you need to archive the security log for each server on a daily basis