EventRecordID what happens when it reaches its max size, does it wrap around to start again from 0

Sam light 6 Reputation points
2022-02-25T11:17:12.787+00:00

So I've been trying to query the Windows EventViewer and it got me thinking that what happens when it reaches the max size of 18,446,744,073,709,551,615 does it wrap around and start again from 0? if that does happen how will I query EventViewer with EventRecordID since starting again from EventRecordID to > 0 will again fetch the beginning data as well as the wrapped around data?

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,276 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Limitless Technology 44,001 Reputation points
    2022-02-28T16:29:33.073+00:00

    Hello @Sam light

    Thank you for this metaphysical question. There is absolutely no documentation to the respect, and the limit is related to 2^64-1 as a calculation in binary of 64bit (equals to 1111111111111111111111111111111111111111111111111111111111111111b). The reason why this limit is not tested is that even if each ID information was only 1Kb of space, the total amount will be measured in Zettabytes (or millions of Terabytes).

    A scientific estimation in 2018 about the world´s total combined digital storage predicts that it would be around 175 Zettabytes by 2025. This Event viewer would take 10% of it.

    Hope this helps with your query,

    --
    --If the reply is helpful, please Upvote and Accept as answer--

    1 person found this answer helpful.