Security Event Log Stop Logging Events When It Is Full

[sunt]

Hi Experts,
I am having a problem on security event log.
I found that when the server's security event log full, the event log will stop to log other further security event log. However, there is no message / alert which alert administrator about the security log get full nor record a event in system log.
Due to the audit issue, we can't set it to overwrite as needed.
We must manually clear the security event after we dump the events to a file. Is there any way to get around this?
such as : alert the administrator, log a event in system log.
Thanks a lot!
Sunt

 

[tahoe2]

Open event viewer and click on LOG. Choose LOG SETTINGS. from that window, you can set parameters for all logs.


Hope this helps!

Corie

 

[sunt]

According to our company audit policy, we can't set to other setting except manually clear the log. the problem I found is whenever the security log get full, it will stop logging any further security event. Moreover, the system log will not log the security log is full. (As we know if application log is full, it will log an event into the system log, but not for security.)