Archiving an Event Log
To archive an event log, use the following procedures:
Open Event Viewer as described in the previous subsection.
In the console tree, click the log that is to be archived.
On the Action menu, click Save Log File As. A Save logname As window will appear.
In the File name: dialog box, enter a name for the archived log file.
In the Save as type: drop down menu, select a file format.
If the log is archived in log-file format, it can be reopened it in Event Viewer. Logs saved as event log files (*.evt) retain the binary data for each event recorded.
If the log is archived in text or comma-delimited format (*.txt and *.csv, respectively), it can reopened in other programs such as word processing or spreadsheet programs. Logs saved in text or comma-delimited format do not retain the binary data.
If the file is to be saved in a location other than the default, use the Save in drop down menu to save the audit log in an alternate location.
Click Save.
After the log has been archived, the original may be deleted by clearing the log as described "Configuring the Event Log" subsection. This will free up disk space and reinitiate the event log.