OverflowAction Enum

Definition

Namespace:

System.Diagnostics

Assembly:

System.Diagnostics.EventLog.dll

Source:

OverflowAction.cs

Specifies how to handle entries in an event log that has reached its maximum file size.

public enum class OverflowAction

public enum OverflowAction

type OverflowAction = 

Public Enum OverflowAction

Inheritance

Object

ValueType

Enum

OverflowAction

Fields

Name	Value	Description
DoNotOverwrite	-1	Indicates that existing entries are retained when the event log is full and new entries are discarded.
OverwriteAsNeeded	0	Indicates that each new entry overwrites the oldest entry when the event log is full.
OverwriteOlder	1	Indicates that new events overwrite events older than specified by the MinimumRetentionDays property value when the event log is full. New events are discarded if the event log is full and there are no events older than specified by the MinimumRetentionDays property value.

Examples

The following example enumerates the event logs defined on the local computer and displays configuration details for each event log.

void DisplayEventLogProperties()
{
   
   // Iterate through the current set of event log files,
   // displaying the property settings for each file.
   array<EventLog^>^eventLogs = EventLog::GetEventLogs();
   System::Collections::IEnumerator^ myEnum = eventLogs->GetEnumerator();
   while ( myEnum->MoveNext() )
   {
      EventLog^ e = safe_cast<EventLog^>(myEnum->Current);
      Int64 sizeKB = 0;
      Console::WriteLine();
      Console::WriteLine( "{0}:", e->LogDisplayName );
      Console::WriteLine( "  Log name = \t\t {0}", e->Log );
      Console::WriteLine( "  Number of event log entries = {0}", e->Entries->Count );
      
      // Determine if there is a file for this event log.
      RegistryKey ^ regEventLog = Registry::LocalMachine->OpenSubKey( String::Format( "System\\CurrentControlSet\\Services\\EventLog\\{0}", e->Log ) );
      if ( regEventLog )
      {
         Object^ temp = regEventLog->GetValue( "File" );
         if ( temp != nullptr )
         {
            Console::WriteLine( "  Log file path = \t {0}", temp );
            FileInfo^ file = gcnew FileInfo( temp->ToString() );
            
            // Get the current size of the event log file.
            if ( file->Exists )
            {
               sizeKB = file->Length / 1024;
               if ( (file->Length % 1024) != 0 )
               {
                  sizeKB++;
               }
               Console::WriteLine( "  Current size = \t {0} kilobytes", sizeKB );
            }
         }
         else
         {
            Console::WriteLine( "  Log file path = \t <not set>" );
         }
      }
      
      // Display the maximum size and overflow settings.
      sizeKB = e->MaximumKilobytes;
      Console::WriteLine( "  Maximum size = \t {0} kilobytes", sizeKB );
      Console::WriteLine( "  Overflow setting = \t {0}", e->OverflowAction );
      switch ( e->OverflowAction )
      {
         case OverflowAction::OverwriteOlder:
            Console::WriteLine( "\t Entries are retained a minimum of {0} days.", e->MinimumRetentionDays );
            break;

         case OverflowAction::DoNotOverwrite:
            Console::WriteLine( "\t Older entries are not overwritten." );
            break;

         case OverflowAction::OverwriteAsNeeded:
            Console::WriteLine( "\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry." );
            break;

         default:
            break;
      }
   }
}

static void DisplayEventLogProperties()
{
    // Iterate through the current set of event log files,
    // displaying the property settings for each file.

    EventLog[] eventLogs = EventLog.GetEventLogs();
    foreach (EventLog e in eventLogs)
    {
        Int64 sizeKB = 0;

        Console.WriteLine();
        Console.WriteLine("{0}:", e.LogDisplayName);
        Console.WriteLine("  Log name = \t\t {0}", e.Log);

        Console.WriteLine("  Number of event log entries = {0}", e.Entries.Count.ToString());

        // Determine if there is an event log file for this event log.
        RegistryKey regEventLog = Registry.LocalMachine.OpenSubKey("System\\CurrentControlSet\\Services\\EventLog\\" + e.Log);
        if (regEventLog != null)
        {
            Object temp = regEventLog.GetValue("File");
            if (temp != null)
            {
                Console.WriteLine("  Log file path = \t {0}", temp.ToString());
                FileInfo file = new FileInfo(temp.ToString());

                // Get the current size of the event log file.
                if (file.Exists)
                {
                    sizeKB = file.Length / 1024;
                    if ((file.Length % 1024) != 0)
                    {
                        sizeKB++;
                    }
                    Console.WriteLine("  Current size = \t {0} kilobytes", sizeKB.ToString());
                }
            }
            else
            {
                Console.WriteLine("  Log file path = \t <not set>");
            }
        }

        // Display the maximum size and overflow settings.

        sizeKB = e.MaximumKilobytes;
        Console.WriteLine("  Maximum size = \t {0} kilobytes", sizeKB.ToString());
        Console.WriteLine("  Overflow setting = \t {0}", e.OverflowAction.ToString());

        switch (e.OverflowAction)
        {
            case OverflowAction.OverwriteOlder:
                Console.WriteLine("\t Entries are retained a minimum of {0} days.",
                    e.MinimumRetentionDays);
                break;
            case OverflowAction.DoNotOverwrite:
                Console.WriteLine("\t Older entries are not overwritten.");
                break;
            case OverflowAction.OverwriteAsNeeded:
                Console.WriteLine("\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry.");
                break;
            default:
                break;
        }
    }
}

Shared Sub DisplayEventLogProperties()

   ' Iterate through the current set of event log files,
   ' displaying the property settings for each file.
   Dim eventLogs As EventLog() = EventLog.GetEventLogs()
   
   Dim e As EventLog
   For Each e In  eventLogs
      Dim sizeKB As Int64 = 0
      
      Console.WriteLine()
      Console.WriteLine("{0}:", e.LogDisplayName)
      Console.WriteLine("  Log name = " + ControlChars.Tab _
                          + ControlChars.Tab + " {0}", e.Log)

      Console.WriteLine("  Number of event log entries = {0}", e.Entries.Count.ToString())
      
      ' Determine if there is an event log file for this event log.
      Dim regEventLog As RegistryKey
      regEventLog = Registry.LocalMachine.OpenSubKey( _
             ("System\CurrentControlSet\Services\EventLog\" + e.Log))

      If Not (regEventLog Is Nothing) Then

         Dim temp As Object = regEventLog.GetValue("File")
         If Not (temp Is Nothing) Then

            Console.WriteLine("  Log file path = " + ControlChars.Tab _
                                  + " {0}", temp.ToString())
            Dim file As New FileInfo(temp.ToString())
            
            ' Get the current size of the event log file.
            If file.Exists Then
               sizeKB = file.Length / 1024
               If file.Length Mod 1024 <> 0 Then
                  sizeKB += 1
               End If
               Console.WriteLine("  Current size = " + ControlChars.Tab _
                          + " {0} kilobytes", sizeKB.ToString())
            End If
         Else
            Console.WriteLine("  Log file path = " + ControlChars.Tab _
                             + " <not set>")
         End If
      End If
      
      ' Display the maximum size and overflow settings.
      sizeKB = e.MaximumKilobytes
      Console.WriteLine("  Maximum size = " + ControlChars.Tab _
                         + " {0} kilobytes", sizeKB.ToString())
      Console.WriteLine("  Overflow setting = " + ControlChars.Tab _
                         + " {0}", e.OverflowAction.ToString())
      
      Select Case e.OverflowAction
         Case OverflowAction.OverwriteOlder
            Console.WriteLine(ControlChars.Tab + _
                 " Entries are retained a minimum of {0} days.", _
                 e.MinimumRetentionDays)
         Case OverflowAction.DoNotOverwrite
            Console.WriteLine(ControlChars.Tab + _
                 " Older entries are not overwritten.")
         Case OverflowAction.OverwriteAsNeeded
            Console.WriteLine(ControlChars.Tab + _
                 " If number of entries equals max size limit, a new event log entry overwrites the oldest entry.")
         Case Else
      End Select

   Next e

End Sub

Remarks

Every event log has a maximum size limit and a configurable setting that provides the rule for writing new entries at that limit. When the event log has reached its maximum size, you can specify one of the following rules:

• New entries will be discarded.

• New entries will overwrite older entries.

• New entries will either be discarded or will overwrite existing entries depending upon the age of the existing entries.

Use the ModifyOverflowPolicy method to set the overflow behavior for an EventLog. Check the current configured behavior of an EventLog through its OverflowAction property.