NT Eventlog single message size

Question

Can anybody tell me what is maximum size of a windows NT log message? I know that it is possible to reset the maximum log size of event log from 32 MB. I am interested about the memory a single message can hold in NT event log.

Thanks in advance

score 13 · Answer 1 · answered Oct 04 '13 at 23:00

13

In Windows Server 2008 the maximum size of a single Event Log entry is: 31,839 characters http://msdn.microsoft.com/EN-US/library/windows/desktop/aa363679.aspx

answered Oct 04 '13 at 23:00

Daniel Hester

131
1
3

score 8 · Accepted Answer · answered Nov 16 '12 at 17:27

8

The answer is 32766 characters ~ 32 KB

See a example below: Error: Log entry string is too long. A string written to the event log cannot exceed 32766 characters.

answered Nov 16 '12 at 17:27

Sathish

869
2
13
28

5

32766 characters is stated to be true for Windows OS before Vista. The actual limit varies by OS. See http://msdn.microsoft.com/EN-US/library/windows/desktop/aa363679.aspx `lpStrings`. For Vista or newer it's 31389 characters. Although I found limit of 31914 on Windows 7 to be working. – Mike Jul 24 '13 at 18:01
4

@thepip3r I realize I am late to the game, but I believe the other answer was posted almost 11 months *later*, not before. – Manuel May 12 '15 at 17:54

score 0 · Answer 3 · answered Aug 28 '23 at 08:25

Starting from windows Vista the maximum size in bytes was reduced from 32,766 to 31,839 byes.

So lets say you want to know a C# string maximum allowed length, you'll have to run:

int EventViewerMaximumMessageLength = 31839 / sizeof(Char);

And you'r string will have to be trimmed accordingly:

string trimmedEventLogMessage = message.Length > EventViewerMaximumMessageLength
                ? message.Substring(0, EventViewerMaximumMessageLength)
                : message;

NT Eventlog single message size

3 Answers3

Linked