How to set the Windows 2000 event log size?
Created 2003-04-14 by Rainer Gerhards.
I know that the Windows event log size settings are not optimal. So how can I change them and what are better values?
Indeed, the default settings are just 512 KB and overwrite after 7 days. While the 512 KB settings do not actually pose a problem the 7 day overwrite does. Effectively, this means that no new records will be added to the event log as long as records younger than 7 days fill up the log. They can not be overwritten with this setting. As such, the new ones are simply lost.
With MonitorWare Agent and EventReporter, event log records are quickly picked up from the Windows event logs and forwarded to a central server. As such, there is no concern with older records being overwirtten. For that reason, we recommend to set the log setting to "overwrite as needed". Just as a general idea, we also recommend setting the log size to 4096 KB, as this allows for some local storage on the system in question (but this is not critical).
If you would like to see how these settings can be made, you can watch a short video sequence demoing this.