ashokvishnu
September 19th, 2006, 11:48 PM
Hi All,
If I update the value of File key in registry of Application event log (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application) to D:\ApplicationLog\Loggggggggggggggggggggggggggggggggggggggggggggggggggggg\AppEvent.Evt which has a length of 87characters, and restart the system windows event log will still write events to its default file in %SystemRoot%\System32\config directory. However if i give the path as D:\ApplicationLog\Logggggggggggggggggggggggggggggggggggggggggggggggggggg\AppEvent.Evt whose length is 86characters and restart then events will be written to this file. It seems windows will not consider a path whose length is greater than 86 characters in registry for event logging. I have tried expandable path also, and the issue remains even though the full path after expanding can be greater than 86 characters. That is %xxxx%/etc/etc will not be taken if length greater than 86. I have searched a lot for a an explanation for this behaviour but found none. Anyone here has some idea why this is happening.
Thanks
If I update the value of File key in registry of Application event log (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application) to D:\ApplicationLog\Loggggggggggggggggggggggggggggggggggggggggggggggggggggg\AppEvent.Evt which has a length of 87characters, and restart the system windows event log will still write events to its default file in %SystemRoot%\System32\config directory. However if i give the path as D:\ApplicationLog\Logggggggggggggggggggggggggggggggggggggggggggggggggggg\AppEvent.Evt whose length is 86characters and restart then events will be written to this file. It seems windows will not consider a path whose length is greater than 86 characters in registry for event logging. I have tried expandable path also, and the issue remains even though the full path after expanding can be greater than 86 characters. That is %xxxx%/etc/etc will not be taken if length greater than 86. I have searched a lot for a an explanation for this behaviour but found none. Anyone here has some idea why this is happening.
Thanks