Recipe 6.8 Changing the Maximum Size of a Custom Event Log

Problem

Custom event logs are created with a default maximum size of 512K. For some applications, this default may be too small or even too large. You need a way of programmatically modifying this size. If you are a system administrator, you might need to write a utility to modify this value.

Solution

There is no direct way of modifying the maximum size of an event log. However, the following method makes use of the registry to circumvent this limitation:

using System;
using Microsoft.Win32;

public void SetCustomLogMaxSize(string logName, int maxSize)
{
    RegistryKey key = Registry.LocalMachine.OpenSubKey
      (@"SYSTEM\CurrentControlSet\Services\Eventlog\" + logName, true);
    if (key == null)
    {
        Console.WriteLine(
          "Registry key for this Event Log does not exist.");
    }
    else
    {
        key.SetValue("MaxSize", maxSize);
        Registry.LocalMachine.Close( );
    }
}

Discussion

The FCL classes devoted to making use of the event log contain most of the functionality that a developer will ever need. Yet there are some small items that are not directly accessible using the event log API in the FCL. One of these is the manipulation of the maximum size of an event log. Event logs are initialized to a maximum size of 512K, after which the event log entries are overwritten by default.

There are cases where an application may produce many or very few entries in an event log. In these cases, it would be nice to manipulate the maximum size of an event log so that memory is used most efficiently and that critical entries are not lost or overwritten because the event log fills up too fast.

It is possible to set the maximum size of an event log manually through the Event Viewer application. Unfortunately, you might not always have access to the machine to manually do this. In addition, this is a tedious and time-consuming process. You can programmatically set the maximum size by changing the value of a registry entry. If an event log were named MyLog, the properties of this log would reside in the following registry location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\MyLog

This location contains several value entries containing properties of this event log. The value entry we are interested in is MaxSize. Using the static methods of the Registry class, we can add or modify this value to one of our choosing with code like the following:

Microsoft.Win32.RegistryKey lm = Registry.LocalMachine;
Microsoft.Win32.RegistryKey logKey = lm.OpenSubKey(
            @"SYSTEM\CurrentControlSet\Services\Eventlog\RegistryLog", true);
logKey.SetValue("MaxSize", (int) 1024);
logKey.Close;

To access this registry value, we first call the RegistryKey.OpenSubKey method. This method returns a RegistryKey object, which, in this case, represents the key containing the MaxSize value entry in which we are interested. The SetValue method of the RegistryKey object is called next to change the value of the MaxSize entry. If this value entry does not exist, it is created with the desired value. This information is then flushed to the registry and the RegistryKey class is closed. Both of these actions are performed though the Close method on the RegistryKey class.

See Also

See the "Registry.LocalMachine Field" and "RegistryKey.Open Method" topics in the MSDN documentation.