Event log message size 31885? Windows 2008

Question

We recently upgraded our production boxes to Windows 2008 from Windows 2003 servers. Everything works fine except the event logging. We log at max 32000 bytes of data for each message.

On 2008 servers, event logging fails if number of characters is greater than 31885. Is this new limit on Windows 2008 R2 servers?

On Win 2003 servers, I am able to log 32000 bytes of data for each log entry.

Graz

If this is a programming question, provide some relevant details. Otherwise, you'll soon be beamed to ServerFault or so. – Ypsilanti

An ArgumentException is thrown if the "message string is longer than 31,839 bytes (32,766 bytes on Windows operating systems before Windows Vista)." msdn.microsoft.com/en-us/library/6w20x90k.aspx The "solution" would be not to log such a large message. – Aeolis

Answer 1

Quoting from the documentation for the ReportEvent function:

pStrings [in]

A pointer to a buffer containing an array of null-terminated strings that are merged into the message before Event Viewer displays the string to the user. This parameter must be a valid pointer (or NULL), even if wNumStrings is zero. Each string is limited to 31,839 characters.

Prior to Windows Vista: Each string is limited to 32K characters.

So to answer the question:

Yes, the length of an allowed string that can be logged changed in the correct time frame. The solution is to break up event log entries, shrink the entry and store the details elsewhere, or store some of the content in the event's binary data field.

Reinforce