Exchange Health Checker: Event Log - Not enough logs to cover

It may happen that the Exchange Health Checker displays the following error in the report:

Event Log -  -ERROR- Not enough logs to cover 7 days. Last log entry is at ... This could cause issues with Root Cause Analysis

Actually, this is not really an error. A message as a warning would probably have sufficed. The error merely indicates that the size of the event log is too small (the application log is mentioned in the screenshot above). An event log that is too small may overwrite the data too quickly, which can make it difficult to trace or analyze problems afterwards.

The solution is therefore very simple: enlarge the event log. The event log is 32MB in size by default. As soon as the event log reaches 32MB, the oldest entries are overwritten. For a single Exchange Server, the log can be enlarged by right-clicking:

In theory, the log file can be up to a maximum file size of 16TB, but such large files can no longer be displayed with the Event Viewer. If long periods of logs are required, a log management system is more suitable than the local event log. I would therefore set the smallest possible size here so that searching through the log does not become a pain.

The screenshot shows the timestamp of the oldest entry, so in my case about 5 days of logs fit into 32MB. So with 64MB I can manage about 10 days. That's quite enough for me.

For multiple Exchange servers, a group policy can be used to adjust the size of the event log on all Exchange servers. The path of the setting can be seen in the following screenshot:

If the setting is distributed via group policy, the size of the log can no longer be adjusted locally. In this case, only an error message is displayed.