I have an isolated LAN with RHEL 5.0 Server out-of-box installed and acting as the PDC for a handful of Win XP w/SP2 systems. All XP systems are on a domain I created via samba.

I have discovered that all XP systems that had been configured to shut down if logging reached max capacity "reset" to allow overwriting if the PC is rebooted.

Virus protection is installed on all systems and is up-to-date. Being isolated, none of the systems ever touch the Internet.

These systems also have Snare Agent installed to assist with logging.

Would Samba or Snare be causing the Event Viewer's Application, System, and Security categories to reset from manually clear to automatically? Is there a setting I am missing from samba and/or snare to permit the XP systems to retain their proper configuration?

Thanks for any insight.

Scott