I have a service that produces a lot of event log output. Currently the event log is configured to overwrite any old events to keep the log from ever getting full. We have also increased the event log size considerably (to about 600 MB).

Recently the service started reporting errors to its clients, and the error message it was sending to its clients is "The event log file is full". How can this be, when event log is configured to overwrite as necessary?

In our hurry to get the service back up we cleared the event log without saving its contents, but most likely it had not reached 600 MB yet, judging from sizes of some earlier log dumps. There is also MS KB entry 312571, which reports that a hot fix to a similar issue is available, but the the configuration that the fix applies to is not exactly the same we have. Specifically, the fix only applies if event logs are configured to never overwrite old events.

I wonder if this has something to do with the fact that the log files apparently are memory-mapped. What happens if the system runs out of address space to map files to?



All of the current versions of Windows have an architectural limitation with regard to memory-mapped files: no process can have more than 1 GB of memory-mapped files in total. This limitation means that all of the services that run under the Services.exe process must share the 1-GB pool

I think that's is the cause. If you need extensive logging, use some method to archive old logs before they're overwritten?

  • Yes, I think so too. Some way to confirm would be helpful. – Tuure Laurinolli Mar 3 '10 at 10:00
  • And about archiving, switching to the solution mentioned in 312571 would possibly solve the issue and provide archiving. We will probably try soon. – Tuure Laurinolli Mar 3 '10 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.