NT Eventlog single message size

Question

Can anybody tell me what is maximum size of a windows NT log message? I know that it is possible to reset the maximum log size of event log from 32 MB. I am interested about the memory a single message can hold in NT event log.

Thanks in advance

Skater

Answer 1

The answer is 32766 characters ~ 32 KB

See a example below: Error: Log entry string is too long. A string written to the event log cannot exceed 32766 characters.

Skater

32766 characters is stated to be true for Windows OS before Vista. The actual limit varies by OS. See msdn.microsoft.com/EN-US/library/windows/desktop/aa363679.aspx lpStrings. For Vista or newer it's 31389 characters. Although I found limit of 31914 on Windows 7 to be working. – Dymphia

@thepip3r I realize I am late to the game, but I believe the other answer was posted almost 11 months later, not before. – Usher

Answer 2

In Windows Server 2008 the maximum size of a single Event Log entry is: 31,839 characters http://msdn.microsoft.com/EN-US/library/windows/desktop/aa363679.aspx

Cornstalk

Answer 3

Starting from windows Vista the maximum size in bytes was reduced from 32,766 to 31,839 byes.

So lets say you want to know a C# string maximum allowed length, you'll have to run:

int EventViewerMaximumMessageLength = 31839 / sizeof(Char);

And you'r string will have to be trimmed accordingly:

string trimmedEventLogMessage = message.Length > EventViewerMaximumMessageLength
                ? message.Substring(0, EventViewerMaximumMessageLength)
                : message;

Fantoccini