Event Viewer question

[serverguy78]

Hello, I was wondering if it is possible to change this code so that it checks Overwrite events as needed instead of Overwrite events older than 14 days?

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
   & "{impersonationLevel=impersonate,(Security)}!\\" & _ 
   strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery("Select * from Win32_NTEventLogFile")

For each objLogfile in colLogFiles
   strLogFileName = objLogfile.Name
   Set wmiSWbemObject = GetObject("winmgmts:{impersonationLevel=Impersonate}!\\.\root\cimv2:" _
      & "Win32_NTEventlogFile.Name='" & strLogFileName & "'")
   wmiSWbemObject.MaxFileSize = 2500000000
   wmiSWbemObject.OverwriteOutdated = 14
   wmiSWbemObject.Put_

Next

 

[guitarzan]

1 minute on Google brought me here:

http://technet.microsoft.com/en-us/library/ee176687.aspx

 

[serverguy78]

You must have used better search terms than me. I been researching on Google for about two weeks. Thanks.

 

[guitarzan]

No problem. I just used OverwriteOutdated as the search term. Pretty nice page, rare to see a page that actually shows screenshots of what the corresponding code affects.

 

[serverguy78]

Yeah I know.