How much is enough? By how much we’re referring to the length of the message field in a typical Windows Event. Prior to Windows Server 2008 the level of detail in an event log wasn’t too overwhelming. However now that we’re post-Windows Server 2008 and the changes introduced with the Windows Event Log, we’re now beginning to find that the old “typical” just isn’t enough.
This problem first came to light with the SMTP or Email notification. By default ELM is set to a Max Message length of 1024 characters. This can be adjusted up or down depending on how or where the message will be delivered. If it is too low, the event message details will be truncated at the end, possibly leaving off some important details that you need to determine what’s going on.
Adjusting the message length in the SMTP Notification is quite easy. First open the properties of the notification you’d like to modify by double-clicking it or right-click and select the Properties from the context menu.
Now we’ll jump over to the Mail Message Options tab. Here is where we can set the Max Message length and unless you’ve already changed it, you’ll see the default 1024. A good starting place is to simply double the message size to 2048.
This should solve the problem of any event message being truncated in the email notifications you’re receiving. Is there any reason not to increase the number even higher?
No, you could increase the Max Message length to 10,000 if you want, it really makes no difference to ELM. The notification engine simply uses as much space is needed for the event message or, in the case of the smaller number, as much as is available and then will truncate the remainder. Note: If you are using an email notification to send messages to a smartphone via SMS/Text, you may want to shorten down the max message length to 160 characters or whatever max length is specified by your mobile carrier.
Another helpful feature we wanted to remind you of is a new message variable that was introduced in ELM version 6.5. This variable shows which Event View triggered the notification and can be very handy for tracing back to the source of event and notification activity in ELM. If you upgraded to version 6.5 by overlaying on top of an older version of ELM, then your existing email notifications did not get this feature added by default.
However, you can quickly add it by opening the properties of any Email Notification Method, navigating to the Mail Message tab and clicking the Insert Variable button in the lower right corner. On the context menu you’ll want to select %ViewName% to add to the message or body of the email. Now your notifications will tell you which Event View triggered them. (All new email notifications created in version 6.5 include this variable by default.) You can also further customize the email message, just remember to use a CTRL-Enter for line breaks.
We hope that you found this article on Dealing With Wordy Windows Server 2008 Events informative and useful and wish you continued success with ELM.