Eventlog

If you select an eventlog, you can:

• Save it.
• Erase it: this action is irreversible.
• Save and erase it.
• Dump it.
• Define an action.
• Display or refresh the events list.
• Get properties and set the maximum size and the wrapping of the log (You can only change the size and the retention if you are an administrator).
  

Some particular properties:

• Number of the first event: If this number is not 1, that means that the oldest events have been automatically erased by the system.
• The date of the last erase/save/dump is the date of the last successful actions that has been made with the WDumpEvt tool, or the LogSched service.
• Wrapping: It define what Windows NT should do when the eventlog is full between this three choices:
  • Overwrite Events as Needed.
    When selected, ensures that all new events are written to the log, even when the log is full. Each new event then replaces the oldest event.
    This option is the best choice for ease of maintenance and is the default.
  • Overwrite Events Older than x Days.
    When selected, retains a log for a specific number of days before overwriting it. You can set the number of days before a log can be overwritten, using numbers from 1 to 365.
    The default setting for this option is 7 days. This is the best choice if you want to archive log files weekly.
  • Do Not Overwrite Events.
    When selected, retains all existing events when the log is full.
    This option requires that you manually clear the log. Click this option only if you must retain all events