Windows Security Log Event ID 1104

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Non Audit (Event Log)
 • Event processing
Type Success
Corresponding events
in Windows 2003
and before
 
Discussions on Event ID 1104
Ask a question about this event

1104: The security Log is now full

On this page

No more events will be logged until the log is expanded, cleared or configured to overwrite events.

This event indicates a "hole" in your audit trail and should be avoided with the implementation of an effective log management solution that collects events before they can be overwritten or before the log fills up.

"Do not overwrite events (clear log manually)" should only be used in conjunction with the security option "Audit: Shutdown system immediately if unable to log security audits".  Of course these 2 settings together will cause the system outages if the log is allowed to fill up and would only be appropriate for systems with the highest integrity requirements on audit trails.

Free Security Log Resources by Randy

Supercharger Free Edition

 

Examples of 1104

The security log is now full.

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources