NoteHKLM\SYSTEM\CurrentControlSet\Services\EventLog\<Log-name>
| Data type | Range | Default value |
|---|---|---|
| REG_DWORD | 0x0 | 0x1 - 0xFFFFFFFE seconds | 0xFFFFFFFF | 0x93A80 (604800 seconds = 7 days) |
Determines how long records of events are protected from being overwritten. When the age of an event reaches or exceeds the value of this entry, it can be overwritten.
| Value | Meaning |
|---|---|
| 0x0 | Event Viewer overwrites events only when the log reaches the maximum size, as defined by the value of MaxSize. This value corresponds to the Overwrite events as needed option on the Properties dialog box for a log in Event Viewer. |
| 0x1 - 0xFFFFFFFE | Specifies how long records are protected. |
| 0xFFFFFFFF | Records are never overwritten. When the log file reaches its maximum size, as defined by the value of MaxSize, ???. You must clear the log manually, by clicking Clear all Events. This value corresponds to the Do not overwrite events option in Event Viewer. |
To change the value of this entry, use Event Viewer. This entry corresponds to the options in the Event log wrapping section of the Properties page for any log.
Note
Event Viewer requires that you enter retention values in days, not seconds, and enforces a range of 1 day (86,400 seconds) - 365 days (31,536,000 seconds). If you change the value of this entry by editing the registry, the value you enter is effective. However, if you change any values in the Event Log Settings Properties dialog box for any log in Event Viewer, Event Viewer converts the value of Retention to the nearest day and replaces the value in the registry.