What’s the issue?
SQL Server maintains a series of error log files that record service startup messages, login activity, errors, backup history, and many other diagnostic events. The current log is named ERRORLOG, with archived copies named ERRORLOG.1, ERRORLOG.2, and so on. A new log file is created each time the SQL Server service restarts or when the log is manually cycled.By default, SQL Server retains only six archived error logs in addition to the current one, for a total of seven. Once that limit is reached, each new log creation causes the oldest archive to be deleted permanently. This finding indicates there are less than 12 error log files.
Why is this a problem?
The default of six archived logs is too low for most production environments. On instances that restart frequently (due to patching, failovers, or maintenance) or that cycle the log on a schedule, six archives can cover only a few weeks or even days of history.When older logs are deleted, the diagnostic record of past events is lost. This makes it impossible to investigate issues that surfaced earlier, correlate failures with patterns over time, or provide historical evidence during audits and incident reviews.
The error log is often the first place administrators look when troubleshooting, and missing entries from previous weeks or months can turn a routine investigation into guesswork. The default also predates modern monitoring practices and reflects an era when log files were considered short term operational data rather than a long-term diagnostic record.
What should you do about this?
Increase the number of retained error logs to a more reasonable value (we recommend 52). The setting is configured through SSMS by right clicking SQL Server Logs under Management and selecting Configure, or via T-SQL using xp_instance_regwrite to update the registry value NumErrorLogs under the SQL Server instance key.Combine the increased retention with regular log cycling so individual log files do not become unwieldy. Schedule a SQL Server Agent job to run EXEC sp_cycle_errorlog; on a regular cadence (we recommend weekly), which closes the current log and starts a new one without requiring a service restart.
The combination of more retained logs and regular cycling produces a longer history of smaller, more manageable files that are easier to search and review. Monitor disk space on the SQL Server LOG directory after the change, since the increased retention does consume more storage, though typically a small amount relative to the operational benefit.