Diagnose log rotation and retention#

When to use this procedure#

Use when files do not rotate or retention cannot rename/delete eligible files.

This procedure applies to WinSyslog.

Use an account that can read the product configuration and Windows diagnostic state.
Replace angle-bracket placeholders with values from the affected system.

Configuration Client > the service, rule, or action named on the Event ID page.

Record active path, trigger, naming pattern, and retention settings.

Expected result: The affected object and its effective settings are identified.

If it fails: Return to the complete Event Log detail and configuration export before changing settings.
Run the native Windows checks below from the affected product host.
```
Get-ChildItem -LiteralPath '<LOG_DIRECTORY>' | Sort-Object LastWriteTime | Format-Table Name,Length,LastWriteTime
Get-Acl -LiteralPath '<LOG_DIRECTORY>' | Format-List AccessToString
```
Expected result: A controlled rotation creates the expected file, active output continues, and only eligible files are removed.

If it fails: Correct ACLs, naming conflicts, timing, free space, or external handle interference.
Perform one uniquely identifiable product test through the same service, rule, or action.

Expected result: The intended destination records the test exactly once.

If it fails: Collect the first new product event and bounded debug output; do not change unrelated settings.

Repeat the affected operation, confirm its positive output, and verify that queues, collection positions, or remote delivery continue normally.

The complete Event Log entry and neighboring product events with timestamps.
The command output, relevant configuration export, and bounded debug log from the same interval.