Send your events log to sql

Recently I had to turning on auditing on a file server. However turning on auditing was fine but what to do with the logs. The max recommended size for logs are 65Mb. However within 4 hours I was hitting that 65MB limit, and my oldest logs would start erasing. There are some tools out there that can help you, but nothing beats building your own. While I was researching how to archive my logs in a format I want, I stumbled on LogParser by Microsoft. This tools allows you to save your logs to SQL, CSV, TXT and provides only the information you want. All I wanted archived was the date/time stamp, the user, and what they did. This tool helped me accomplish that. I highly recommend you try it, if you need to archive, or audit logs. Click here to download from Microsoft, or here LogParser.msi to download from this site. Below is a code I used to extract the security log with the time stamp,  eventid, sid, and the message into a file.

LogParser “SELECT TimeGenerated, EventID, SID, Message INTO c:\temp\security.txt FROM \\SERVERNAME\security” -resolveSIDs:ON