So I'm working to grab DNS logs from our Domain Controller for the purpose of sending them to our SIEM. This has been successfully, however, due to the limitations of Microsoft, it's required that the settings are set to "Do not overwrite events (clear manually)".
This is a problem for the domain controller, since the logs will continue to build up overtime and fill up the server. I need to automate the process of clearing the logs on a scheduled basis.
Log that I'm trying to clear - %SystemRoot%\System32\Winevt\Logs\Microsoft-Windows-DNSServer%4Analytical.etl
My first approach was to user Powershell to disable the logging service for a short time, remove that file, and then have the service reenabled. However, I found that even after disabling the service, Windows does not allow me to delete the logs.
My colleague found that temporarily disabling and reenabling logging in the settings will clear out the file.
I'm fairly new to Powershell and I'm willing to learn from this, but I was wondering anyone had any insight as to how to clear this .etl file? Or perhaps using the method that my colleague proposed to disable and reenable logs, is there a way to automate this through Powershell?
Thank you so much for your input!
