Check for full logs and rotated events

[YamatoSecurity]

Give warnings on files that are full due to small file sizes and have their events rotated.

[fukusuket]

memo:

PS C:\test> wevtutil gl System
name: System
enabled: true
type: Admin
owningPublisher:
isolation: System
channelAccess: O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)
logging:
  logFileName: %SystemRoot%\System32\Winevt\Logs\System.evtx
  retention: false
  autoBackup: false
  maxSize: 20971520
publishing:
  fileMax: 1
PS C:\test> Get-WinEvent -ListLog System | Format-List -Property *


FileSize                       : 2166784
IsLogFull                      : False
LastAccessTime                 : 2025/03/12 18:46:45
LastWriteTime                  : 2025/03/12 18:46:45
OldestRecordNumber             : 1
RecordCount                    : 2258
LogName                        : System
LogType                        : Administrative
LogIsolation                   : System
IsEnabled                      : True
IsClassicLog                   : True
SecurityDescriptor             : O:BAG:SYD:(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;0x3;;;BO)(A;;0x5;;;SO)(A;;0x1;;;IU)(A;;0x3;;;SU)(A;;0x1;;;S-1-5-3)(A;;0x2;;;S-1-5-33)(A;;0x1;;;S-1-5-32-573)
LogFilePath                    : %SystemRoot%\System32\Winevt\Logs\System.evtx
MaximumSizeInBytes             : 20971520
LogMode                        : Circular
OwningProviderName             :
ProviderNames                  : {ACPI, AFD, Application Management Group Policy, Application Popup...}
ProviderLevel                  :
ProviderKeywords               :
ProviderBufferSize             : 64
ProviderMinimumNumberOfBuffers : 0
ProviderMaximumNumberOfBuffers : 16
ProviderLatency                : 1000
ProviderControlGuid            :