Powershell – How do -RetentionDays and -MaximumSize parameters work in Limit-EventLog in PowerShell

powershellwindows-server-2012

I want to increase the size of the Windows Application Log using Powershell and intend to use Limit-EventLog. I must keep at least 7 days of logs and have plenty of disk space (at least up to the 4GB limit). My question is if I run a command like this:

Limit-EventLog -LogName "Application" -MaximumSize 4092MB -RetentionDays 7 -OverflowAction "OverwriteOlder"

If there are events in the event log older than 7 days, and there is lots of free space, does Windows keep the oldest records, or does it start overwriting events older than 7 days? If I have reached a 7 days retention period I don't want to grow the log unnecessarily.

I'm unsure how these two parameters work together and the documentation is not explicit enough.

Best Answer

My understanding from setting this using local security policy (GPO) which I'm guessing will be the same behavior is that it will overwrite firstly if it gets to the maximumsize or if the maximumsize is not met it will start to overwrite after 7 days.

Related Solutions

Windows PowerShell – How to Diff Two Text Files

Figured it out myself. Because Powershell works with .net objects rather than text, you need to use get-content to expose the contents of the text files. So to perform what I was trying to do in the question, use:

compare-object (get-content one.txt) (get-content two.txt)

Powershell – Piping powershell messages to Write-EventLog

What kind of data does the cmdlet return? You could save it into a string like so,

$ret = Get-ClubMembers -Whatever...
Write-EventLog -LogName "Windows Powershell" -Source "Powershell" -Message $ret -EventId 0

If the data returned is an array, you must create an ordinary string first. Othervise, the log message will just contain the array name. Maybe something like this

$ret = Get-ClubMembers -Whatever...
Write-EventLog -LogName "Windows Powershell" -Source "Powershell" -Message $($ret -join [Environment]::NewLine) -EventId 0

Ed:

As far as I know - and I'd really like to be wrong in this one - you have run into a nasty limitation of Powershell. Keith Hill's blog has kind of a work-around. You mentioned that the cmdlet is a custom one. Maybe you could ask its developer to add a switcht that toggles the messages to stdout, so that executing the cmdlet would return its output as an easily logged string array.

Best Answer

Related Solutions

Windows PowerShell – How to Diff Two Text Files

Powershell – Piping powershell messages to Write-EventLog

Related Topic