Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Microsoft has posted the recommended settings for event log sizes in Windows Server 2003 and in Windows Server 2008 (link), but I was wondering if anyone knew if there was something somewhere which posted the same information for Windows XP. Most importantly the Recommended maximum total size for all each log and all logs

share|improve this question

1 Answer 1

up vote 2 down vote accepted

It would appear that Microsoft themselves do not specify the recommended event log sizes for Windows XP (unlike the article you linked to for Windows Server 2003/2008).

Despite this, there is some information out there from other large organizations, that offers default sizes and recommended size settings:

The Computer Security Resource Centre at NIST, in its publication entitled, "Guidance for Securing Microsoft Windows XP Systems for IT Professionals: A NIST Security Configuration Checklist" states:

For the Application log, the maximum size should be set to 16384 kilobtes. For the Security log, the maximum size should be set to 81920 kilobytes. For the System log, the maximum size should be set to 16384 kilobytes.

The NSA document, "Windows XP Security Guide" states:

Table 3.18
Event Log Security Setting  
Recommendations Setting EC desktop	EC laptop	SSLF desktop	SSLF laptop  
Maximum appl. log size   16384 KB	 16384 KB	 16384 KB	     16384 KB  
Maximum security log size  81920 KB 81920 KB	81920 KB	    81920 KB  
Maximum system log size 16384 KB	16384 KB	16384 KB	    16384 KB

(where EC = Enterprise Client & SSLF = Specialized Security - Limited Functionality)

And finally, the DISA publication, "Windows XP Security Checklist" states:

If any of the following conditions are true, then this is a finding:

If the value for “Maximum application log size” is not set to a minimum of “16384 kilobytes”, then this is a finding.

If the value for “Maximum security log size” is not set to a minimum of “81920 kilobytes”, then this is a finding.

If the value for “Maximum system log size” is not set to a minimum of “16384 kilobytes”, then this is a finding.

Of course, the default sizes of 512kb for each event log, as configured by Windows XP itself upon installation, could be considered the "default" sizes.

Some other links that may be useful:

Microsoft Windows XP Power Productivity Book (on Google Books)
Group Policy Settings - Security Settings - Event Log
Fixing "The Event Log is Full" Error on Windows XP

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.