Ok a basic question i hope...
Background
There is currently a plan to implement auditing on one of the networks i am managing they would like to set the event viewer to retain events for 31 day's
Question
What would be the suggested site of the log files? also what would happen if the event log was full but none of the files were over 31 day's old...
Hopefully a simple question haven't come across this before tho :)