Size of the Event Viewer logs

Question

Hello,
I've already asked that question but since it hasn't yet been answered and I've run out of ideas please let me ask it again.

There's the Windows server 2012 R2 DC with the GPO defining the size of the event logs:

There's the Windows Server 2016 member server that has this gpo successfully applied:

But it does not help to change the size of Server's logs:

???

Thank you in advance,
Michael

Answer 1

Hi,

Please check the registry key values on the target 2016 Server.

If the GPO is applied successfully, below values should be updated correctly. You can check if the values are the number you have set in GPO. If not, it means the GPO is not correctly applied.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\<log name>\MaxSize
<log name> should be Application, System and Security

You can follow the steps in below link to try other GPO settings to see if the issue could be resolved.
https://helpcenter.netwrix.com/NA/Configure_IT_Infrastructure/Windows_Server/WS_Event_Log_Settings.html

Thanks,

Eleven

If the Answer is helpful, please click "Accept Answer" and upvote it. Thanks.

Answer 2

AFAIK setting the options via GPO doesn't change the per-log settings. They are 2 different settings. The eventing subsystem will use the GPO settings if they are set (size, retention, etc) or use the log settings otherwise. Looking at your screenshot it looks like you're allowing your logs to get as big as 1GB so they should grow until they get there. The security log is the only one getting close to its locally configured max of 204MB. It should go past that once the GPO takes effect. However I'm assuming the GPO settings have replicated to that server and nothing else is overwriting them.

Answer 3

"setting the options via GPO doesn't change the per-log settings." ??? It does - the values depicted above are the MAXIMUM size of the logs - those values should change right after applying a gpo. I've just made the same test in my second network (Windows Server 2008R2) - all worked perfect (the MAXIMUM size of the logs has been changed immediately!

Answer 4

"Please check the registry key values on the target 2016 Server." - I've already done it, that's why I'm saying "I've run out of ideas"... :(((

Answer 5

"So if you set the GPO to retain the log and then switch over to the log settings the UI has updated to use that setting?" - not to retain, if I set the maximum log size in GPO, that GPO setting is immediately applied to the client and is reflected in UI: