Limiting Event Log file size

[Guest]

I am using the EWF RAM mode on my CF drive and redirected the log files to a
512K second drive. I tried limiting the event log file size (Application,
Security and System) using the MaxSize registry parameters. i.e.

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
Name: MaxSize
Type: REG_DWORD
Value: 0x00002000 (8192)

etc...

I disabled the event log service, rebooted and deleted the old log files.
After restarting the service, I expected that the file should be limited to
8K but instead, the system still creates 64k files for all three log files
independent of my settings.

Does this mean that the minimum file size is 64K? i.e. values less than 64K
are not allowed and is this documented somewhere?

Is it a bug? i.e. 64K initial size as opposed to the lower MaxSize parameter
setting?

Can I assume that if I set the limit to 64K that this will be actual maximum?

Thanks,
Joe

 

[KM]

Joe,

I disabled the event log service, rebooted and deleted the old log files.
After restarting the service, I expected that the file should be limited
to
8K but instead, the system still creates 64k files for all three log files
independent of my settings.

Does this mean that the minimum file size is 64K? i.e. values less than
64K
are not allowed and is this documented somewhere?

The MaxSize value must be 0x10000 to 0xFFFF0000, in 64K increments.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/eventlog_key.asp

Is it a bug? i.e. 64K initial size as opposed to the lower MaxSize
parameter setting?

Can I assume that if I set the limit to 64K that this will be actual
maximum?

Yes, you can.

KM