Remote Event Log Management

Is it possible to use Hyena to perform remote Event log management - More specifically, select a group of servers and change a particular log to "Overwrite as needed"?

Thanks,
Ralph

[cmccullough]

Re: Remote Event Log Management

You should be able to do this with WMI. In Hyena you would need the Enterprise Edition for this functionality, and you can run WMI against multiple computers at once.

[kstanush]

Re: Remote Event Log Management

Assuming you have the Enterprise Edition, to try this on one computer, expand the computer in the left window, expand the WMI, then double-click on the Win32_NTEventLogFile class. The resulting output will contain the properties for this class. The one you want is named OverwriteOutdated.

I believe that a value of '0' indicates that the log data can be overwritten as needed. You can verify this by looking at some logs that are setup the way you want. If you doubleclick on any selected entries in the right window, you can change any property that has a 'writable' icon indicator next to it.

To do this on multiple computers, just display the computers in Hyena's right window, right click, select WMI->Execute WMI Query, and select the class and query name. When the data has been displayed, just select all of the event logs that need to be changed and make the change.

Let us know if this works for you.

Re: Remote Event Log Management

Sounds great. I'll give it a try and report back via the forum. Thank you for the fast replies..!

Ralph

Re: Remote Event Log Management

That method addressed and solved my problem perfectly. Thanks a million.

Ralph