you need to aarchive the security log for each server on daily basis