Solved

Grow time storage log event security

Posted on 2010-09-10
10
239 Views
Last Modified: 2013-11-05
Dear,

I made GPO for all my desktop and servers, hold log security event for 40 days, I change maximum log size for 499968 KB but I seen that my server doesn't hold more that two  days .

How solve this problem ?

Bruno Steven
0
Comment
Question by:aspenbr
  • 5
  • 5
10 Comments
 
LVL 13

Expert Comment

by:George Sas
Comment Utility
Are you sure the gpo is applied to your servers ?
Are you talking about server as a member server or Domain Controllers ?
Try to run a "gpresult /r" and see if your GPO is applied to the server with the problem.
0
 
LVL 1

Author Comment

by:aspenbr
Comment Utility
The GPO was applied , no problems . The server are member server and domain Controllers
0
 
LVL 13

Expert Comment

by:George Sas
Comment Utility
So you have same problem on both member servers and DC's ?
How long ago did you applied the GPO ? Did you rebooted any of the servers after applying the GPO ?
0
 
LVL 13

Expert Comment

by:George Sas
Comment Utility
What OS are you running on your DC's ?
0
 
LVL 1

Author Comment

by:aspenbr
Comment Utility
OS is Windows 2003 r2 Standard . I don't have problem with GPO application only policy . I need increase volume for storage event of security log , the limit isn't enough for hold log for 40 day .  
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 
LVL 13

Accepted Solution

by:
George Sas earned 250 total points
Comment Utility
0
 
LVL 1

Author Comment

by:aspenbr
Comment Utility
Thank GeoSs , but this template work only CrashOnAuditFail enable, isn't my case. I change storage limit for 1 GB . The model is nice, but model (adm) doesn't work when storage limit was reached. Do have you know change the MODEL for this ?


0
 
LVL 1

Author Comment

by:aspenbr
Comment Utility
I have idea, on linux the is tool logrotate that break log for syslog storage log on new file. Do you know some tool work like logrotate on Windows system  ?
0
 
LVL 13

Expert Comment

by:George Sas
Comment Utility
aspenbr: you are totally wrong here !

You can use the :
"Backup Log Automatically when full" option in the GPO.
This will save old event logs automatically and start a new one.
Have you even tried ??

This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the “Retain old events” policy setting is enabled.

If you enable this policy setting and the “Retain old events” policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started.

If you disable this policy setting and the “Retain old events” policy setting is enabled, then new events are discarded and the old events are retained.

When this policy setting is not configured and the “Retain old events” policy setting is enabled, new events are discarded and the old events are retained.
0
 
LVL 1

Author Comment

by:aspenbr
Comment Utility
Sorry , I am wrong , the GPO work fine , all logs more big that 400 MB create a new file for storage security event.

Thank very much .
0

Featured Post

Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

Join & Write a Comment

Recently, I had the need to build a standalone system to run a point-of-sale system. I’m running this on a low-voltage Atom processor, so I wanted a light-weight operating system, but still needed Windows. I chose to use Microsoft Windows Server 200…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now