Fix descriptions of invalid eventlog overflow policy

[Robo210]

Support for "Retain events older than X days" was dropped in Windows Vista (and it only ever almost worked on XP/Server 2003). This was a breaking change made roughly 15 years ago, and the new policy is documented as being strictly incompatible with the old retention setting:

• XP/2003: Set reg value to 0 for "overwrite based on log size", > 0 for "overwrite based on the value as a time", and -1 for "never overwrite events"
• Vista onward: Set reg value to 0 for "overwrite based on log size" and any non-zero value for "never overwrite events".

Encouraging people to continue to try to utilize the XP/2003 behavior of setting a time will in fact make the system never overwrite events at all, which in turn will break the system when other security policies are applied (e.g. "don't allow users to log in when the security log is full" or "bug check the machine when a security event is lost").

This change does not fully remove every reference to the old behaviors across the entire code base, but it is a start.

See the description of the Retention value at https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key for details.

[ghost]

Tagging subscribers to this area: @tommcdon
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Support for "Retain events older than X days" was dropped in Windows Vista (and it only ever almost worked on XP/Server 2003). This was a breaking change made roughly 15 years ago, and the new policy is documented as being strictly incompatible with the old retention setting:

• XP/2003: Set reg value to 0 for "overwrite based on log size", > 0 for "overwrite based on the value as a time", and -1 for "never overwrite events"
• Vista onward: Set reg value to 0 for "overwrite based on log size" and any non-zero value for "never overwrite events".

Encouraging people to continue to try to utilize the XP/2003 behavior of setting a time will in fact make the system never overwrite events at all, which in turn will break the system when other security policies are applied (e.g. "don't allow users to log in when the security log is full" or "bug check the machine when a security event is lost").

This change does not fully remove every reference to the old behaviors across the entire code base, but it is a start.

See the description of the Retention value at https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key for details.

Author:	Robo210
Assignees:	-
Labels:	area-System.Diagnostics, community-contribution
Milestone:	-

[antonfirsov]

LGTM sorry, posted on the wrong issue.

mistaken

[antonfirsov]

/cc @tommcdon

[gewarren]

Should the deprecated methods be obsoleted instead of just setting the summary to "deprecated"? That way the docs would automatically show a banner similar to this: https://learn.microsoft.com/en-us/dotnet/api/system.codedom.compiler.codedomprovider.createcompiler?view=net-8.0#definition.

[Robo210]

Should the deprecated methods be obsoleted instead of just setting the summary to "deprecated"? That way the docs would automatically show a banner similar to this: https://learn.microsoft.com/en-us/dotnet/api/system.codedom.compiler.codedomprovider.createcompiler?view=net-8.0#definition.

That sounds like a good idea, but outside of my expertise. I am wary of causing build breaks for existing code (something we can't do in Win32 land, as much as I'd like to clear out a ton of obsolete nonsense); updating the docs at least lets support engineers point impacted customers in the correct direction. I am hoping the docs can also make it clear that this is deprecated/obsolete based on the Windows version the code is running on, not a specific .Net version (i.e. I don't want a customer to say "the docs claim it is obsolete in .net 9 but we're using .net framework 3 so clearly we're still good to use it").

[learn-build-service-prod]

Learn Build status updates of commit 4c1b573:

💡 Validation status: suggestions

File	Status	Preview URL	Details
xml/System.Diagnostics/OverflowAction.xml	💡Suggestion	View	Details
xml/System.Diagnostics/EventLog.xml	✅Succeeded	View

xml/System.Diagnostics/OverflowAction.xml

• Line 0, Column 0: [Suggestion: ECMA2Yaml_Enum_NoRemarks] Please note: <remarks> node on Enum fields will be ignored.

For more details, please refer to the build report.

Note: Your PR may contain errors or warnings or suggestions unrelated to the files you changed. This happens when external dependencies like GitHub alias, Microsoft alias, cross repo links are updated. Please use these instructions to resolve them.

For any questions, please:

• Try searching the learn.microsoft.com contributor guides
• Post your question in the Learn support channel