Redirecting event log files, etc.

[Doug G]

I think I've decided how to handle our RAM-based EWF solution, but I was
wondering about the advice given here and in some articles (e.g.
http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx)
about redirecting things like event log files to an "unprotected drive". In
the case of the event logs, is there a limit on their size? I am going to be
just as out-of-luck if the unprotected drive fills up with log files as if
the EWF area fills up. Are these files limited to some number of events,
percentage of free drive space, or ???

Doug Gordon

 

[KM]

Doug,

I think I've decided how to handle our RAM-based EWF solution, but I was
wondering about the advice given here and in some articles (e.g.
http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx)
about redirecting things like event log files to an "unprotected drive". In
the case of the event logs, is there a limit on their size? I am going to be
just as out-of-luck if the unprotected drive fills up with log files as if
the EWF area fills up. Are these files limited to some number of events,
percentage of free drive space, or ???

Absolutely there is. Take a look at the Eventlog component registry settings. Look for MaxSize value under
[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\<any log>]. ("any log" includes Application, System, Security and any custom log
you may have).
Also, take a look at the "Retention" value.

There is a good page on msdn describing all Eventlog keys/values. Here we go:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/eventlog_key.asp

 

[Doug G]

Thanks! That was a really good tip.

Doug,


Absolutely there is. Take a look at the Eventlog component registry

settings. Look for MaxSize value under

[HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\<any log>]. ("any log"

includes Application, System, Security and any custom log