Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've changed, with regedit, the storage location from C:\WINDOWS\system32\config\AppEvent.Evt to somewhere else.

After restarting computer, it seems it doesn't work out - Event Log still adopts original location to store the log fie.

Any step I neglected to achive this?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

The procedure is outlined here: http://support.microsoft.com/kb/315417

Quoted:

To move Event Viewer log files to another location on the hard disk, follow these steps:

  1. Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
  2. Click the subkey that represents the event log that you want to move, for example, click Application.
  3. In the right pane, double-click File.
  4. Type the complete path to the new location (including the log file name) in the Value data box, and then click OK. For example, if you want to move the application log (Appevent.evt) to the Eventlogs folder on the E drive, type e:\eventlogs\appevent.evt. Repeat steps 4 through 6 for each log file that you want to move.
  5. Click Exit on the Registry menu.
  6. Restart the computer.

Hmm.. seems not, odd.

share|improve this answer
add comment

Did you change the path in HKLM\SYSTEM\CurrentControlSet or in HKLM\SYSTEM\ControlSetX? And are you sure che active ControlSet didn't switch upon reboot (it sometime does)?

Check which ControlSet is actually active (look at the value of HKLM\SYSTEM\Select\Current).

share|improve this answer
add comment

If anyone is still looking for the answer here...

Change the registry entry in the CurrentControlSet hive as described above (you do NOT have to touch the other control set hives), reboot, in Event View change the log file location for each log you wish to move. Bingo.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.