Recipe 8.4. Viewing the Size of an Event LogProblemYou want to find the size of an event log. SolutionUsing a graphical user interface
Using a command-line interfaceThis command displays the file size for all of the event logs that are stored in the default location on the file system: > dir %systemroot%\system32\config\*evt Using VBScript' This code displays the size of the specified event log in KB ' ------ SCRIPT CONFIGURATION ------ strLog = "LogName>" ' e.g., Security strServer = "<ServerName>" ' e.g., fs01 (use "." for local server) ' ------ END CONFIGURATION --------- set objWMI = GetObject("winmgmts:\\" & strServer & "\root\cimv2") set colLogs = objWMI.ExecQuery("Select * from Win32_NTEventlogFile Where : & _ Logfilename = '" & strLog & "'") if colLogs.Count > 1 then WScript.Echo "Fatal error. Number of logs found: " & colLogs.Count WScript.Quit end if for each objLog in colLogs WScript.Echo strLog & " size: " & objLog.FileSize / 1024 & "KB" next DiscussionEach event log has a corresponding event log file, which contains all of the event log messages (stored in a binary format). The size of an event log is determined by viewing the size of its event log file. By default, the %systemroot%\system32\config\ directory contains these files. Each file name directly corresponds to the name of the event log that uses it with an .evt extension (e.g., Application.evt). |