| Previous | Next |
| ERROR_EVENTLOG_CANT_START | ERROR_EVENTLOG_FILE_CHANGED |
ERROR_LOG_FILE_FULL
The event log cannot accept another record at its current size and retention policy.
ERROR_LOG_FILE_FULL is Win32 error 1502 (0x5DE). For event logs, reaching the maximum file size does not always imply failure: circular channels can overwrite old records. This code becomes significant when retention, auto-backup, archival, or channel state prevents reclamation. The correct response depends on whether losing old events is acceptable and whether the log is security- or compliance-sensitive.
Why a channel stops accepting events
- retention is enabled and records must not be overwritten automatically
- auto-backup cannot create or access its archive destination
- the maximum channel size is too small for the event rate and retention period
- a burst of verbose diagnostics consumed capacity unexpectedly
- administrative policy prevents clearing while archival has not completed
Operational telemetry
Record channel name, current and maximum size, retention and auto-backup settings, oldest and newest record identifiers, event rate, free disk space, archival destination, and the writer or provider that observed 1502. Track dropped or rejected event counts outside the affected channel. Do not solve a security-log capacity incident without preserving required audit records.
Diagnostic process
Inspect channel configuration and log information with Windows Event Log tools. Determine whether the file is genuinely at capacity, whether auto-backup failed, and which providers increased volume. Compare recent event rate with normal baselines and look for repeated identical events that indicate a fault loop rather than legitimate workload.
Verify disk space and permissions for archive files. If a collector is expected to drain events, ensure its bookmark advances and that collection latency has not exceeded the retention design. For applications using a private log, estimate maximum sustained write rate and choose capacity based on recovery time, not only nominal daily volume.
Safe recovery
Export or archive required events, then clear or enlarge the channel according to policy. Circular logging may be appropriate for diagnostic channels but not for every audit requirement. Correct noisy providers, failed collection, and archive permissions so the condition does not recur. Applications should degrade gracefully when logging fails and must not crash the primary service solely because an auxiliary event write returned 1502.
Difference from a full disk
A full volume can contribute to this error, but ERROR_LOG_FILE_FULL specifically reflects event-log capacity and policy. Freeing unrelated disk space may not help when retention forbids overwrite at the configured maximum. Conversely, increasing the log limit cannot succeed if the volume itself has no space.
Example
An operational channel retains all events and is sized for one day, but a failing device emits thousands of warnings per minute. The channel reaches its limit and returns 1502. Exporting the log preserves evidence; suppressing the repetitive provider fault and resizing for the documented retention period prevents recurrence.
References
- Microsoft: System Error Codes (1300–1699)
- Microsoft: Channel logging settings
- Microsoft: EvtGetLogInfo
Looking for a different code? Search another status or error code.