2.5 Customizing the Event Log
The properties of an event log can be
configured. In Event Viewer, the properties of a log are defined by
general characteristics: log path, current size, date created, when
last modified or accessed, maximum size, and what should be done when
the maximum log size is reached.
To customize the event
log, access the properties of the particular log by highlighting the
log and selecting Action and then Properties. Alternatively, you can
right-click the log and select Properties to display the General tab of
the log’s property page, as shown in Figure 3.
Figure 3. Selecting properties for the event log.
The Log Size section specifies the maximum
size of the log and the subsequent actions to take when the maximum log
size limit is reached. The three options are as follows:
• Overwrite Events as Needed (Oldest Events First)
• Archive the Log When Full, Do Not Overwrite Events
• Do Not Overwrite Events (Clear Logs Manually)
If you select the Do Not Overwrite Events
option, Windows Server 2012 stops logging events when the log is full.
Although Windows Server 2012 notifies you when the log is full, you
need to monitor the log and manually clear the log periodically so that
new events can be tracked and stored in the log file.
In addition, log file sizes must be specified
in multiples of 64KB. If a value is not in multiples of 64KB, Event
Viewer automatically sets the log file size to a multiple of 64KB.
When you need to clear the event log, click the Clear Log button in the lower right of the property page.
Understanding the Security Log
Effectively logging an accurate and
wide range of security events in Event Viewer requires an understanding
of auditing in Windows Server 2012. It is important to know events are
not audited by default. You can enable auditing in the local security
policy for a local server, the domain controller security policy for a
domain controller machine, and the Active Directory (AD) Group Policy
object (GPO) for a domain. Through auditing, you can track Windows
Server 2012 security events. It is possible to request that an audit
entry be written to the security event log whenever certain actions are
carried out or an object such as a file or printer in AD is accessed.
The audit entry shows the action carried out, the user responsible for
the action, and the date and time of the action.
