locked
What is maximum security event log size in 2012 R2 Domain Controller RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Note: I already found this KB table...

    https://support.microsoft.com/en-ca/kb/957662

    but it says recommended 4Gb individual log and 16Gb for all event logs combined for server 2008 64bit and above...

    Found an article that says maximum size can be much larger and I want to confirm its validity as it is different from this KB article...

    the thread here indicates bigger log is allowed and the windows event log setting will actually allow 20Gb to be set... ?? Are there concerns with doing this...we want to backup event logs but we see that the 4Gb log only covers about 6 hours of logging so by setting to 20 and using veritas to backup logs we ensure no lost entries...

    Comments, thoughts... yes opening logs in eventvwr would be tedious but we would use log_parser for searching event logs for specific investigations of user activity...

    Rich

    Thursday, December 22, 2016 7:32 PM

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi Rich,

    >Found an article that says maximum size can be much larger and I want to confirm its validity as it is different from this KB article.

    According to official documents from  the Microsoft (which you post), the recommendation value is 4Gb for each.

    As far as I know, usually the recommendation value could do the better performance for your service. Sometimes we may could set large value than the recommendation, but it maybe cause some other side effect on the service. (Of course that's not definite).

    Best Regards,

    Mary

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Friday, December 23, 2016 3:04 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    The larger the file is the more difficult it will be for the OS to open and write to it and more prone to corruption. It would also be difficult to open for viewing, etc.

     

     


    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows Server] Datacenter Management

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

    Friday, December 23, 2016 3:36 AM