If there's a eventlog entry bigger than the default BUFFER_SIZE then the logwatch enters an endless loop.
If the buffer isn't big enough then there's a realloc with size "bytesNeeded" but the buffersize stays "BUFFER_SIZE" in stead of bufferSize.

diff:
--- C:/Temp/eventlog.cpp-revBASE.svn001.tmp.cpp   Tue Aug 14 19:44:38 2012
+++ D:/Source/netxms/trunk/src/agent/subagents/logwatch/eventlog.cpp   Wed Feb 27 19:56:50 2013
@@ -341,7 +341,7 @@
             {
retry_read:
                success = ReadEventLog(hLog, EVENTLOG_SEQUENTIAL_READ | EVENTLOG_FORWARDS_READ, 0,
-                                       buffer, BUFFER_SIZE, &bytes, &bytesNeeded);
+                                       buffer, bufferSize, &bytes, &bytesNeeded);
               error = GetLastError();
               if (!success && (error == ERROR_INSUFFICIENT_BUFFER))
               {

Hi!

Thanks for the fix, just committed it into trunk.

Best regards,
Victor