I support a large environment which is divided into 4 domains with about 120 BDCs (NT 4) and 5000 NT 4 workstations in each domain. The PDCs are still NT 3.51 (Please don’t ask me why we’re still running NT 3.51 on PDCs.)
We want to keep at least 7days worth of events in the system event logs on the PDCs but they continuously get filled up with event 5711 (partial synchronization).
We have increased the system event log size to 70MB and still we are only able capture 4 to 5 days worth of events in 2 domains.
I’ve done a little research and found that most of this traffic is generated by secure channel password changes.
My manaager is reluctant to disable this feature. My only option, then, is to increase the system event log size toperhaps 100MB caputre a week’s worth of data.
Does anyone know of any negative implications of making the event log so large? Or, I’d greatly appreciate any other suggestions on getting a handle on this matter. Thanks.