How to change the Maximum Log Size of “Applications and Services” logs

Hey hey,

this is another cool request from the Microsoft Technet Forums that I wanted to share here:

“I know you can set the maximum log file size for Application, Security, Setup and System logs in Group Policy natively — is there a way I can set the new Event Logs’ sizes found in “Application and Services

Great question. Sure you can. The bad thing is, that it isn’t exposed as a native Group Policy, but it is – as many other things – editable in the registry. What you need is a little Regedit.EXE searching skills (e.g. hit F3 a couple of times) and the right key words to search for.

Since it’s a registry key, you can roll out the changes e.g. the new max log file size with a custom ADM(X) template. That’s the classic way however. I won’t do that. Since GP Preferences offer a way richer option of rolling out registry settings, we’ll use that. Okay, so before we start, let’s make sure we’re on the same boat. The question is about the following log files:

Under “Windows Logs”, those are the classic logs you know from since Windows 2000 or before – I don’t know. They were always there. You configure their size using Comp Conf\Policies\Adm Templ\Windows Components\Event Log Service. There’s the GP called “Maximum Log Size (KB)” – you’re shooting for that.

For “Application and Services Logs” however, there aren’t pre-defined GPs, but the registry location the information is stored is in: HKLM\Software\Microsoft\Windows\CurrentVersion\WINEVT\Channels\. In there, there’s a registry key for every log file that’s around. Inside that key, there’s a value called MaxSize that stores the maximum log file size in Bytes.

This is in bold because the UI asks for the max log file size in Kilobytes. It calculates the actual Byte size (Kilobytes * 1024, duh!) for you and writes them to the registry. That’s a little tidbit to remember as you’ll have to write the Bytesize to the registry – there’s no automatic calculation for you, if you’re going the Preference or ADM(X) way.

Here’s how I’ve configured the GP Preference item the Group Policy Operational log file to increase it to 16384 KB (that’s 16 Megabytes or 16777216 Bytes) (Computer Configuration\Preferences\Windows Settings\Registry – right-click – New – Registry Item. For “Key Path” I browsed the correct “MaxSize” value in the correct key for the log file) :

Note: You might want to switch the number base in Regedit and the Registry Preference to “Decimal” so that you’re sure you have the correct value.

1 Comment so far

  1. [...] How to change the Maximum Log Size of “Applications and Services” logs [...]