Microsoft KB Archive/320121

= HOW TO: Configure the Size and Behavior of Event Viewer Logs in Windows 2000 =

PSS ID Number: 320121

Article Last Modified on 12/3/2003

-

The information in this article applies to:


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q320121



IN THIS TASK

 * SUMMARY
 * ** To Change the Size and Behavior of an Event Log



SUMMARY
This step-by-step article describes how to change the size and behavior of the event logs in Event Viewer.

By default, the configuration of the event logs in Event Viewer may allow an event log to become full. If an event log becomes full, an error message is generated, and you may miss important events. However, you can change the size and behavior of event logs to handle the number of events that you want to be able to view.

back to the top

To Change the Size and Behavior of an Event Log

 * 1) Start Event Viewer. Click Start, point to Settings, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.
 * 2) In Event Viewer, right-click the log that you want to change, and then click Properties.
 * 3) To change the size of the log, click the General tab, and then specify a new size (in kilobytes) in the Maximum log size box. Click Clear Log to apply the change.

NOTE: The size of the log file does not change until you clear the event log.

When you click Clear Log, you are prompted to specify if you want to save the events in the original log before you clear it. If you want to save the events, click Yes, and then click OK. Select a folder, and then type a file name for the saved log. By default, Windows 2000 selects the My Documents folder of the current user. The default extension for a saved event log file is .evt. You can open any .evt file in Event Viewer by clicking Open Log File on the Action menu.

If you want to use event log files in a database or spreadsheet to sort and select events easily, you can save the log file as a tab-delimited text file with a .txt extension, or as a comma-delimited text file with a .csv extension.
 * 1) To change the way in which the log behaves when it reaches its maximum size, click one of the following options:
 * 2) * Overwrite events as needed: Event Viewer overwrites the oldest event with each new event. If you use this option and the computer is experiencing problems, you might replace important event notifications without knowing it.
 * 3) * Overwrite events older than  days: This is the default option. The default number of days is seven. Event Viewer overwrites the oldest event that is older than the specified number of days as each new event occurs. If the computer is experiencing problems and many events are written to the log, no existing event may be older than the specified number of days. In this case, no events are automatically cleared and the log becomes full.
 * 4) * Do not overwrite events (clear log manually). Event Viewer does not overwrite events. If the log reaches its maximum size (becomes full), new events are not written to the log and an error message is generated.

back to the top

Keywords: kbhowto kbHOWTOmaster KB320121

Technology: kbwin2000AdvServ kbwin2000AdvServSearch kbwin2000DataServ kbwin2000DataServSearch kbwin2000Pro kbwin2000ProSearch kbwin2000Search kbwin2000Serv kbwin2000ServSearch kbWinAdvServSearch kbWinDataServSearch

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© 2004 Microsoft Corporation. All rights reserved.