Home / server / Questions / 102944
Accepted
user25414
Asked: 2010-01-15 20:13:17 +0800 CST

Change Windows Event Log storage location on WIN2003

  • 772

I've changed, with regedit, the storage location from C:\WINDOWS\system32\config\AppEvent.Evt to somewhere else.

After restarting computer, it seems it doesn't work out - Event Log still adopts original location to store the log fie.

Any step I neglected to achive this?

windows

3 Answers

  1. Best Answer

    The procedure is outlined here: http://support.microsoft.com/kb/315417

    Quoted:

    To move Event Viewer log files to another location on the hard disk, follow these steps:

    1. Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
    2. Click the subkey that represents the event log that you want to move, for example, click Application.
    3. In the right pane, double-click File.
    4. Type the complete path to the new location (including the log file name) in the Value data box, and then click OK. For example, if you want to move the application log (Appevent.evt) to the Eventlogs folder on the E drive, type e:\eventlogs\appevent.evt. Repeat steps 4 through 6 for each log file that you want to move.
    5. Click Exit on the Registry menu.
    6. Restart the computer.

    Hmm.. seems not, odd.

    • 2

  2. Did you change the path in HKLM\SYSTEM\CurrentControlSet or in HKLM\SYSTEM\ControlSetX? And are you sure che active ControlSet didn't switch upon reboot (it sometime does)?

    Check which ControlSet is actually active (look at the value of HKLM\SYSTEM\Select\Current).

    • 1

  3. If anyone is still looking for the answer here...

    Change the registry entry in the CurrentControlSet hive as described above (you do NOT have to touch the other control set hives), reboot, in Event View change the log file location for each log you wish to move. Bingo.

    • 0