Re: SECURITY LOG IS FULL MESSAGE

From: Wesley Vogel (123WVogel955_at_comcast.net)
Date: 04/03/04


Date: Fri, 02 Apr 2004 23:14:59 GMT

Rume;

I know very little about Win2000. XP is similar, but
not the same.

They changed just enough stuff in XP to mess you
up. :-)

-- 
Hope this helps.  Let us know.
Wes
In news:178ac01c418fd$e086a710$a501280a@phx.gbl,
RUME <anonymous@discussions.microsoft.com>  hunted and pecked:
> Wes,
> 
> This helps but does not explain why this is an issue with
> windows XP.  This was not an issue with windows 2000.
> With windows 2000 I don't have to change any settings on
> the event log.
> 
> Thanks anyway for your response and for not being a jerk
> like the first guy who responded to my post.
> 
> Rume
> 
>> -----Original Message-----
>> Rume;
>> 
>> Start | Run Type:   eventvwr  | OK |
>> Help | Help Topics | [+] Event Viewer | [+] How To |
>> [+]  Manage Event Logs
>> 
>> [[If you select Do not overwrite events (clear log manually) in the
>> Properties dialog box of an active log, you must periodically clear
>> the log either when the log reaches a certain size or when a message
>> notifies you that the log is full.]]
>> 
>> [[When a log is full, it stops recording new events. Clearing the
>> log is one way to free the log and start recording new events]]
>> 
>> [[You can also free a log and start recording new events by
>> overwriting old events. To overwrite events, on the Action menu,
>> click Properties, and then click Overwrite events as needed. This
>> ensures that all new events are written to the log, even when the
>> log is full.]] 
>> 
>> [[You can also start logging new events by increasing the maximum
>> log size. To increase the log size, on the Action menu, click
>> Properties, and then increase the Maximum log size.]]
>> 
>> --
>> Hope this helps.  Let us know.
>> Wes
>> 
>> In news:21b101c417f8$50924cf0$3501280a@phx.gbl,
>> Rume <anonymous@discussions.microsoft.com>  hunted and
> pecked:
>>> Hi,  We just recently deployed some XP computers to some
>>> of our users.  Sometimes they receive the following
>>> message when they try to logon: Security log is full
>>> contact your System Administrator.  Subsequently they are
>>> denied logon until an adminstrator logs in and clears the
>>> log.  Is anybody out there experiencing this?  This is
>>> the first time we are having this issue and I am curious
>>> to know the cause of this.  On checking the security log,
>>> we find erroneous login and logout events by the computer
>>> user which are entered a second or two apart in the
>>> security log. But this is not the case because the user
>>> remains logged in after they log on to the computer. Any
>>> suggestions will be appreciated.
>>> 
>>> Thanks,
>>> 
>>> Rume
>> 
>> .


Relevant Pages

  • Re: SECURITY LOG IS FULL MESSAGE
    ... it stops recording new events. ... To overwrite events, on the Action menu, click Properties, and then ... > message when they try to logon: Security log is full ... > denied logon until an adminstrator logs in and clears the ...
    (microsoft.public.windowsxp.security_admin)
  • Re: SECURITY LOG IS FULL MESSAGE
    ... This was not an issue with windows 2000. ... Rume ... To overwrite events, on the Action menu, click ... >> security log. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Event Viewer stopped logging security audit
    ... of when "maximum log size is reached" in the properties of the security log. ... The options are - overwrite events as needed, ... > event viewer in the section Security. ... I checked the auditing event to see ...
    (microsoft.public.win2000.security)
  • Re: Event Log Settings
    ... it will overwrite events older than X days. ... Maximum security log size 81920 ... Retain security log 7 days (<-- overwrite events ... Retention method for security log As needed (<-- overwrite events ...
    (microsoft.public.security)
  • Re: Really no answer?
    ... >Sometimes helps if you clear the security log. ... >its setting to "overwrite events as necessary". ... >HTH ... flakey, possibly related to the fact that WMI thinks it needs to ...
    (microsoft.public.windowsxp.security_admin)