none
AD user event log size, not getting updated in some machines

    Question

  • Hi,

    using group policy i pushed event log maximum size as 1228800, but in some machine the value showing as 81920. I am not able to edit the value even manually. please see the screenshot. most of the error machines are enterprise edition 64 bi. can any one help ??? 


    Sunday, July 12, 2015 10:34 AM

Answers

  • Hi Techknowledge,

    For the Event Log service, the use of memory-mapped files means that regardless of the amount of memory that a maximum event log size setting specifies, events can no longer be recorded in the log when the computer has no more memory available for the memory-mapped file. Error messages will not be displayed; the events will simply not appear in the event log, or they might overwrite other events that had been recorded previously. Fragmentation of the log files within memory has also been shown to lead to significant performance problems on busy computers.

    Because of these limitations—even though the theoretical limit for memory-mapped files suggests otherwise and the Event Viewer and Group Policy Object Editor user interfaces allow you to specify as much as 4 GB per log—we have verified that the practical limit is approximately 300 megabytes (MBs) on most 32-bit servers running Windows Server 2003—that is, 300 MBs for all of the event logs combined. On Windows XP-based computers, member servers, and stand-alone servers, the combined size of the Application, Security, and System logs should not exceed 300 MBs. On domain controllers, the combined size of these three logs plus the Directory Service, the DNS Server service, and File Replication Service logs should not exceed 300 MBs.

    More details please refer the following KB:

    Event Log

    https://technet.microsoft.com/en-us/library/cc722385(v=ws.10).aspx

    Event Log Policy Settings

    https://technet.microsoft.com/en-us/library/cc778402%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

    I’m glad to be of help to you!


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com

    Wednesday, July 15, 2015 3:00 AM
    Moderator