Recommended max size for Directory Service, DFS Replication and DNS Server logs on DCs?

Hi all,

I'm reviewing event log sizes on our domain controllers (~30 DCs, Server 2019, multi-domain forest) and I'm not sure what values make sense for these three logs:

– Directory Service

– DFS Replication

– DNS Server

CIS and STIG only define sizes for Application, Security and System, and the Event Log settings in Group Policy don't cover these logs either, so I'm planning to set MaxSize via GPP Registry (HKLM\SYSTEM\CurrentControlSet\Services\EventLog\<LogName>\MaxSize).

Right now the defaults are small and some logs only go back a few days on busy DCs.

My current idea:

– Directory Service: 256 MB

– DFS Replication: 128 MB

– DNS Server: 128 MB

Questions:

1. What sizes do you use for these logs on DCs?

2. Do you size them based on a retention target (e.g. 30 days), or do you rely on forwarding to a SIEM/WEF and keep them smaller locally?

3. Any performance or disk concerns with going to 512 MB – 1 GB, especially when enabling NTDS diagnostic logging (e.g. 1644 expensive LDAP queries, 2889 unsigned LDAP binds)?

Thanks!