using powershell to set an event logs "Maximum Size" action

Question

When viewing an Event Logs properties (in Server 2008) you can set three actions for what to happen when the maximum event log size has been reached:

• Overwrite events as needed
• Archive the log when full
• Do not overwrite events

Using Powershell I can use limit-eventlog to set the event log retention to set the OverflowAction to DoNotOverwrite or OverwriteAsNeeded, but I cannot seem to be able to get the Archive the log when full action selected.

Any ideas how I could select this option via powershell?

Answer 1

The only way (IMO) is to modifying the registry. Here an example to set 'Archive the log when full' action for the Application log:

new-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application `
-name AutoBackupLogFiles -Value 1 -PropertyType 'dword'

if the options have been selected previously, the key is already present so just need set to 1 the key value:

set-ItemProperty -path HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application `
    -name AutoBackupLogFiles -Value 1