Skip to main content

Configure Security Event Log

Configure the security event log path, maximum size, and retention on your Dell Data Storage device so that you don't lose audit data when the log fills. Create the file system in the Dell Web UI, configure the registry values in Registry Editor, then verify them in the Computer Management console.

Create the file system for the security log

Step 1 – In the Dell Web UI, navigate to Storage → File → File System and click + to create a file system. Name it events and set its size to at least 4 GiB. This file system stores the security log.

Step 2 – Confirm that the account you specified for data collection in the monitoring plan can read the share at \\<file_server_name>\C$\events.

Configure Event Log values in Registry Editor

Step 1 – On the computer that hosts Auditor Server, open Registry Editor: navigate to Start → Run and type regedit.

Step 2 – Navigate to File → Connect Network Registry and specify <file_server_name>.

Step 3 – Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security.

Step 4 – Set the File value to C:\events\security.evt.

Step 5 – Set the MaxSize value to ffff0000 (hexadecimal) or 4294901760 (decimal). Select the matching Base option in the Edit DWORD Value dialog before you enter the value.

Step 6 – Set the Retention value to 0. The value is the same in hexadecimal and decimal. This configures the log to overwrite events as needed instead of retaining them.

Verify Event Log settings in the Computer Management console

Step 1 – On the computer that hosts Auditor Server, open Computer Management: navigate to Start → Run and type compmgmt.msc /computer=<file_server_name>. Alternatively, right-click Start, select Computer Management, then right-click Computer Management (Local), select Connect to another computer, and specify <file_server_name>.

Step 2 – Navigate to System Tools → Event Viewer → Windows Logs, then right-click Security and select Properties.

Step 3 – Confirm the following values:

  • Log name: \\<file_server_name>\C$\events\security.evt
  • Maximum log size: 4,194,240 KB
  • Overwrite events as needed: selected

If any value doesn't match, correct it in Registry Editor and reopen this dialog.

note

The Security Properties dialog fields map to the following registry values:

Security Properties fieldRegistry value
Log nameFile
Maximum log sizeMaxSize (4,294,901,760 bytes = 4,194,240 KB)
Overwrite events as neededRetention = 0

The MaxSize registry value uses bytes, while Maximum log size in Security Properties uses KB. You can't change Log name from the Security Properties dialog — use Registry Editor instead.