If you run out of space on the disk where your log files reside,
the Event Log service will be unable to record new events and
you will receive an error message to that effect. If you cannot
create free space on the full disk, you can work around the problem
by changing the default location of the log files.
Doing so requires three modifications to your registry.
Proceed as follows:
1. Run Registry Editor.
2. Navigate to the key HKLM\System\CurrentControlSet\Services\ Eventlog\Application.
3. Double-click the File value.
4. Change the File value's data to specify a path to a disk that isn't full.
For example, if the current data is located in %SystemRoot%\System32\Config\Appevent.evt
and you have room to put the Appevent.evt file in E:\SomeFolder,
change the File value's data to E:\SomeFolder\Appevent.evt.
The folder you specify must exist, or the change won't take effect.
5. Repeat these steps to change the location specified by the File value in
HKLM\System\CurrentControlSet\Services\Eventlog\Security
and HKLM\System\CurrentControlSet\Services\Eventlog\System.
6. Close Registry Editor.
7. Restart your computer.
--
Carey Frisch
Microsoft MVP
Windows XP - Shell/User
Be Smart! Protect your PC!
http://www.microsoft.com/security/protect/
-----------------------------------------------------------------------
"BennyC" (e-mail address removed) wrote in message:
| I keep getting security log full everyday although I made
| the size to 2048 with 1 day overwrite.
| I can't figure out why? is there anybody there has idea?
| I have The current microsoft update.
|
| Thanks
| Benny
