Skip to content

Commit 5c0ddaa

Browse files
authored
Remove mention of invalid eventlog overflow policy
Support for "Retain events older than X days" was dropped in Windows Vista (and it only ever almost worked on XP/Server 2003). This was a breaking change made roughly 15 years ago, and the new policy is documented as being strictly incompatible with the old retention setting: - XP/2003: Set reg value to 0 for "overwrite based on log size", > 0 for "overwrite based on the value as a time", and -1 for "never overwrite events" - Vista onward: Set reg value to 0 for "overwrite based on log size" and any non-zero value for "never overwrite events". Encouraging people to continue to try to utilize the XP/2003 behavior of setting a time will in fact make the system never overwrite events at all, which in turn will break the system when other security policies are applied (e.g. "don't allow users to log in when the security log is full" or "bug check the machine when a security event is lost"). This change does not fully remove every reference to the old behaviors across the entire code base, but it is a start. See the description of the Retention value at https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key for details.
1 parent 6190dd8 commit 5c0ddaa

File tree

1 file changed

+1
-45
lines changed

1 file changed

+1
-45
lines changed

xml/System.Diagnostics/OverflowAction.xml

Lines changed: 1 addition & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,7 @@
3333
3434
- New entries will be discarded.
3535
36-
- New entries will overwrite older entries.
37-
38-
- New entries will either be discarded or will overwrite existing entries depending upon the age of the existing entries.
36+
- New entries will overwrite older entries.
3937
4038
Use the <xref:System.Diagnostics.EventLog.ModifyOverflowPolicy%2A> method to set the overflow behavior for an <xref:System.Diagnostics.EventLog>. Check the current configured behavior of an <xref:System.Diagnostics.EventLog> through its <xref:System.Diagnostics.EventLog.OverflowAction%2A> property.
4139
@@ -113,47 +111,5 @@ The following example enumerates the event logs defined on the local computer an
113111
<summary>Indicates that each new entry overwrites the oldest entry when the event log is full.</summary>
114112
</Docs>
115113
</Member>
116-
<Member MemberName="OverwriteOlder">
117-
<MemberSignature Language="C#" Value="OverwriteOlder" />
118-
<MemberSignature Language="ILAsm" Value=".field public static literal valuetype System.Diagnostics.OverflowAction OverwriteOlder = int32(1)" />
119-
<MemberSignature Language="DocId" Value="F:System.Diagnostics.OverflowAction.OverwriteOlder" />
120-
<MemberSignature Language="VB.NET" Value="OverwriteOlder" />
121-
<MemberSignature Language="F#" Value="OverwriteOlder = 1" Usage="System.Diagnostics.OverflowAction.OverwriteOlder" />
122-
<MemberSignature Language="C++ CLI" Value="OverwriteOlder" />
123-
<MemberType>Field</MemberType>
124-
<AssemblyInfo>
125-
<AssemblyName>System</AssemblyName>
126-
<AssemblyVersion>2.0.0.0</AssemblyVersion>
127-
<AssemblyVersion>4.0.0.0</AssemblyVersion>
128-
</AssemblyInfo>
129-
<AssemblyInfo>
130-
<AssemblyName>System.Diagnostics.EventLog</AssemblyName>
131-
<AssemblyVersion>4.0.0.0</AssemblyVersion>
132-
<AssemblyVersion>4.0.1.0</AssemblyVersion>
133-
<AssemblyVersion>4.0.2.0</AssemblyVersion>
134-
<AssemblyVersion>5.0.0.0</AssemblyVersion>
135-
<AssemblyVersion>6.0.0.0</AssemblyVersion>
136-
<AssemblyVersion>7.0.0.0</AssemblyVersion>
137-
<AssemblyVersion>8.0.0.0</AssemblyVersion>
138-
</AssemblyInfo>
139-
<ReturnValue>
140-
<ReturnType>System.Diagnostics.OverflowAction</ReturnType>
141-
</ReturnValue>
142-
<MemberValue>1</MemberValue>
143-
<Docs>
144-
<summary>Indicates that new events overwrite events older than specified by the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> property value when the event log is full. New events are discarded if the event log is full and there are no events older than specified by the <see cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" /> property value.</summary>
145-
<remarks>
146-
<format type="text/markdown"><![CDATA[
147-
148-
149-
]]></format>
150-
</remarks>
151-
<altmember cref="T:System.Diagnostics.EventLog" />
152-
<altmember cref="P:System.Diagnostics.EventLog.OverflowAction" />
153-
<altmember cref="P:System.Diagnostics.EventLog.MaximumKilobytes" />
154-
<altmember cref="P:System.Diagnostics.EventLog.MinimumRetentionDays" />
155-
<altmember cref="M:System.Diagnostics.EventLog.ModifyOverflowPolicy(System.Diagnostics.OverflowAction,System.Int32)" />
156-
</Docs>
157-
</Member>
158114
</Members>
159115
</Type>

0 commit comments

Comments
 (0)