PowerShell Logo Small


This is the built-in help made by Microsoft for the command 'Limit-EventLog', in PowerShell version 5 - as retrieved from Windows version 'Microsoft Windows Server 2012 R2 Standard' PowerShell help files on 2016-06-23.

For PowerShell version 3 and up, where you have Update-Help, this command was run just before creating the web pages from the help files.


Sets the event log properties that limit the size of the event log and the age of its entries.


Limit-EventLog [-LogName] <String[]> [-ComputerName [<String[]>]] [-InformationAction {SilentlyContinue | Stop | Continue | Inquire | Ignore | Suspend}]
[-InformationVariable [<System.String]>]] [-MaximumSize [<Int64>]] [-OverflowAction {OverwriteAsNeeded | OverwriteOlder | DoNotOverwrite}] [-RetentionDays [<Int32>]]
[-Confirm] [-WhatIf] [<CommonParameters>]

Search powershellhelp.space


The Limit-EventLog cmdlet sets the maximum size of a classic event log, how long each event must be retained, and what happens when the log reaches its maximum size. You can
use it to limit the event logs on local or remote computers.

The cmdlets that contain the EventLog noun (the EventLog cmdlets) work only on classic event logs. To get events from logs that use the Windows Event Log technology in
Windows Vista and later versions of Windows, use Get-WinEvent.



Online Version: http://go.microsoft.com/fwlink/p/?linkid=290509




-------------------------- EXAMPLE 1 --------------------------

PS C:\>limit-eventLog -logname "Windows PowerShell" -MaximumSize 20KB

This command increases the maximum size of the Windows PowerShell event log on the local computer to 20480 bytes (20 KB).

-------------------------- EXAMPLE 2 --------------------------

PS C:\>limit-eventlog -logname Security -comp Server01, Server02 -retentionDays 7

This command ensures that events in the Security log on the Server01 and Server02 computers are retained for at least 7 days.

-------------------------- EXAMPLE 3 --------------------------

PS C:\>$logs = get-eventlog -list | foreach {$_.log}
PS C:\>limit-eventlog -overflowaction OverwriteOlder -logname $logs
PS C:\>get-eventlog -list

Max(K) Retain OverflowAction Entries Log
------ ------ -------------- ------- ---
15,168 0 OverwriteOlder 3,412 Application
512 0 OverwriteOlder 0 DFS Replication
512 0 OverwriteOlder 17 DxStudio
10,240 7 OverwriteOlder 0 HardwareEvents
512 0 OverwriteOlder 0 Internet Explorer
512 0 OverwriteOlder 0 Key Management Service
16,384 0 OverwriteOlder 4 ODiag
16,384 0 OverwriteOlder 389 OSession Security
15,168 0 OverwriteOlder 19,360 System
15,360 0 OverwriteOlder 15,828 Windows PowerShell

These commands change the overflow action of all event logs on the local computer to "OverwriteOlder".

The first command gets the log names of all of the logs on the local computer. The second command sets the overflow action. The third command displays the results.