I'm working on output analysis of the Windows Event ID 5136 ("A directory service object was modified") and more specifically events with "LDAP Display Name = nTSecurityDescriptor" (see following event 5136 capture).
In the "value" field, I have a list of all the security permissions changed on the object itself, which is great. However, I notice the following problems when trying to compare 2x correlated events and their respective "values" fields:
- Number of characters is always 5120 (4096+1024)
- Text located in the last line is always truncated, and doesn't finish with the proper character - should be a ")" at the end (see folllwing text output).
Information about the events:
- Source host is a Windows Server 2012 R2 DC (up to date)
- For this specific output analysis, logs were directly extracted from the source computer itself (so no WEF, NXlog Agent, SYSLOG, ELK, SIEM, ...)
- Viewing the event with PowerShell, Event console (general tab) or Event console (Details/XML View) provide the same output
So I looked for some value size limitations inside Windows Events (not the event log file itself) but just found some info on "community embarcadero" and "developpez" websites.
Question: does someone know if there is any limitation for a Windows logs value field to 5120 Bytes and a way to increase it ? I need both to make a diff between and report the changes. Thanks
The message in the event is rendered by the EvtFormatMessage function. As far as I remember there was a limit of around 32k characters for this so this shouldn't be causing the truncation. This works via a format string that is identified by the event id and a set of values that are stored with the event. The
value: %piece is such. The EVENTDATA_DESCRIPTOR structure that is used to write this value can also store larger data.My bet is that the event provider has an internal limit (5120) for this. The reason behind this is probably due to the limitation noted in the
EVENTDATA_DESCRIPTORdocumentation:Your event has 12 values and if they used equal limits for each then it comes down to around 5kb. Perhaps you could file a bug report with Microsoft.
Initial issue was detected on 05/09/17 and today on 26/07/18 this "truncated" behavior has disappeared in my environment. Logs are not anymore truncated and full SDDL is displayed inside the Windows Event Viewer (see VALUE field below). Concerned DC is running with updates from June 2018.