9

Somehow, the Application Event log count ended up to 18,446,744,073,709,551,499. This causes MMC snap-in to fail when I want to see the event using Event Viewer, giving a System.OverflowException (Value was either too large or too small for an Int64.). Any thoughts, or should I just clear the log?

misha
  • 2,760
  • 3
  • 28
  • 30
  • 1
    Clear the log and then keep an eye on it to find which app is flooding it. – David Heffernan Nov 03 '11 at 08:28
  • I wonder, was your issue permanently resolved by clearing the event log? I ask because, six (6) years later, I've experienced this anomaly on a Windows Server, i.e. could not view the Application Event log, error "Value was either too large or too small for an Int64". Saving and clearing the log resolved the issue for some time but later the Application Event log became un-writable (nondescript OS error message when write attempted via PowerShell). Saving and clearing the log again appears to have resolved the issue... for now. Any additional info. would be appreciated. – ScottWelker Jul 07 '18 at 22:11
  • It did go away for me, can't recall it occurring again, not even sure if I identified the root cause, sorry - I don't fully remember all the details. – misha Jul 08 '18 at 19:18
  • Thanks misha. If I discover anything noteworthy I'll post it here. However, we've now gone two (2) days now without the issue returning. Head-scratcher. – ScottWelker Jul 09 '18 at 18:26

2 Answers2

6

Maybe it helps if you activate the option to override old eventlogs when the log is full. This should prevent you from loosing the newest log entries when reaching the limit.

To activate navigate to your eventlog and go to their settings. There you find an option to override old entries if the log is full.

LMW-HH
  • 1,193
  • 2
  • 15
  • 31
  • Overwriting is activated (default setting), and put to 20MB, but even so, other events don't exceed 100k in count. I guess it's an unusual situation... – misha Nov 03 '11 at 08:38
  • Okay, than I agree with David Heffernan. For analyzing your event logs you can use this tool: http://www.eventlogxp.com/ I used it several time under Windows7 – LMW-HH Nov 03 '11 at 09:35
  • I've cleared the Event log and saved the "broken" one in a file, but when I try to open it with eventlogxp it looks like it has no entries. I'll see if it goes crazy again... – misha Nov 03 '11 at 10:39
2

Before clearing the Application log I first tried "Save All Events As...", but the file it produced was empty.

I then copied C:\Windows\System32\winevt\Logs\Application.evtx to my desktop and that file DID open correctly. Not great, but an acceptable work-around for my needs.

Steve C
  • 31
  • 2