Home / server / Questions / 510705
Accepted
NealWalters
Asked: 2013-05-25 12:08:22 +0800 CST

Opening an archived "Application Event Log" (Hidden Directory)

  • 772

I'm an admin on the box. I've turned off all the folder options "Hide protected operating system files" and turned on "Show hidden files and folders".

I can see this folder in Windows Explorer: C:\Windows\System32\winevt\Logs

but I cannot see it from Event Log Viewer MMC snap-in BizTalk Admin Console. In that tool, and others such as GamutLog-Viewer, when I do "file Open", and paste in the same directory, I get: \ C:\Windows\System32\winevt\Logs - Path does not exist - Check the path and try again.

From Windows Notepad, I can do "File Open", paste same, and I get the directory.

Why is it different from one tool to the other?

Should I just create a C:\EventLogArchive and archive all my logs there?

Here's a couple of screen shots from NotePad and NotePad++ showing how NotePad can navigate to the directory, and NotePad++ cannot:

enter image description here

enter image description here

filesystems

2 Answers

  1. Best Answer

    Use C:\Windows\Sysnative\winevt

    In most cases, whenever a 32-bit application attempts to access %windir%\System32, the access is redirected to %windir%\SysWOW64.

    32-bit applications can access the native system directory by substituting %windir%\Sysnative for %windir%\System32. WOW64 recognizes Sysnative as a special alias used to indicate that the file system should not redirect the access. This mechanism is flexible and easy to use, therefore, it is the recommended mechanism to bypass file system redirection. Note that 64-bit applications cannot use the Sysnative alias as it is a virtual directory not a real one.

    From the File System Redirector technet article, here.

    • 7

  2. I can re-produce this issue on my Windows 8.1 x64 as well with the latest version of Notepad++. As more careful people noticed that is because Notepad++ is x32 app and replacing 'system32' with 'sysnative' does the trick. if I type 

    C:\Windows\sysnative\winevt\logs\

    I can see the files just fine. enter image description here

    • 0