Recipe8.4.Viewing the Size of an Event Log

Recipe 8.4. Viewing the Size of an Event Log

Problem

You want to find the size of an event log.

Solution

Using a graphical user interface

1. Open the Event Viewer (eventvwr.msc).

2. In the left pane, right-click on the target event log and select Properties.

3. The Size field contains the size of the event log in kilobytes and bytes.

Using a command-line interface

This command displays the file size for all of the event logs that are stored in the default location on the file system:

> dir %systemroot%\system32\config\*evt

Using VBScript

' This code displays the size of the specified event log in KB ' ------ SCRIPT CONFIGURATION ------ strLog = "LogName>"         ' e.g., Security strServer = "<ServerName>"  ' e.g., fs01 (use "." for local server) ' ------ END CONFIGURATION --------- set objWMI = GetObject("winmgmts:\\" & strServer & "\root\cimv2") set colLogs = objWMI.ExecQuery("Select * from Win32_NTEventlogFile Where : & _                                Logfilename = '" & strLog & "'") if colLogs.Count > 1 then    WScript.Echo "Fatal error.  Number of logs found: " & colLogs.Count    WScript.Quit end if for each objLog in colLogs    WScript.Echo strLog & " size: " & objLog.FileSize / 1024 & "KB" next

Discussion

Each event log has a corresponding event log file, which contains all of the event log messages (stored in a binary format). The size of an event log is determined by viewing the size of its event log file. By default, the %systemroot%\system32\config\ directory contains these files. Each file name directly corresponds to the name of the event log that uses it with an .evt extension (e.g., Application.evt).