Custom event logs are created with a default maximum size of 512K. For some applications, this default may be too small or even too large. You need a way of programmatically modifying this size. If you are a system administrator, you might need to write a utility to modify this value.
There is no direct way of modifying the maximum size of an event log. However, the following method makes use of the registry to circumvent this limitation:
using System; using Microsoft.Win32; public void SetCustomLogMaxSize(string logName, int maxSize) { RegistryKey key = Registry.LocalMachine.OpenSubKey (@"SYSTEMCurrentControlSetServicesEventlog" + logName, true); if (key == null) { Console.WriteLine( "Registry key for this Event Log does not exist."); } else { key.SetValue("MaxSize", maxSize); Registry.LocalMachine.Close( ); } }
The FCL classes devoted to making use of the event log contain most of the functionality that a developer will ever need. Yet there are some small items that are not directly accessible using the event log API in the FCL. One of these is the manipulation of the maximum size of an event log. Event logs are initialized to a maximum size of 512K, after which the event log entries are overwritten by default.
There are cases where an application may produce many or very few entries in an event log. In these cases, it would be nice to manipulate the maximum size of an event log so that memory is used most efficiently and that critical entries are not lost or overwritten because the event log fills up too fast.
It is possible to set the maximum size of an event log manually
through the Event Viewer application. Unfortunately, you might not
always have access to the machine to manually do this. In addition,
this is a tedious and time-consuming process. You can
programmatically set the maximum size by changing the value of a
registry entry. If an event log were named MyLog
,
the properties of this log would reside in the following registry
location:
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesEventlogMyLog
This location contains several value entries containing properties of
this event log. The value entry we are interested in is
MaxSize
. Using the static methods of the
Registry
class, we can add or modify this value to
one of our choosing with code like the following:
Microsoft.Win32.RegistryKey lm = Registry.LocalMachine; Microsoft.Win32.RegistryKey logKey = lm.OpenSubKey( @"SYSTEMCurrentControlSetServicesEventlogRegistryLog", true); logKey.SetValue("MaxSize", (int) 1024); logKey.Close;
To access this registry value, we first call the
RegistryKey.OpenSubKey
method. This method returns
a RegistryKey
object, which, in this case,
represents the key containing the MaxSize
value
entry in which we are interested. The SetValue
method of the
RegistryKey
object is
called next to change the value of the MaxSize
entry. If this value entry does not exist, it is created with the
desired value. This information is then flushed to the registry and
the RegistryKey
class is closed. Both of these
actions are performed though the Close
method on
the RegistryKey
class.