Article ID: 957662 - Last Review: September 11, 2011 - Revision: 5.0

Recommended settings for event log sizes in Windows Server 2003, Windows XP, Windows Server 2008 and Windows Vista

View products that this article applies to.
System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.

On This Page

Expand all | Collapse all

INTRODUCTION

The following table lists the recommended event log sizes for different versions of Windows Server 2003 and Windows Server 2008.
Collapse this tableExpand this table
Operating systemRecommended maximum size for each log (kilobytes)Recommended maximum total size for all logs (kilobytes)Approximate maximum logging rate (events per second)Recommended maximum log size to view (kilobytes)
Windows Server 2003, 32-bit versions300,000300,032 1,000300,000
Windows Server 2003, 64-bit versions4,194,24016,776,9605,0004,194,240
Windows Server 2008, 32-bit versions4,194,24016,776,9602,0004,194,240
Windows Server 2008, 64-bit versions4,194,24016,776,9605,0004,194,240
Windows XP, 32-bit Versions300,000300,0321,000300,000
Windows XP, 64-bit versions4,194,24016,776,9605,0004,194,240
Windows Vista, 32-bit versions4,194,24016,776,9602,0004,194,240
Windows Vista, 64-bit versions4,194,24016,776,9605,0004,194,240
Notes
  • Log sizes should be decided on an as needed basis up to the maximum individual and combined log size.
  • The recommended maximum event log sizes for 64-bit versions of Windows Server 2003 apply to Windows Server 2003 Service Pack 2-based computers that have hotfix 931304 installed.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
931304  (http://support.microsoft.com/kb/931304/ ) Windows Server 2003 stops responding when the event log size is larger than the default size
Back to the top

MORE INFORMATION

Notes on Windows Server 2003 and Windows XP event logs

If an event log in Windows Server 2003 or Windows XP is near its recommended maximum logging rate, some events may not be logged.

By default, the event log files in Windows Server 2003 and Windows XP are located in the following folder:
%WinDir%\System32\Config
To relocate the event log files to a specified folder, follow these steps:
  1. Click Start, click Run, type regedit, and then click OK.
  2. Locate and then click the following registry subkey for the log that you want to configure:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\EventLogName
    Note The EventLogName placeholder represents the name of the log that you want to configure. For example, the log can be Application, System, or Security.
  3. Under the registry subkey that you located in step 2, right-click File, and then click Modify.
  4. In the Value data box, type the desired location for the event log, and then click OK.
  5. Exit Registry Editor.
  6. Restart the computer.
Back to the top

Notes on Windows Server 2008 and Windows Vista event logs

Event log sizes can be larger in Windows Server 2008 and Windows Vista than in Windows Server 2003 and Windows XP.

By default, the event log files in Windows Server 2008 and Windows Vista are located in the following folder:
%WinDir%\System32\Winevt\Logs
To relocate the event log files to a specified folder, follow these steps:
  1. Open the Server Manager console.
  2. In the console tree, expand Diagnostics, expand Event Viewer, expand Windows Logs, right-click the log that you want to configure, and then click Properties.
  3. In the Log path box, type the desired location for the event log, and then click OK.

    Notes
    • This change takes effect immediately. However, the events that were already logged are still saved in the previous location.
    • If you relocate the event log files to an unavailable disk, the events will be lost.
If you have enabled the Audit: Shut down system immediately if unable to log security audits policy setting, see the following article in the Microsoft Knowledge Base for more information:
823659  (http://support.microsoft.com/kb/823659/ ) Client, service, and program incompatibilities that may occur when you modify security settings and user rights assignments
Back to the top

REFERENCES

For more information about these settings in Windows Vista and Windows Server 2008, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/library/dd349798.aspx (http://technet.microsoft.com/en-us/library/dd349798.aspx)
For more information about event log policy settings, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/library/cc778402.aspx (http://technet.microsoft.com/en-us/library/cc778402.aspx)
Back to the top
APPLIES TO
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Standard x64 Edition
  • Microsoft Windows Server 2003, Enterprise x64 Edition
  • Microsoft Windows Server 2003, Datacenter x64 Edition
  • Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
  • Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
  • Microsoft Windows Server 2003 Service Pack 1
  • Microsoft Windows Server 2003 Service Pack 2
  • Windows Server 2008 Standard
  • Windows Server 2008 Enterprise
  • Windows Server 2008 Datacenter
  • Windows Server 2008 for Itanium-Based Systems
  • Windows Web Server 2008
  • Microsoft Windows XP Professional
  • Microsoft Windows XP Professional for Itanium-based systems
  • Microsoft Windows XP Professional x64 Edition
  • Windows Vista Enterprise 64-bit Edition
  • Windows Vista Home Premium 64-bit Edition
  • Windows Vista Ultimate 64-bit Edition
  • Windows Vista Business
  • Windows Vista Business 64-bit Edition
  • Windows Vista Enterprise
  • Windows Vista Home Premium
  • Windows Vista Ultimate
Back to the top
Keywords: 
kbexpertiseinter kbhowto kbinfo KB957662
Back to the top