How to fix a custom Event Viewer Log that merges automatically with the Application log

eventviewerwindows-event-logwindows-server-2003

I am trying to create a custom event log for a Windows Service on Windows Server 2003. I would like to name the custom log "(ML) Startup Commands". However, when I add a registry key with that name to HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\, it adds a log but shows the exact same events that are in the Application log when looking in the event viewer.

If I add a registry key with the name "(ML) Startup Commands 2" to the event log, it shows a blank event log as expected. In fact, any other name will work correctly except for the one I want.

I have searched through the registry for other keys with the string "(ML)" and removed all other references to this key name, however I continue to get merged results in the viewer when I create a key with this name.

My question is, how can I fix the server so I can create a custom event log with this name that shows only the events from my application, not the events from the default Application event log that is installed with Windows?

Update:

I rebooted the server and woudn't you know it, the log started acting normally. I got a strange error message in the Application log:

The EventSystem sub system is
suppressing duplicate event log
entries for a duration of 86400
seconds. The suppression timeout can
be controlled by a REG_DWORD value
named SuppressDuplicateDuration under
the following registry key:
HKLM\Software\Microsoft\EventSystem\EventLog.

For more information, see Help and
Support Center at
http://go.microsoft.com/fwlink/events.asp.

I can only hope this error doesn't mean the problem will come back after 86400 seconds. I guess I will have to wait and see.

Best Answer

I haven't really tried to use custom event logs. But I have seen the problem you describe, with the same events appearing in more than 1 log. This can happen because event logs are memory mapped files, and if the total size of all event logs is greater than 300MB you will start to have issues.

See the 2nd or so page of this article:

http://technet.microsoft.com/en-us/library/cc722385%28WS.10%29.aspx

>On Windows XP-based computers, member servers, and stand-alone servers, the
>combined size of the Application, Security, and System logs should not exceed 300 MBs.