UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

Event log sizes do not meet minimum requirements.


Overview

Finding ID Version Rule ID IA Controls Severity
V-1118 5.002 SV-29488r1_rule ECRR-1 Medium
Description
Inadequate log size will cause the log to fill up quickly and require frequent clearing by administrative personnel.
STIG Date
Windows 2008 Domain Controller Security Technical Implementation Guide 2013-07-03

Details

Check Text ( C-16639r1_chk )
Vista/2008 - If the following registry values don’t exist or are not configured as specified, then this is a finding:

Registry Hive: HKEY_LOCAL_MACHINE

Subkey: Software\Policies\Microsoft\Windows\EventLog\Application
Value Name: MaxSize
Type: REG_DWORD
Value: 32768

Subkey: Software\Policies\Microsoft\Windows\EventLog\Security
Value Name: MaxSize
Type: REG_DWORD
Value: 81920

Subkey: Software\Policies\Microsoft\Windows\EventLog\Setup
Value Name: MaxSize
Type: REG_DWORD
Value: 32768

Subkey: Software\Policies\Microsoft\Windows\EventLog\System
Value Name: MaxSize
Type: REG_DWORD
Value: 32768

Documentable: Yes
Documentable Explanation: If the machine is configured to write an event log directly to an audit server, the “Maximum log size” for that log does not have to conform to the requirements above. This should be documented with the IAO.

Fix Text (F-16018r1_fix)
Configure the following policy values as listed below:

Computer Configuration -> Administrative Templates -> Windows Components -> Event Log Service ->

Application -> “Maximum Log Size (KB)” will be set to “Enabled:32768”
Security -> “Maximum Log Size (KB)” will be set to “Enabled:81920”
Setup -> “Maximum Log Size (KB)” will be set to “Enabled:32768”
System -> “Maximum Log Size (KB)” will be set to “Enabled:32768”