Event Log Settings

In Group Policy, I have these defined:

Maximum security log size 81920
Retain security log 7 days (<-- overwrite events
older than)
Retention method for security log As needed (<-- overwrite events
as needed. The option two options are 'Overwrite events by days' and
'Do not overwrite events')

So what happens if the security log grows to be 8200kb but is more than
7 days old? Does 'as needed' apply to wrapping the events based on
maximum log size, while 'Overwrite events older than 7 days' only
applied if 'Retention method for security logs' is set to 'Overwrite
events by days'?
.

Relevant Pages

  • Re: Security Log Question & Hotfix?
    ... Or are the properties being set in Group Policy perhaps? ... Anthony, http://www.airdesk.co.uk ... I've set up my security log to overwrite events as needed, ...
    (microsoft.public.windows.server.general)
  • Re: SECURITY LOG IS FULL MESSAGE
    ... >> Rume; ... Clearing the>> log is one way to free the log and start recording new events]]>> ... To overwrite events, on the Action menu,>> click Properties, and then click Overwrite events as needed. ... Sometimes they receive the following>>> message when they try to logon: Security log is full>>> contact your System Administrator. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Event Viewer stopped logging security audit
    ... of when "maximum log size is reached" in the properties of the security log. ... The options are - overwrite events as needed, ... > event viewer in the section Security. ... I checked the auditing event to see ...
    (microsoft.public.win2000.security)
  • Re: Event Log Settings
    ... it will overwrite events older than X days. ... Maximum security log size 81920 ... Retain security log 7 days (<-- overwrite events ... Retention method for security log As needed (<-- overwrite events ...
    (microsoft.public.security)
  • Re: Really no answer?
    ... >Sometimes helps if you clear the security log. ... >its setting to "overwrite events as necessary". ... >HTH ... flakey, possibly related to the fact that WMI thinks it needs to ...
    (microsoft.public.windowsxp.security_admin)