Windows Event ID 1085 – EventLog: Event Log Service Automatic Backup

Start by examining the specific Event ID 1085 entry to understand which log was backed up and when.

1. Open Event Viewer by pressing Win + R, typing eventvwr.msc, and pressing Enter
2. Navigate to Windows Logs → System
3. Filter the current log by clicking Filter Current Log in the Actions pane
4. Enter 1085 in the Event IDs field and click OK
5. Double-click the most recent Event ID 1085 entry to view details
6. Note the log name and backup file path shown in the event description
7. Check the backup file location, typically C:\Windows\System32\winevt\Logs\Archive-[LogName]-[Timestamp].evtx

Use PowerShell to get detailed information about recent backup events:

Get-WinEvent -FilterHashtable @{LogName='System'; Id=1085} -MaxEvents 10 | Select-Object TimeCreated, Id, LevelDisplayName, Message | Format-Table -Wrap

Examine the current log size settings and modify them if backups are occurring too frequently.

1. Open Event Viewer and navigate to the log mentioned in the Event ID 1085 message
2. Right-click the log name and select Properties
3. Review the Maximum log size (KB) setting
4. Check the current When maximum event log size is reached option
5. To increase log size, modify the value (recommended: 20480 KB for Application/System logs)
6. Consider changing retention policy to Overwrite events as needed if historical data isn't critical

Use PowerShell to check log configurations across multiple logs:

Get-WinEvent -ListLog * | Where-Object {$_.RecordCount -gt 0} | Select-Object LogName, MaximumSizeInBytes, LogMode | Sort-Object LogName

Modify log size programmatically:

# Set Application log to 50MB
Limit-EventLog -LogName Application -MaximumSize 52428800

# Check current settings
Get-EventLog -List

Identify what's causing rapid log growth to address the root cause rather than just managing symptoms.

1. Open the backed-up log file mentioned in Event ID 1085
2. In Event Viewer, click Action → Open Saved Log
3. Browse to the backup file location and open the archived .evtx file
4. Analyze the event sources and frequency patterns
5. Look for repetitive events or verbose logging from specific applications

Use PowerShell to analyze event frequency by source:

# Analyze Application log event sources
Get-WinEvent -LogName Application -MaxEvents 10000 | Group-Object ProviderName | Sort-Object Count -Descending | Select-Object Name, Count

# Check for high-frequency events in the last 24 hours
$StartTime = (Get-Date).AddDays(-1)
Get-WinEvent -FilterHashtable @{LogName='Application'; StartTime=$StartTime} | Group-Object Id | Sort-Object Count -Descending | Select-Object Name, Count -First 10

For Security log analysis:

# Identify top security event types
Get-WinEvent -LogName Security -MaxEvents 5000 | Group-Object Id | Sort-Object Count -Descending | Select-Object Name, Count -First 15

Implement more sophisticated log management through Group Policy or registry modifications.

1. Open Group Policy Editor by running gpedit.msc
2. Navigate to Computer Configuration → Administrative Templates → Windows Components → Event Log Service
3. Configure policies for specific logs under the appropriate subfolder (Application, Security, System)
4. Set Maximum Log Size and Log Retention Method policies
5. Enable Control Event Log behavior when the log file reaches its maximum size

Registry-based configuration for advanced scenarios:

# Check current registry settings for Application log
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application" -Name MaxSize, Retention

# Set Application log to 100MB with overwrite policy
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application" -Name MaxSize -Value 104857600
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application" -Name Retention -Value 0

Configure custom retention for specific logs:

# Create a custom retention policy
$LogName = "Application"
wevtutil sl $LogName /ms:104857600 /rt:false

Deploy enterprise-level solutions to manage log data more effectively and reduce local storage pressure.

1. Configure Windows Event Forwarding (WEF) to centralize logs
2. Set up a collector server to receive forwarded events
3. Create custom event subscriptions for critical events
4. Implement log rotation and archival policies on the collector

Configure Event Forwarding on source computers:

# Enable WinRM for event forwarding
winrm quickconfig -q

# Configure the forwarder service
wecutil qc /q

# Create a subscription (run on collector server)
wecutil cs subscription.xml

Example subscription XML configuration:

<Subscription xmlns="http://schemas.microsoft.com/2006/03/windows/events/subscription">
    <SubscriptionId>SystemEvents</SubscriptionId>
    <SubscriptionType>SourceInitiated</SubscriptionType>
    <Description>Forward System Events</Description>
    <Enabled>true</Enabled>
    <Uri>http://schemas.microsoft.com/wbem/wsman/1/windows/EventLog</Uri>
    <ConfigurationMode>Custom</ConfigurationMode>
    <Query><![CDATA[
        <QueryList>
            <Query Id="0">
                <Select Path="System">*[System[Level=1 or Level=2 or Level=3]]</Select>
            </Query>
        </QueryList>
    ]]></Query>
</Subscription>

Monitor forwarding status:

# Check subscription status
wecutil gr SystemEvents

# View forwarded events
Get-WinEvent -LogName "ForwardedEvents" -MaxEvents 50