JSI Tip 3734. Windows 2000 ignores duplicate events?

When the Net Logon service prepares to write an event to the System event log, it first determines if the event is a continuation of a previous event. If the second event is identical to the previous event, and it occurs less than 2 hours after the previous event, it is considered to be a continuation and is NOT recorded.

NOTE: This function is designed to minimized the number of repeated entries in the System event log.

You can alter this behavior by using Regedt32 to Add Value name DuplicateEventlogTimeout, a REG_DWORD data type, at HKEY_LOCAL_MACHINE\\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters, and setting the data value to a Decimal number between 0 and 4,292,967.

NOTE: Setting DuplicateEventlogTimeout to 0 causes Net Logon to record all events.



Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish