Issue with 'Limit-EventLog'?

This topic contains 8 replies, has 3 voices, and was last updated by Profile photo of Don Jones Don Jones 2 years, 4 months ago.

  • Author
    Posts
  • #17344
    Profile photo of Kirk Hauer
    Kirk Hauer
    Participant

    Hi, I just came across this issue this morning, was hoping someone here could explain to me why it's happening:

    PS C:\> Invoke-Command -Session $s -ScriptBlock {Limit-EventLog -LogName Security -MaximumSize 4GB -OverflowAction OverwriteAsNeeded}
    The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper value and then retry.
    + CategoryInfo : InvalidData: (:) [Limit-EventLog], Exception
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand
    + PSComputerName : Server01

    The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper value and then retry.
    + CategoryInfo : InvalidData: (:) [Limit-EventLog], Exception
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand
    + PSComputerName : Server02

    The value supplied for MaximumSize parameter has to be in the range of 64 KB to 4GB with an increment of 64 KB. Please enter a proper value and then retry.
    + CategoryInfo : InvalidData: (:) [Limit-EventLog], Exception
    + FullyQualifiedErrorId : ValueOutofRange,Microsoft.PowerShell.Commands.LimitEventLogCommand
    + PSComputerName : Server03

    PS C:\> Invoke-Command -Session $s -ScriptBlock {Limit-EventLog -LogName Security -MaximumSize 3GB -OverflowAction OverwriteAsNeeded}

    PS C:\>

    If you notice, you'll see that in the first line I'm attempting to limit the Security log to 4GB, which should be a supported value, but it does not accept it. Going down to 3GB, however, works fine. Any ideas?

  • #17345
    Profile photo of Kirk Hauer
    Kirk Hauer
    Participant

    Sorry, I should've included the server information... Server01 and 02 are DCs running Server 2012 R2, Server03 is a DC running Server 2012. All three are VMs running on Hyper-V 2012 R2.

  • #17346
    Profile photo of Don Jones
    Don Jones
    Keymaster

    PowerShell interprets 4GB as a base-2 number, and the event log wants a base-10 number. 4GB in base-2 is larger than 4GB in base-10. Try specifying the actual number of bytes, rather than using the GB unit. E.g., 4000000000 (4 billion).

    Technically, "4GB" in PowerShell is actually 4GiB, not exactly 4 billion.

  • #17347
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    That doesn't seem to be the case, based on some quick tests. It really does want increments of 64KiB, and will accept a size of "64KB" in PowerShell. It doesn't like 4GB for some reason, but will accept (4GB – 64KB) (4294901760).

    Edit: Confirmed with dotPeek, 4294901760 is the highest value you can assign. This limitation is coded down in the underlying .NET Framework classes, not the Limit-EventLog cmdlet itself, which might account for the confusing documentation (which seems to indicate that 4GB should be a valid value.)

  • #17349
    Profile photo of Don Jones
    Don Jones
    Keymaster

    So you're saying it'll accept 4294901760 as an argument? That's not working for me.

    My point was, I can use 4000000000, but not 4294901760. I don't think it cares as much about the increment (when I set the value through WMI, which is a bit lower-level, if you provide an invalid increment, it rounds up to the next increment), but that it seems to have an upper limit of 4GB not 4GiB.

  • #17351
    Profile photo of Dave Wyatt
    Dave Wyatt
    Moderator

    That's odd. I get exactly the opposite results; 4000000000 throws an error, and 4294901760 works fine. I'm on a PowerShell 4.0 machine at the moment; what version did you test on?

  • #17352
    Profile photo of Kirk Hauer
    Kirk Hauer
    Participant

    @Don, thank you for the quick reply. It makes sense.

    However, given that the error message displays "64 KB to 4GB" *shouldn't* a value of 4GB work? Seems to me that this is something the PowerShell team may want to rectify, either in the error message or in the handling of the integer (and hopefully in the latter).

  • #17353
    Profile photo of Kirk Hauer
    Kirk Hauer
    Participant

    I'm using PowerShell 3.0, for the record.

  • #17354
    Profile photo of Don Jones
    Don Jones
    Keymaster

    If the error indeed comes from PowerShell, and not from the underlying .NET Framework, then yeah, I'd think they'd want to clarify.

You must be logged in to reply to this topic.