Hello,
First, thanks for your help and time!!
In windows 2008, the DNS log is a txt file (dns.log) which is recreated with the same name if the size reach a configurable amount.
There is not more history than the size you actually put, let's say 200mo. Then if you need this log just after 200mo has been reach, you end up with opening the file which is a fresh new empty one (because it has just been recreated).
How can I change that behavior in order to keep a bit more history. (something like DHCP could be great: one log by day of the week recycling every week). I tried to put DNS%date%.log but not sure if possible.
My issue is with Splunk soft (which is collecting DNS log to database), it doesn't support the fact that the same file with the same name is recreating over and over. The log crash (the file disapeer) when using Splunk. Splunk keeps a "SHARE_DELETE" flag on the DNS.log which makes windows fail to create the file with the same name until Splunk release it. And Splunk do not release the file in time.
Is someone came through that issue?
Thanks for your help and good day!
Greg.
