Q

Change the default location for the Event Viewer's log files

Is there a straightforward way to redirect the Event Viewer files from the Windows\System32\config folder to an alternate logical partition or network share? My platform is Windows XP Professional SP2.

Is there a straightforward way to redirect the Event Viewer files from the Windows\System32\config folder to an alternate logical partition or network share? My platform is Windows XP Professional SP2.

There is indeed a way to change the default location for the Event Viewer's log files in Windows 2000, 2003 and XP. Note that you need to be logged in with an account that has administrative privileges to do this.

1. Open REGEDIT (or another Registry editor program) and navigate to the key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

2. Open the subkey that contains the event log you want to move. On most machines, you'll be able to choose between Application, Security and System.

3. Each key contains a value named File (type REG_EXPAND_SZ), which contains the pathname and filename to the log file. By default this is %SystemRoot%\system32\config\ .Evt. You can provide a new pathname and filename here, but you should use the .EVT file extension.

4. Close the Registry and restart the computer.

This was first published in November 2005

Dig deeper on Windows Server Monitoring and Administration

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close