3.1 KiB
title, description, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, author
| title | description | ms.pagetype | ms.prod | ms.mktglfcycl | ms.sitesec | author |
|---|---|---|---|---|---|---|
| 1105(S) Event log automatic backup. (Windows 10) | Describes security event 1105(S) Event log automatic backup. | security | w10 | deploy | library | Mir0sh |
1105(S): Event log automatic backup.
Applies to
- Windows 10
- Windows Server 2016
Subcategory: Other Events
Event Description:
This event generates every time Windows security log becomes full and new event log file was created.
This event generates, for example, if the maximum size of Security Event Log file was reached and event log retention method is: “Archive the log when full, do not overwrite events”.
Note
For recommendations, see Security Monitoring Recommendations for this event.
Event XML:
- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Eventlog" Guid="{fc65ddd8-d6ef-4962-83d5-6e5cfe9ce148}" />
<EventID>1105</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>105</Task>
<Opcode>0</Opcode>
<Keywords>0x4020000000000000</Keywords>
<TimeCreated SystemTime="2015-10-16T00:50:12.715302700Z" />
<EventRecordID>1128551</EventRecordID>
<Correlation />
<Execution ProcessID="820" ThreadID="3660" />
<Channel>Security</Channel>
<Computer>DC01.contoso.local</Computer>
<Security />
</System>
- <UserData>
- <AutoBackup xmlns="http://manifests.microsoft.com/win/2004/08/windows/eventlog">
<Channel>Security</Channel>
<BackupPath>C:\\Windows\\System32\\Winevt\\Logs\\Archive-Security-2015-10-16-00-50-12-621.evtx</BackupPath>
</AutoBackup>
</UserData>
</Event>
Required Server Roles: None.
Minimum OS Version: Windows Server 2008, Windows Vista.
Event Versions: 0.
Field Descriptions:
Log [Type = UnicodeString]: the name of the log which was archived (new event log file was created and previous event log was archived). Always “Security” for Security Event Logs.
File: [Type = FILETIME]: full path and filename of archived log file.
The format of archived log file name is: “Archive-LOG_FILE_NAME-YYYY-MM-DD-hh-mm-ss-nnn.evtx”. Where:
-
LOG_FILE_NAME – the name of archived file.
-
Y – years.
-
M – months.
-
D – days.
-
h – hours.
-
m – minutes.
-
s – seconds.
-
n – fractional seconds.
The time in this event is always in GMT+0/UTC+0 time zone.
Security Monitoring Recommendations
For 1105(S): Event log automatic backup.
- Typically it’s an informational event and no actions are needed. But if your baseline settings are not set to Archive the log when full, do not overwrite events, then this event will be a sign that some settings are not set to baseline settings or were changed.