Hi Everyone,
I have a requirement to enable and collect DNS Analytical logs from Event Viewer to ArcSight (SIEM tool). I am able to fetch the logs but I have select "Do not overwrite events (Clear logs manually)" because that is what is recommended. If I select the option of Overwriting logs and clear based on the old events, I am unable to fetch the logs.
https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn...
The above link is of the article which recommends to use the option of not overwriting events.
Now, since the file size is huge and it is not feasible to delete older logs manually, we need some PowerShell script or some other mechanism to delete the old logs and that script can be scheduled using task scheduler to automate.
Is there any way I can delete certain dated old logs (ex: logs older than 1 hour) and achieve my requirement?
Regards,
Mitesh Agrawal
