CmdID / PowerShell / Cmdlets / Limit
Limit-EventLog
Sets the event log properties that limit the size of the event log and the age of its entries. PowerShell reference
From the PowerShell reference 7 parameters 1 Sigma rule looks for it
What it does
Sets the event log properties that limit the size of the event log and the age of its entries. The Limit-EventLog cmdlet sets the maximum size of a classic event log, how long each event must be retained, and what happens when the log reaches its maximum size. You can use it to limit the event logs on local or remote computers. The cmdlets that contain the EventLog noun (the EventLog cmdlets) work only on classic event logs. To get events from logs that use the Windows Event Log technology in Windows Vista and later versions of Windows, use Get-WinEvent.
Limit-EventLog [-LogName] <String[]> [-ComputerName <String[]>] [-RetentionDays <Int32>] [-OverflowAction <OverflowAction>] [-MaximumSize <Int64>] [-WhatIf] [-Confirm] [<CommonParameters>]Increase the size of an event log
Limit-EventLog -LogName "Windows PowerShell" -MaximumSize 20KBIdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Retain an event log for a specified duration
Limit-EventLog -LogName Security -ComputerName "Server01", "Server02" -RetentionDays 7IdentifyTrips 1 Sigma rule: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Change the overflow action of all event logs
$Logs = Get-EventLog -List | foreach {$_.Log}
Limit-EventLog -OverflowAction OverwriteOlder -LogName $Logs
Get-EventLog -ListIdentifyTrips 2 Sigma rules: highSuspicious Eventlog Clearing or Configuration Change Activity by Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems); mediumEventLog Query Requests By Builtin Utilities by Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Its page in the reference: Limit-EventLog.
Parameters
-ComputerNameSpecifies remote computers. The default is the local computer.
This parameter does not rely on Windows PowerShell remoting. You can use the ComputerName parameter of Limit-EventLog even if your computer is not configured to run remote commands.-LogNameSpecifies the event logs. Enter the log name (the value of the Log property; not the LogDisplayName) of one or more event logs, separated by commas. Wildcard characters are not permitted. This parameter is required.-MaximumSizeSpecifies the maximum size of the event logs in bytes. Enter a value between 64 kilobytes (KB) and 4 gigabytes (GB). The value must be divisible by 64 KB (65536).
This parameter specifies the value of the MaximumKilobytes property of the System.Diagnostics.EventLog object that represents a classic event log.-OverflowActionSpecifies what happens when the event log reaches its maximum size.
The acceptable values for this parameter are:
- DoNotOverwrite: Existing entries are retained and new entries are discarded.
- OverwriteAsNeeded: Each new entry overwrites the oldest entry.
- OverwriteOlder: New events overwrite events older than the value specified by the
MinimumRetentionDays property. If there are no events older than specified by the
MinimumRetentionDays property value, new events are discarded.
This parameter specifies the value of the OverflowAction property of the System.Diagnostics.EventLog object that represents a classic event log.-RetentionDaysSpecifies the minimum number of days that an event must remain in the event log.
This parameter specifies the value of the MinimumRetentionDays property of the System.Diagnostics.EventLog object that represents a classic event log.-ConfirmPrompts you for confirmation before running the cmdlet.-WhatIfShows what would happen if the cmdlet runs. The cmdlet is not run.