Configure event log programmatically

F

Franz Häring

Hi,

I use an event log to protocol parameter changes. I create a dedicated event
log if it doesnt exist and write events to it. Now the problem: The default
setting of the event log is to overwrite entries if older than 7 days. This
leads to log file overflow under certain circumstances. As the software is
used in industrial control devices, this cannot be tolerated. I know how to
change the setting in the event viewer, but I must change it
programmatically when the log is created.

How can I change the settings of an event log programmatically?

Please send a copy of your response by email.

Franz
 
Y

Yan-Hong Huang[MSFT]

Hello Franz,

As far as I know, there's no direct method in .NET class library to
increase the size of a specified event log. However, if you have the
appropriate permissions, you can directly write to the registry to modify
the appropriate event log properties.
(using the Microsoft.Win32.Registry and Microsoft.Win32.RegistryKey classes)

Under the registry key of the appropriate event log, modify the 'MaxSize'
and 'Retention' values to modify the values of the properties you mentioned.

For example, to modify the size of the Application Event log, you'll have
to change the value of the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Ma
xSize registry key.

MaxSize would be 512K upwards in 64K chunk increments. Retention values
would be:
0x00000000 for "Overwrite Events as needed"
0xFFFFFFFF for "Do not overwrite events"

For "Overwrite Events older than x days", the property's value has to be
specified as the number of days in terms of seconds. (86,400 increments)
For example: Overwrite events older that 2 days will require you to set the
Retention key's value to 172800.

Sorry that there is currently no way to do this, but keep an eye out for it
in the future. We are looking at continual improvement, and it's this kind
of feedback that let's us know what things you're trying to do, that we
haven't yet exposed for you. Thanks very much for your post.

Best regards,
yhhuang
VS.NET, Visual C++
Microsoft

This posting is provided "AS IS" with no warranties, and confers no rights.
Got .Net? http://www.gotdotnet.com
--------------------
!From: "Franz Häring" <[email protected]>
!Subject: Configure event log programmatically
!Date: Tue, 8 Jul 2003 18:57:45 +0200
!Lines: 17
!X-Priority: 3
!X-MSMail-Priority: Normal
!X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
!X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
!Message-ID: <[email protected]>
!Newsgroups: microsoft.public.dotnet.framework
!NNTP-Posting-Host: 217.146.142.34
!Path: cpmsftngxa09.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
!Xref: cpmsftngxa09.phx.gbl microsoft.public.dotnet.framework:10475
!X-Tomcat-NG: microsoft.public.dotnet.framework
!
!Hi,
!
!I use an event log to protocol parameter changes. I create a dedicated
event
!log if it doesnt exist and write events to it. Now the problem: The default
!setting of the event log is to overwrite entries if older than 7 days. This
!leads to log file overflow under certain circumstances. As the software is
!used in industrial control devices, this cannot be tolerated. I know how to
!change the setting in the event viewer, but I must change it
!programmatically when the log is created.
!
!How can I change the settings of an event log programmatically?
!
!Please send a copy of your response by email.
!
!Franz
!
!
!
 
Y

Yan-Hong Huang[MSFT]

Hello Franz,

As far as I know, there's no direct method in .NET class library to
increase the size of a specified event log. However, if you have the
appropriate permissions, you can directly write to the registry to modify
the appropriate event log properties.
(using the Microsoft.Win32.Registry and Microsoft.Win32.RegistryKey classes)

Under the registry key of the appropriate event log, modify the 'MaxSize'
and 'Retention' values to modify the values of the properties you mentioned.

For example, to modify the size of the Application Event log, you'll have
to change the value of the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Ma
xSize registry key.

MaxSize would be 512K upwards in 64K chunk increments. Retention values
would be:
0x00000000 for "Overwrite Events as needed"
0xFFFFFFFF for "Do not overwrite events"

For "Overwrite Events older than x days", the property's value has to be
specified as the number of days in terms of seconds. (86,400 increments)
For example: Overwrite events older that 2 days will require you to set the
Retention key's value to 172800.

Sorry that there is currently no way to do this, but keep an eye out for it
in the future. We are looking at continual improvement, and it's this kind
of feedback that let's us know what things you're trying to do, that we
haven't yet exposed for you. Thanks very much for your post.

Best regards,
yhhuang
VS.NET, Visual C++
Microsoft

This posting is provided "AS IS" with no warranties, and confers no rights.
Got .Net? http://www.gotdotnet.com
--------------------
!From: "Franz Häring" <[email protected]>
!Subject: Configure event log programmatically
!Date: Tue, 8 Jul 2003 18:57:45 +0200
!Lines: 17
!X-Priority: 3
!X-MSMail-Priority: Normal
!X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
!X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
!Message-ID: <[email protected]>
!Newsgroups: microsoft.public.dotnet.framework
!NNTP-Posting-Host: 217.146.142.34
!Path: cpmsftngxa09.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
!Xref: cpmsftngxa09.phx.gbl microsoft.public.dotnet.framework:10475
!X-Tomcat-NG: microsoft.public.dotnet.framework
!
!Hi,
!
!I use an event log to protocol parameter changes. I create a dedicated
event
!log if it doesnt exist and write events to it. Now the problem: The default
!setting of the event log is to overwrite entries if older than 7 days. This
!leads to log file overflow under certain circumstances. As the software is
!used in industrial control devices, this cannot be tolerated. I know how to
!change the setting in the event viewer, but I must change it
!programmatically when the log is created.
!
!How can I change the settings of an event log programmatically?
!
!Please send a copy of your response by email.
!
!Franz
!
!
!
 
Y

Yan-Hong Huang[MSFT]

You are welcome. :)

Best regards,
yhhuang
VS.NET, Visual C++
Microsoft

This posting is provided "AS IS" with no warranties, and confers no rights.
Got .Net? http://www.gotdotnet.com
--------------------
!From: "Franz Häring" <[email protected]>
!References: <[email protected]> <[email protected]>
!Subject: Re: Configure event log programmatically
!Date: Sat, 12 Jul 2003 08:16:29 +0200
!Lines: 95
!X-Priority: 3
!X-MSMail-Priority: Normal
!X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
!X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
!Message-ID: <[email protected]>
!Newsgroups: microsoft.public.dotnet.framework
!NNTP-Posting-Host: 217.146.142.34
!Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
!Xref: cpmsftngxa06.phx.gbl microsoft.public.dotnet.framework:48758
!X-Tomcat-NG: microsoft.public.dotnet.framework
!
!Hello Huang,
!
!thank you very much for the information. It works great.
!
!Franz
!
!
!!> Hello Franz,
!>
!> As far as I know, there's no direct method in .NET class library to
!> increase the size of a specified event log. However, if you have the
!> appropriate permissions, you can directly write to the registry to modify
!> the appropriate event log properties.
!> (using the Microsoft.Win32.Registry and Microsoft.Win32.RegistryKey
!classes)
!>
!> Under the registry key of the appropriate event log, modify the 'MaxSize'
!> and 'Retention' values to modify the values of the properties you
!mentioned.
!>
!> For example, to modify the size of the Application Event log, you'll have
!> to change the value of the
!>
!HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Ma
!> xSize registry key.
!>
!> MaxSize would be 512K upwards in 64K chunk increments. Retention values
!> would be:
!> 0x00000000 for "Overwrite Events as needed"
!> 0xFFFFFFFF for "Do not overwrite events"
!>
!> For "Overwrite Events older than x days", the property's value has to be
!> specified as the number of days in terms of seconds. (86,400 increments)
!> For example: Overwrite events older that 2 days will require you to set
!the
!> Retention key's value to 172800.
!>
!> Sorry that there is currently no way to do this, but keep an eye out for
!it
!> in the future. We are looking at continual improvement, and it's this kind
!> of feedback that let's us know what things you're trying to do, that we
!> haven't yet exposed for you. Thanks very much for your post.
!>
!> Best regards,
!> yhhuang
!> VS.NET, Visual C++
!> Microsoft
!>
!> This posting is provided "AS IS" with no warranties, and confers no
!rights.
!> Got .Net? http://www.gotdotnet.com
!> --------------------
!> !From: "Franz Häring" <[email protected]>
!> !Subject: Configure event log programmatically
!> !Date: Tue, 8 Jul 2003 18:57:45 +0200
!> !Lines: 17
!> !X-Priority: 3
!> !X-MSMail-Priority: Normal
!> !X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
!> !X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
!> !Message-ID: <[email protected]>
!> !Newsgroups: microsoft.public.dotnet.framework
!> !NNTP-Posting-Host: 217.146.142.34
!> !Path: cpmsftngxa09.phx.gbl!TK2MSFTNGP08.phx.gbl!TK2MSFTNGP10.phx.gbl
!> !Xref: cpmsftngxa09.phx.gbl microsoft.public.dotnet.framework:10475
!> !X-Tomcat-NG: microsoft.public.dotnet.framework
!> !
!> !Hi,
!> !
!> !I use an event log to protocol parameter changes. I create a dedicated
!> event
!> !log if it doesnt exist and write events to it. Now the problem: The
!default
!> !setting of the event log is to overwrite entries if older than 7 days.
!This
!> !leads to log file overflow under certain circumstances. As the software
!is
!> !used in industrial control devices, this cannot be tolerated. I know how
!to
!> !change the setting in the event viewer, but I must change it
!> !programmatically when the log is created.
!> !
!> !How can I change the settings of an event log programmatically?
!> !
!> !Please send a copy of your response by email.
!> !
!> !Franz
!> !
!> !
!> !
!>
!
!
!
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top