Setting options for logging events
Application and system logging start automatically when you start the computer. Logging stops when an event log becomes full and cannot overwrite itself, either because it has been set for manual clearing or because the first event in the log is not old enough. You use Group Policy to set up security logging.
To define logging parameters for each kind of log, in the Event View console tree, right-click the type of log, and then click Properties. On the General tab, you can set the maximum size of the log and specify whether the events are overwritten or stored for a certain period of time.
The default logging policy is to overwrite logs as needed, provided events are at least seven days old. You can customize this policy for different logs.
The Event log wrapping options include the following.
Use To
Overwrite events as needed:
Have new events continue to be written when the log is full. Each new event replaces the oldest event in the log. This option is a good choice for low-maintenance systems.
Overwrite events older than [x] days :
Retain the log for the number of days you specify before overwriting events. The default is seven days. This option is the best choice if you want to archive log files weekly. This strategy minimizes the chance of losing important log entries and at the same time keeps log sizes reasonable.
Do not overwrite events:
Clear the log manually rather than automatically. Select this option only if you cannot afford to miss an event (for example, for the security log at a site where security is extremely important).
Note • When a log is full and no more events can be logged, you can free the log by clearing it. Reducing the amount of time you keep an event also frees the log if it allows the next record to be overwritten.
• Each log file has an initial maximum size of 512 KB. You can increase the maximum log size to the capacity of the disk and memory, or you can decrease the maximum log size. Before decreasing a log's size, you must clear the log.
I just had the same problem..
