locked
Change event viewer options from command line? RRS feed

  • Question

  • I need to change the option on an Event Viewer log (my own, not an existing one) but this is being deployed and it will be impossible to manually click the new option on every machine.  Currently it deletes the logs older than 7 days but I need it to be "As Needed" instead.

    Is there a way that SMS can change this option?  Is there a command line option that can be run at install time?  Registry setting?

    Thanks

    Thursday, February 10, 2011 8:17 PM

Answers

  • Hi,

    In the Windows 2000 Resource kit, there was "eventlog.pl", that allowed you to change these settings.
    Look at this article for more information : http://support.microsoft.com/kb/318763
    The script is probably not supported for XP environments though. 


    I think that the same thing can be achieved by editing the registry (as you suggested). The key to edit :
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\<LOGNAME>

    Inthere, is a DWORD value "Retention". Setting that to "0" means that the events will be removed "as needed" to maintain the maximum log size (defined in the "Maxsize" DWORD)

    • Marked as answer by cduff55 Wednesday, February 23, 2011 7:56 PM
    Wednesday, February 16, 2011 10:26 AM

All replies

  • Hi,

    In the Windows 2000 Resource kit, there was "eventlog.pl", that allowed you to change these settings.
    Look at this article for more information : http://support.microsoft.com/kb/318763
    The script is probably not supported for XP environments though. 


    I think that the same thing can be achieved by editing the registry (as you suggested). The key to edit :
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\<LOGNAME>

    Inthere, is a DWORD value "Retention". Setting that to "0" means that the events will be removed "as needed" to maintain the maximum log size (defined in the "Maxsize" DWORD)

    • Marked as answer by cduff55 Wednesday, February 23, 2011 7:56 PM
    Wednesday, February 16, 2011 10:26 AM
  • Thanks!
    Wednesday, February 23, 2011 7:56 PM