event viewer shows only one message

[Guest]

the event viewer on a w2k srv shows in the security-eventlog only one
message. the secevent.evt is only 64 kb, even though i set the security
protocol to be 10.752 kb.
i let the system rebuild the secevent.evt by disabling
eventlog-service->restart->delete secevent.evt->enable eventlog->restart. it
then built a new 64 kb secevent.evt.
registry-settings seem to be correct.
there is enough space on disk.
so i think it's not the evt that's corrupt. but what could be the reason?
can i somehow repair the eventlog-service or some dll?
please help!

 

[Adrian Grigorof]

Do you auditing enabled? You need to enable the logging of various security
events. Verify the Audit Policy using the group policy editor.

 

[Guest]

indeed! thanks! somehow stupid, the gpo i have for auditing was linked to the
dc's ou but not active! thank's again