Recommended settings for event log sizes in Windows
|Operating system||Recommended maximum size for each log (kilobytes)||Recommended maximum total size for all logs (kilobytes)||Approximate maximum logging rate (events per second)||Recommended maximum log size to view (kilobytes)|
|Windows Server 2003, 32-bit versions||300,000||300,032||1,000||300,000|
|Windows Server 2003, 64-bit versions||4,194,240||16,776,960||5,000||4,194,240|
|Windows Server 2008, 32-bit versions||4,194,240||16,776,960||2,000||4,194,240|
|Windows Server 2008 and newer, 64-bit versions||4,194,240||16,776,960||5,000||4,194,240|
|Windows XP, 32-bit Versions||300,000||300,032||1,000||300,000|
|Windows XP, 64-bit versions||4,194,240||16,776,960||5,000||4,194,240|
|Windows Vista and newer, 32-bit versions||4,194,240||16,776,960||2,000||4,194,240|
|Windows Vista and newer, 64-bit versions||4,194,240||16,776,960||5,000||4,194,240|
- Log sizes should be decided on an as needed basis up to the maximum individual and combined log size.
- The recommended maximum event log sizes for 64-bit versions of Windows Server 2003 apply to Windows Server 2003 Service Pack 2-based computers that have hotfix 931304 installed.
Notes on Windows Server 2003 and Windows XP event logsIf an event log in Windows Server 2003 or Windows XP is near its recommended maximum logging rate, some events may not be logged.
By default, the event log files in Windows Server 2003 and Windows XP are located in the following folder:
- Click Start, click Run, type regedit, and then click OK.
- Locate and then click the following registry subkey for the log that you want to configure:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\EventLogNameNote The EventLogName placeholder represents the name of the log that you want to configure. For example, the log can be Application, System, or Security.
- Under the registry subkey that you located in step 2, right-click File, and then click Modify.
- In the Value data box, type the desired location for the event log, and then click OK.
- Exit Registry Editor.
- Restart the computer.
Notes on Windows versions beginning Windows Vista and newerEvent log sizes can be larger in Windows Vista and newer compared to Windows Server 2003 and Windows XP. The eventlog engine has been redesigned to improve performance and capacity of eventlogs.
Using the new engine, he event log files are located in the following folder:
- Open the Server Manager console.
- In the console tree, expand Diagnostics, expand Event Viewer, expand Windows Logs, right-click the log that you want to configure, and then click Properties.
- In the Log path box, type the desired location for the event log, and then click OK.
- This change takes effect immediately. However, the events that were already logged are still saved in the previous location.
- If you relocate the event log files to an unavailable disk, the events will be lost.
Article ID: 957662 - Last Review: 08/14/2015 07:24:00 - Revision: 6.1
- kbexpertiseinter kbhowto kbinfo KB957662