Limiting Event Log file size



Joe
07-09-2005, 09:25 PM
I am using the EWF RAM mode on my CF drive and redirected the log files to a
512K second drive. I tried limiting the event log file size (Application,
Security and System) using the MaxSize registry parameters. i.e.

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
Name: MaxSize
Type: REG_DWORD
Value: 0x00002000 (8192)

etc...

I disabled the event log service, rebooted and deleted the old log files.
After restarting the service, I expected that the file should be limited to
8K but instead, the system still creates 64k files for all three log files
independent of my settings.

Does this mean that the minimum file size is 64K? i.e. values less than 64K
are not allowed and is this documented somewhere?

Is it a bug? i.e. 64K initial size as opposed to the lower MaxSize parameter
setting?

Can I assume that if I set the limit to 64K that this will be actual maximum?

Thanks,
Joe

KM
07-09-2005, 09:25 PM
Joe,

> I disabled the event log service, rebooted and deleted the old log files.
> After restarting the service, I expected that the file should be limited
> to
> 8K but instead, the system still creates 64k files for all three log files
> independent of my settings.
>
> Does this mean that the minimum file size is 64K? i.e. values less than
> 64K
> are not allowed and is this documented somewhere?


The MaxSize value must be 0x10000 to 0xFFFF0000, in 64K increments.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/eventlog_key.asp

> Is it a bug? i.e. 64K initial size as opposed to the lower MaxSize
> parameter setting?

> Can I assume that if I set the limit to 64K that this will be actual
> maximum?

Yes, you can.

KM


Limiting Event Log file size