The event log is implemented as a ring buffer, and the allocated memory chunk is 64KB. Each log entry is actually variable in size, depending upon the amount of text in the message. For each entry, there is a 16-byte (fixed size) data “header” portion, and a variable portion whose length is specified by a field in the header portion. This variable portion is where the text of the log message is stored. That portion doesn’t include the date/time/uptime value we display, nor the component identifier we display – it contains only the text, and we don’t store a terminating NULL byte since we do store the length in the header portion.
To prevent huge messages from being logged to fill the event log, the logging code implements a maximum text size of 176 bytes. This was increased from 128 bytes on Sept. 11, 2008, as part of the resolution of longer VPN feature messages were being truncated. That was released in 2.8.1 firmware, and all products with 2.8.1 or higher versions use this higher maximum log text size.
When the event log fills up, a new message is added by discarding one or more of the oldest messages to make enough room for the new message.
Since the size of the log message text varies, one cannot state any exact number of log messages that the event log ring buffer will hold. That is, it can hold more small messages than it can large messages. One can express the log size only in terms of “16 bytes fixed plus N bytes variable” per message, until the 64KB log message buffer is filled.