Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How can I relocate the Application, Security, and System event logs in Windows Server 2008 R2? The KB for 2003 does not work, neither does going into the properties of each log and changing the path. By all accounts it should work, but it simply does not move the event log.

share|improve this question
    
That should work, thats how I setup my logs. Just pre-create a directory that you want the logs to be stored in the change that path. I.E.: F:\EVTLogs. Then when you edit the properties just replace the %System%. You will then see each of the Windows logs populate in that new directory. –  Chadddada May 10 '11 at 16:57
add comment

1 Answer

up vote 4 down vote accepted

You can do this from the GUI or command line.

  1. Start the Server Manager Diagnostics
  2. Event Viewer
  3. Windows Logs
  4. Right click the event log of your choosing
  5. Change the “Log Path” variable to an existing dir / file name

The registry key that sets the value is HKLM\SYSTEM\ControlSet001\Services\eventlog\$LogName

You can modify it as well by using the following commands (modify to fit your environment)

reg add “HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application” /f /v File /t REG_SZ /d 
   G:\Logs\Application.evtx

reg add ”HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application”/f /v Flags /t REG_DWORD 
  /d 0x00000001

Source : Change Log file location in Windows Server 2008 R2 via registry

share|improve this answer
    
AFAIK, CurrentControlSet points to the ControlSet that is currently in use. Whereas ControlSet001, ControlSet002 are just revisions created. CurrentControlSet is selected at boot time from the various ControlSetXXX present based on the boot options. So I think both keys should be added to CurrentControlSet –  Ganesh R. May 10 '11 at 16:51
    
@Ganesh I think you're right. It might be a typo on the site I sourced. I've changed it in my answer. –  Holocryptic May 10 '11 at 17:26
1  
This is correct. The only step I was missing (which doesn't appear in any of the tutorials) was to make sure Local Service had permissions to create the evtx files. –  j.rightly May 10 '11 at 17:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.