Recipe8.5.Setting the Maximum Size of an Event Log

Recipe 8.5. Setting the Maximum Size of an Event Log

Problem

You want to set the maximum event log size. You need to make sure you size the event logs properly so they do not consume more disk space than necessary.

Solution

Using a graphical user interface

1. Open the Event Viewer (eventvwr.msc).

2. In the left pane, right-click on the target event log and select Properties.

3. Beside Maximum Log Size, enter the maximum size in kilobytes that the event log can grow to.

4. Click OK.

Using a command-line interface

Modify the registry using the following command:

> reg add \\<ServerName>\HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\ <LogName> /t REG_DWORD /v MaxSize /d <SizeInBytes>

Replace <LogName> with the name of the event log you want to configure and <SizeInBytes> with the maximum size the log can grow to.

Using VBScript

' This code sets the maximum size for an event log. ' ------ SCRIPT CONFIGURATION ------ strLog = "<LogName>"           ' e.g., Application intSizeBytes = <SizeInBytes>   ' e.g., 1024 * 512  (512KB) strServer = "<ServerName>"     ' e.g., fs01 (use "." for local server) ' ------ END CONFIGURATION --------- set objWMI = GetObject("winmgmts:\\" & strServer & "\root\cimv2") set colLogs = objWMI.ExecQuery("Select * from Win32_NTEventlogFile Where " & _                                "Logfilename = '" & strLog & "'") if colLogs.Count <> 1 then    WScript.Echo "Fatal error.  Number of logs found: " & colLogs.Count    WScript.Quit end if for each objLog in colLogs    objLog.MaxFileSize = intSizeBytes    objLog.Put_    WScript.Echo strLog & " max size set to " & intSizeBytes next

Discussion

The default maximum size of each event log is 512 KB. Depending on how busy your server is and how many services and applications are running, this size may not be sufficient to store all the events that are generated. With disk space so cheap, consider upping the maximum limit to several megabytes. Ultimately, the maximum size of each of your event logs should be large enough to accommodate the number of events that are generated over the retention period (see Recipe 8.6).

You can also set the maximum size of the application, system, and security logs via group policy. These settings can be found at the following location within a group policy object: Computer Configuration\Windows Settings\Security Settings\Event Log\.

See Also

MS KB 216169 (How to Change the Default Event Viewer Log File Location) and MS KB 315417 (HOW TO: Move Event Viewer Log Files to Another Location in Windows 2000)