Hi,

Running Windows Server 2012 R2.

I'm trying to increase the Application Event Log size from the default of 32768 KB to 2097152 KB.  When I use the Event Viewer GUI, I get the message:

... maximum log size specified is not valid.  It is too large or too small ...

So I've tried using the command prompt:

wevtutil set-log Application /MS:2147483648

And via powershell:

limit-eventlog -logname Application -maximumsize 2097152Kb

Both to no effect as it reverts back to 32768 KB.  My limited Google skills hasn't turned up anything so far.

Any help would be much appreciated.

Thanks.

Run your command prompt in Admin mode and type the below command
wevtutil sl <LogName> /ms:<MaxSizeInBytes>

As per your requirement I tried to replicate the scenario and it worked!! Please copy the below command line.
wevtutil sl Application /ms:2147483648

Thanks

I've done that but no effect (running command prompt as administrator):

D:\>wevtutil sl application /ms:2147483648

D:\>wevtutil gl application
name: application
enabled: true
type: Admin
owningPublisher:
isolation: Application
channelAccess: O:BAG:SYD:(A;;0x2;;;S-1-15-2-1)(A;;0xf0007;;;SY)(A;;0x7;;;BA)(A;;
0x7;;;SO)(A;;0x3;;;IU)(A;;0x3;;;SU)(A;;0x3;;;S-1-5-3)(A;;0x3;;;S-1-5-33)(A;;0x1;
;;S-1-5-32-573)
logging:
  logFileName: %SystemRoot%\System32\Winevt\Logs\application.evtx
  retention: false
  autoBackup: false
  maxSize: 33554432
publishing:
  fileMax: 1

Still says 33554432 for MaxSize.

wevtutil.exe will be present under C:\Windows\System32

So, you need to change the directory to C:\Windows\System32 in command prompt and then execute the command:

wevtutil sl Application /ms:2147483648

Thanks

Hi  Terencewklau,

To change the maximum log size, we need to ensure our account has administrator rights.

If not, log on with an administrator account and try again.

Here are the steps for changing:

Change the maximum event log size:

https://technet.microsoft.com/en-us/library/cc759052%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396

Best Regards,

Leo

My account is an admin on that box (domain admin).  I've tried launching eventvwr as administrator and command prompt as administrator.  But the setting won't stick.  And the Gui gives me the not valid error.

Thanks.

Event Log size and log wrapping are defined in GPO to match the business and security requirements. Kindly check the Event Log policy settings in Group Policy Object Editor. Something might be tripping there.

GPO_name\Computer Configuration\Windows Settings\Security Settings\Event Log\

Thanks

I have a Group Policy that is set at:

Computer Config\Policies\Windows Settings\Security Settings\Event Log:

Maximum application log size = 2097152 kilobytes

gpresult shows the above policy setting is the winning GPO.

I've just noticed another GPO setting that looks similar:

Computer Config\Policies\Administrative Templates\Windows Components\Event Log Service\Appplication:

Specify the maximum log file size (KB)

I wonder what the difference is?  Will try it when I get a chance.

The second GPO setting worked:

Computer Config\Policies\Administrative Templates\Windows Components\Event Log Service\Appplication:

Specify the maximum log file size (KB)