HI - Is it possible to set the Event Logs to this set up in Windows 2008 R2? Audit logs must be retained for a period of x months as defined by the following: retrievable for y month and stored offline for z months. Checking on the Retention Log Policy, it looks like it can only be setup using the Log Size. Thank You!hanging around

Hi, It will not be possible to automate the log retention as per your requirement. You will have to manually save the logsThanks and Regards, Mukesh. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Please VOTE as HELPFUL if the post helps you and remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks for your reply. So is this a limitation of the Windows 2008? Was this possible before with lower versions of Windows server?

Hi Ronsky, I don't think this can be done directly... But you can do it combining log archiving + scripting. 1. Configure evenlog for archiving when log size arrive to determined MB (aprox 1day size) 2. Create a simple script that checks your log repository and delete the file that exceed the policy retention period. Pasted the script: Set objFSO = CreateObject("Scripting.FileSystemObject") strLogFolder="C:\logfolderpath\" set sourcefolder = objFSO.GetFolder(strLogFolder) Set files = sourcefolder.Files for each file in files if file.datelastmodified < date() -90 then 'select days, in this case 90days = 3months objFSO.deletefile file end if next set objFSO=nothing You can save this script as vbs and schedule to be executed daily, so in this case, evt files that exceeds the retention time will be deleted as the new one are archived by the log policy. Hope it helps, just an idea. Regards, Julio Rosua

Thanks guys for the info :D