Can't parse application event log - is there a max size for a single event? RRS feed

  • Question

  • Hi,

    I'm trying to use WMI via script to search for certain events in the application event log.

    The code works perfectly until a certain issue occurs on my system which dumps a huge amount of data into a single event (similar to a Dr Watson dump). The single event appears to have over 1Mb of data

    After this, the WMI has difficulty enumerating the logfile and only returns a subset of the application events.

    If I set the script to only check events with TimeWritten after the large event, then all the events after this time are correctly returned.

    I sense a 'bun fight' coming with the developers of the application which does the huge dump, but can't find any document or other evidence to show there is a limit to the amount of data a single event can hold.

    Does anyone know if there is a limit and if so, is there something somewhere that states this?


    Wednesday, January 26, 2011 5:44 PM