I have a question regarding DUMPEVT and not clearing the event logs. We are set to overwrite as needed.

Let's say I run DUMPEVT without the /all option.

Then, before I run it next, some of the oldeset events are overwritten but all of the overwritten events have already been dumped that run of DUMPEVT.

When I next run DUMPEVT will it dump all or just the ones that have not been dumped? In other words, as long as the overwrite has not overwritten higher numbered records than the number stored in the registry, what will happen all or just the "undumped"?

I'm working on a configuration for a solution so I've not yet tested this and am wondering if I can find out this way instead of through testing.