Event Logging – Clearing the Event Log

As you might expect, an application with heavy use will quickly generate a lot of log entries. If you want to clear out the log, you only have one choice, the Clear method.

      EventLog el = new EventLog();

      el.Log = “ArcaneCode”;


This will clear ALL of the entries in the log you specify with the Log property. Now, you may be thinking “Hey, I want to keep a few, the last couple of days anyway.” Sorry Charlie, it’s an all or nothing deal.

Fortunately, keeping the event log cleaned out is something you don’t have to worry about. By default Windows will take care of it for you. You do, however, have a little bit of control over the process with some properties and methods the EventLog exposes.

The first thing you should look at is the OverflowAction property. It is an enumerated property that tells Windows what to do when the log gets full. Its possible values are:

OverflowAction.DoNotOverwrite – The least useful of the three, this tells Windows once the log is full, quit writing to it. All new events are lost, thrown away like an empty Sausage McGriddle wrapper.

OverflowAction.OverwriteAsNeeded – Nothing is overwritten until the log is full. Once full, the oldest entry is removed, replaced by the newest entry. This is the safest one to use.

OverflowAction.OverwriteOlder – This is the default. If the log is full, Windows looks for events older than the value found in MinimumRetentionDays. If it finds events that are older, it overwrites them. If it does not, the new event is discarded.

As stated, the MinimumRetentionDays shows the number of days to retain, but you have to be careful. If we are in DoNotOverwrite mode, the MinimumRetentionDays is set to -1. If we are in OverwriteAsNeeded mode, the value is 0 (zero). Only if we are in OverwriteOlder mode will this have a positive value greater than zero.

To change the mode your log works in, use the ModifyOverflowPolicy method. It takes two parameters, the OverflowAction and an integer indicating the number of retention days. In cases other than OverwriteOlder, the retention days parameter is ignored. Here’s a sample. Since I’m passing in OverwriteAsNeeded, I just passed in a 0 for the retention days since it’s ignored.  

    public static void SetToOverwriteAsNeeded()


      EventLog el = new EventLog();

      el.Log = “ArcaneCode”;

      el.ModifyOverflowPolicy(OverflowAction.OverwriteAsNeeded, 0);


For my money this is the safest way to go, as you ensure that your newest events will never get discarded.

Before we leave, there’s one more property you should look at. Let’s say your application, for whatever reason generates a lot of log entries. They are rolling out faster than you want them to. The solution then is to make the log bigger through the MaximumKilobytes property.

By default, the MaximumKilobytes for a log will be 512. Setting it straight forward, just set the value to a new size in Kilobytes.


    public static void SetLogTo1K()


      EventLog el = new EventLog();

      el.Log = “ArcaneCode”;

      el.MaximumKilobytes = 1024;     


So now you know how to clear the log, and more importantly how to control the size and retention policy for your event log. Tomorrow we’ll build on what we’ve learned to create a real word event logger.


5 thoughts on “Event Logging – Clearing the Event Log

  1. Hi,
    Just want to mention an issue I struggled with 🙂

    It is important to set the .Log property before calling the ModifyOverflowPolicy metod. If Log is not set you’ll get an exception about invalid characters in log name.


  2. Thanks. I was using sql transactions to import data from excel 2007 to sql tables through vb.net and because the excel file was too big about half a million records and different columns going into different tables that are interlinked blah blah, therefore the system was writing a lot of data to eventlogs and in the end i was getting event log is full exceptions. Your code definitely helped.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s