Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\, it adds a log but shows the exact same events that are in the Application log when looking in the event viewer.

If I add a registry key with the name "(ML) Startup Commands 2" to the event log, it shows a blank event log as expected. In fact, any other name will work correctly except for the one I want.

I have searched through the registry for other keys with the string "(ML)" and removed all other references to this key name, however I continue to get merged results in the viewer when I create a key with this name.

My question is, how can I fix the server so I can create a custom event log with this name that shows only the events from my application, not the events from the default Application event log that is installed with Windows?

Update:

I rebooted the server and woudn't you know it, the log started acting normally. I got a strange error message in the Application log:

The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

I can only hope this error doesn't mean the problem will come back after 86400 seconds. I guess I will have to wait and see.

share|improve this question

1 Answer 1

I haven't really tried to use custom event logs. But I have seen the problem you describe, with the same events appearing in more than 1 log. This can happen because event logs are memory mapped files, and if the total size of all event logs is greater than 300MB you will start to have issues.

See the 2nd or so page of this article:

http://technet.microsoft.com/en-us/library/cc722385%28WS.10%29.aspx

>On Windows XP-based computers, member servers, and stand-alone servers, the
>combined size of the Application, Security, and System logs should not exceed 300 MBs.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.