EventLog::OverflowAction Property


Gets the configured behavior for storing new entries when the event log reaches its maximum log file size.

Namespace:   System.Diagnostics
Assembly:  System (in System.dll)

property OverflowAction OverflowAction {
	OverflowAction get();

Property Value

Type: System.Diagnostics::OverflowAction

The OverflowAction value that specifies the configured behavior for storing new entries when the event log reaches its maximum log size. The default is OverwriteOlder.

Event logs grow in size as new events are written to them. Each event log has a configured maximum size limit; the MaximumKilobytes property defines the maximum number of kilobytes allowed for the event log file size.

Use the OverflowAction property value to examine the configured overflow behavior for an event log at its maximum size. Use the ModifyOverflowPolicy method to change the overflow behavior for an event log.


The overflow behavior takes effect only when an event log reaches its maximum file size. The overflow behavior does not affect writing a new entry to a log that can accommodate additional event log entries.

The following example enumerates the event logs defined on the local computer, and displays configuration details for each event log.

void DisplayEventLogProperties()

   // Iterate through the current set of event log files,
   // displaying the property settings for each file.
   array<EventLog^>^eventLogs = EventLog::GetEventLogs();
   System::Collections::IEnumerator^ myEnum = eventLogs->GetEnumerator();
   while ( myEnum->MoveNext() )
      EventLog^ e = safe_cast<EventLog^>(myEnum->Current);
      Int64 sizeKB = 0;
      Console::WriteLine( "{0}:", e->LogDisplayName );
      Console::WriteLine( "  Log name = \t\t {0}", e->Log );
      Console::WriteLine( "  Number of event log entries = {0}", e->Entries->Count );

      // Determine if there is a file for this event log.
      RegistryKey ^ regEventLog = Registry::LocalMachine->OpenSubKey( String::Format( "System\\CurrentControlSet\\Services\\EventLog\\{0}", e->Log ) );
      if ( regEventLog )
         Object^ temp = regEventLog->GetValue( "File" );
         if ( temp != nullptr )
            Console::WriteLine( "  Log file path = \t {0}", temp );
            FileInfo^ file = gcnew FileInfo( temp->ToString() );

            // Get the current size of the event log file.
            if ( file->Exists )
               sizeKB = file->Length / 1024;
               if ( (file->Length % 1024) != 0 )
               Console::WriteLine( "  Current size = \t {0} kilobytes", sizeKB );
            Console::WriteLine( "  Log file path = \t <not set>" );

      // Display the maximum size and overflow settings.
      sizeKB = e->MaximumKilobytes;
      Console::WriteLine( "  Maximum size = \t {0} kilobytes", sizeKB );
      Console::WriteLine( "  Overflow setting = \t {0}", e->OverflowAction );
      switch ( e->OverflowAction )
         case OverflowAction::OverwriteOlder:
            Console::WriteLine( "\t Entries are retained a minimum of {0} days.", e->MinimumRetentionDays );

         case OverflowAction::DoNotOverwrite:
            Console::WriteLine( "\t Older entries are not overwritten." );

         case OverflowAction::OverwriteAsNeeded:
            Console::WriteLine( "\t If number of entries equals max size limit, a new event log entry overwrites the oldest entry." );



for administering event log information on the computer. Associated enumeration: EventLogPermissionAccess::Administer

.NET Framework
Available since 2.0
Return to top