Redirecting event log files, etc.

  • Thread starter Thread starter Doug G
  • Start date Start date
D

Doug G

I think I've decided how to handle our RAM-based EWF solution, but I was
wondering about the advice given here and in some articles (e.g.
http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx)
about redirecting things like event log files to an "unprotected drive". In
the case of the event logs, is there a limit on their size? I am going to be
just as out-of-luck if the unprotected drive fills up with log files as if
the EWF area fills up. Are these files limited to some number of events,
percentage of free drive space, or ???

Doug Gordon
 
Doug,
I think I've decided how to handle our RAM-based EWF solution, but I was
wondering about the advice given here and in some articles (e.g.
http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx)
about redirecting things like event log files to an "unprotected drive". In
the case of the event logs, is there a limit on their size? I am going to be
just as out-of-luck if the unprotected drive fills up with log files as if
the EWF area fills up. Are these files limited to some number of events,
percentage of free drive space, or ???

Absolutely there is. Take a look at the Eventlog component registry settings. Look for MaxSize value under
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\<any log>]. ("any log" includes Application, System, Security and any custom log
you may have).
Also, take a look at the "Retention" value.

There is a good page on msdn describing all Eventlog keys/values. Here we go:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/eventlog_key.asp
 
Thanks! That was a really good tip.

KM said:
Doug,


Absolutely there is. Take a look at the Eventlog component registry
settings. Look for MaxSize value under
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\<any log>]. ("any log"
includes Application, System, Security and any custom log
 
Back
Top