| Author | Messages | |
mschrisran
Posts:15
 | | 09/08/2008 3:54 PM |
| When you decrease the size of the event logs, we will not decrease the contents of the file if it's over your new quota size. So if you had it set to 300mb, filled the log, and then lowered to 128mb, the file would stay at 300mb. Same happens if you push the policy via GPO. You need to save, and then purge the log.
The limit is the fact that we use Memory mapped files for the event logs, and when we exceed 300mb, we can start to chew memory pooled resources, and depending on available resources we can get to black out points, where we cannot log entries, or we consume the limited resources.
It's best to keep them all under 300mb in 32-bit (any version). In 64-bit we don't have the same pool limits on paged, and non-paged, so this event log size limit is also lifted. Plus Crimson just really kicks...
Chris Ransom
Senior Premier Field Engineer - Active Directory
South Central District - San Antonio
US Central Premier Field Engineering
Email: chrisran@microsoft.com
Blog: http://mschrisran.spaces.live.com
-----Original Message-----
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Steve Schofield
Sent: Thursday, August 21, 2008 12:34 AM
To: ActiveDir@mail.activedir.org
Subject: Re: AD: RE: [ActiveDir] Not enough memory event log message.
Interesting. The policy for security event logs is 131 MB. On disk, actual
file for the security event log is 334 MB. The rest of the logs are about
the size the policy describes. From what I read, adding more memory won't
necessarily fix this issue as much as upgrading to x64. I was planning on
running schema extension updates to prep the domain and forest for w2k8 when
this error came up.  From what I can find, this is the issue.
Thanks,
Steve
----- Original Message -----
From: "Mark Parris (L)" <lists@baseit.co.uk>
To: "ActiveDir" <ActiveDir@mail.activedir.org>
Sent: Tuesday, August 19, 2008 4:07 PM
Subject: Re: AD: RE: [ActiveDir] Not enough memory event log message.
> Large event log files >300MB total can chew up memory too.
>
> http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch06n.mspx
> Regards,
>
> Mark Parris
>
>
>
>
> -----Original Message-----
> From: "Bazell Jennifer C" <Jennifer.C.Bazell@irs.gov>
>
> Date: Tue, 19 Aug 2008 14:04:47
> To: <ActiveDir@mail.activedir.org>
> Subject: AD: RE: [ActiveDir] Not enough memory event log message.
>
>
> Here is a link I saved. It's a good start to understanding token bloat.
>
> http://www.microsoft.com/downloads/details.aspx?familyid=22dd9251-0781-42e6-9346-89d577a3e74a&displaylang=en
>
> -----Original Message-----
> From: ActiveDir-owner@mail.activedir.org
> [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Liu, David
> Sent: Tuesday, August 19, 2008 1:55 PM
> To: ActiveDir@mail.activedir.org
> Subject: RE: [ActiveDir] Not enough memory event log message.
>
> Interesting..i was just talking to my AD admins the other day about
> possibility of having too many security group memberships n AD user accts
> may slow down login policy processing -wd you happen to have a technet
> reference or link to the token explosion? Abd does anyone happen to know
> what the recommended maximum is, if any?
>
> From: ActiveDir-owner@mail.activedir.org
> [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Davy Pierson
> Sent: Tuesday, August 19, 2008 2:12 PM
> To: ActiveDir@mail.activedir.org
> Subject: RE: [ActiveDir] Not enough memory event log message.
>
> Maybe unrelated, but don't you get kind of a "not enough memory" error
> when you have token explosion (for example user in too many groups)?
> Maybe related...
>
> Just a thought,
> DavyP
> ________________________________________
> From: ActiveDir-owner@mail.activedir.org
> [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Steve Schofield
> Sent: dinsdag 19 augustus 2008 19:30
> To: ActiveDir@mail.activedir.org
> Subject: Re: [ActiveDir] Not enough memory event log message.
>
> I had a domain controller boot up after patching this weekend and logged
> "Increase the amount of physical memory or virtual memory and restart this
> domain controller." right after the DC came online. The error was
> referring to the destination domain controller.
>
> For example, I have DC1 and DC2. I rebooted DC2 for patching and when DC2
> came online, the error showed up stating DC1 didn't have enough memory. I
> looked DC1 memory and there was 100 MB of memory free, the commit charge
> was less than 50% used. I'm not certain if adding more memory to DC1 would
> resolve the issue.
>
> I've not seen any other replication issues since and this is the first
> time I've seen this error. Google is not being too helpful. From what I
> can tell, AD is having no issues. Both DC1 / DC2 are Global catalogs and
> host DNS services.
>
> Thanks,
>
> Steve
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive: http://www.activedir.org/ma/default.aspx
> List info : http://www.activedir.org/List.aspx
> List FAQ : http://www.activedir.org/ListFAQ.aspx
> List archive: http://www.activedir.org/ma/default.aspx
> .+-Šwè†Ûi ü0Á§-Š÷Šº+ƒò ²Ö¬§ ²Ñ@Bm§ ðà ¶+Þv*è®ËŠËE¬§ ²Ö«r¯zm§ ðà ¶+Þv*è®æk÷^}«¥µ«)
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.activedir.org/ma/default.aspx
.+-� 0�����j�q.+-� 0����ˊ�E��Kj�!i�b��b����ןj�m | | | |
|
|