0

Getting this exception The file size exceeds the limit allowed and cannot be saved when writing to event viewer using EventLog

Code used:

                    string cs = "LoggingService";
                    EventLog elog = new EventLog();

                    if (!EventLog.SourceExists(cs))
                    {
                        EventLog.CreateEventSource(cs, cs);
                    }

                    elog.Source = cs;
                    elog.EnableRaisingEvents = true;

                    elog.WriteEntry(message);

Stack trace:

System.ComponentModel.Win32Exception (0x80004005): The file size exceeds the limit allowed and cannot be saved
   at System.Diagnostics.EventLogInternal.get_OldestEntryNumber()
   at System.Diagnostics.EventLogInternal.StartRaisingEvents(String currentMachineName, String currentLogName)
   at System.Diagnostics.EventLogInternal.set_EnableRaisingEvents(Boolean value)

Things tried:

  1. http://support.microsoft.com/kb/328380#top

  2. When I put this statement elog.Clear() before elog.EnableRaisingEvents = true; I am getting different exception

    System.ComponentModel.Win32Exception (0x80004005): Access is denied at System.Diagnostics.EventLogInternal.Clear()

The above code is executed by a web service which runs under LocalSystem which has full permission on the computer.

OS: windows server 2008R2 and .NET 4.0

Praneeth
  • 2,527
  • 5
  • 30
  • 47

2 Answers2

1

There is a method EventLog.ModifyOverflowPolicy that modifies log policy. I believe EventLog.ModifyOverflowPolicy(OverflowAction.OverwriteAsNeeded,0) could be helpful.

aiodintsov
  • 2,545
  • 15
  • 17
  • I am not modifying any log and just creating a new log. – Praneeth Aug 30 '12 at 20:23
  • 1
    I am talking about modifying after creating a new one. So that it gets more appropriate policy on it. – aiodintsov Sep 04 '12 at 17:32
  • @Praneeth when you create a new log, it has a maximum size and when that maximum is reached you start getting an exception - exactly as you've found. On that new log you've created, you need to modify its policy so that when it fills up, it starts overwriting the oldest entries. If all you do is increase the maximum size, you're still going to get this exact same problem all over again when the log fills up (which it eventually will). – Chris Dec 18 '13 at 11:57
-1

Event Viewer - Properties - Maximum log size was 1028. I bumped it and it started working fine.

But the same code was working from another window service before I made the above the change. which make me think what could have happened

The message I was trying to log was just a line (less then 255 characters)

Praneeth
  • 2,527
  • 5
  • 30
  • 47
  • If you were filling the log and getting an exception, and all you've done is increase the maximum size of the log, you have NOT fixed the bug - you've just delayed it. The log will eventually fill up again, and then you will have this exact same problem again. You need to modify the overflow policy, as mentioned in aiodintsov's answer. – Chris Dec 18 '13 at 11:54
  • i can reproduce the same exception on one computer, just READING the event logs! It was also set to max size 1028, but the policy was "overwrite events as needed" - crashes enumerating (new EventLog(x,y).Entries... – Mr. Bungle Mar 05 '14 at 12:37