8.4. Viewing the Size of an Event Log

Problem

You want to find the size of an event log.

Solution

Using a graphical user interface

  1. Open the Event Viewer (eventvwr.msc).

  2. In the left pane, right-click on the target event log and select Properties.

  3. The Size field contains the size of the event log in kilobytes and bytes.

Using a command-line interface

This command displays the file size for all of the event logs that are stored in the default location on the file system:

> dir %systemroot%\system32\config\*evt

Using VBScript

' This code displays the size of the specified event log in KB
' ------ SCRIPT CONFIGURATION ------
strLog = "LogName>"         ' e.g., Security
strServer = "<ServerName>"  ' e.g., fs01 (use "." for local server)
' ------ END CONFIGURATION ---------
set objWMI = GetObject("winmgmts:\\" & strServer & "\root\cimv2")
set colLogs = objWMI.ExecQuery("Select * from Win32_NTEventlogFile Where : & _
                               Logfilename = '" & strLog & "'")
if colLogs.Count > 1 then
   WScript.Echo "Fatal error.  Number of logs found: " & colLogs.Count
   WScript.Quit
end if
for each objLog in colLogs
   WScript.Echo strLog & " size: " & objLog.FileSize / 1024 & "KB"
next

Discussion

Each event log has a corresponding event log file, which contains all of the event log messages (stored in a binary format). The size of an event log is determined by viewing the size of its event log file. By default, the %systemroot%\system32\config\ directory contains these files. Each file name directly corresponds to the name of the event ...

Get Windows Server Cookbook now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.