We are using windows 2003 server and configured to capture security event logs upto 2.5 GB as per auditing requirements. However I found that after reaching 240-250 MB of data the security log setting is automatically changing to "Overwrite events as needed" from the actual setting "Do Not Overwrite Events". Is there any limitations are applied by default?

I would check to see if you have any GPO's that your server settings are getting overriden on by the domain policy.:P Advice offered, If you need more help it is advised to seek the council and advice of paid professionals. The answer is always 42, or reboot.

Hi, Thank you for your post. Like Jason mentioned, run rsop.msc command on your server, find if Maximum security log size defined in Computer Configuration--Windows Settings--Security Settings--Event Log. If there are more inquiries on this issue, please feel free to let us know.Regards, Rick Tan

Hi, Thank you for your post. Like Jason mentioned, run rsop.msc command on your server, find if Maximum security log size defined in Computer Configuration--Windows Settings--Security Settings--Event Log. If there are more inquiries on this issue, please feel free to let us know.Regards, Rick Tan

Guys, The answer is Windows 2003 only supports upto 300 MB of event log size (inclusive of application, system and security logs). The below KB article confirms the same, anyway thanks for your replies http://support.microsoft.com/kb/183097