There are Syslog services out there for free, (which may be against your security policy), that will send the event logs to a Syslog server - and therefore in a text format which is a lot less disk intensive. You can then tell the local logs to overwrite themselves at 500k if you like - no big deal, the text file still holds the log entries. I log almost everything and make about 130Mb of text a day weekdays and 60-70Mb a weekend in a 600 user network.... I could cut that down a lot but I like the addidional detail.