In our recent article, we’ve shared you how to allow Event Viewer to archive the log when maximum log size is reached:
However in some versions of Windows 10 users has reported that Event Viewer won’t archive logs when the maximum log size limit is reached. According to some users, they’ve configured the archive logging option. But when the maximum log size limit is reached, Event Viewer just stops logging and no archive file is created.
According to Microsoft, when the limit is reached, Event Viewer triggers Event ID 1105 which generates new log file. This means the older logs should be archived immediately with an effect to this event. However, the users has confirmed that Event ID 1105 doesn’t occurs and Event Viewer quits logging.
In case if you’re also experiencing this problem on your system, try these suggestions and see if they helps:
FIX: Event Viewer Won’t Archive Logs In Windows 10
FIX 1 – General Suggestions
1. Confirm, if the issue is limited to particular type of logging. For example, if you’re facing the issue with Security logs, check if the issue persists with Application, Setup or System logs.
2. If you’ve default maximum log size limit configured, try setting it a lower value and check if Event Viewer archive logs then. For example, if the default size is 20480 KB for Security, I would set them to 20100 KB and see if it works.
3. Run System File Checker scan, just in case if it resolves the problem.
4. Perform clean boot. This will help if some software is blocking from Event Viewer from archiving log.
5. If you’re on Windows 10 V1709, make sure you’ve installed KB4056892 which addresses this problem.
FIX 2 – Via Registry
If the UI option is not working, you can configure log retention policy using the procedure described below.
Registry Disclaimer: The further steps will involve registry manipulation. Making mistakes while manipulating registry could affect your system adversely. So be careful while editing registry entries and create a System Restore point first.
1. Press + R and put
regedit in Run dialog box to open Registry Editor (if you’re not familiar with Registry Editor, then click here). Click OK.
2. In left pane of Registry Editor window, navigate to following registry key:
3. Create a registry sub-key to EventLog registry key. Name it as Security, if you want to configure it for Security logs. Or name is as Application, System or Setup, depending upon type of logs you want to archive. In the right pane of registry sub-key, create a registry string (REG_SZ) named AutoBackupLogFiles and set it to 1.
4. Close Registry Editor and reboot to make changes effective.
Hope something helps!