I've changed, with regedit, the storage location from C:\WINDOWS\system32\config\AppEvent.Evt to somewhere else.

After restarting computer, it seems it doesn't work out - Event Log still adopts original location to store the log fie.

Any step I neglected to achive this?


The procedure is outlined here: http://support.microsoft.com/kb/315417


To move Event Viewer log files to another location on the hard disk, follow these steps:

  1. Locate the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog
  2. Click the subkey that represents the event log that you want to move, for example, click Application.
  3. In the right pane, double-click File.
  4. Type the complete path to the new location (including the log file name) in the Value data box, and then click OK. For example, if you want to move the application log (Appevent.evt) to the Eventlogs folder on the E drive, type e:\eventlogs\appevent.evt. Repeat steps 4 through 6 for each log file that you want to move.
  5. Click Exit on the Registry menu.
  6. Restart the computer.

Hmm.. seems not, odd.


Did you change the path in HKLM\SYSTEM\CurrentControlSet or in HKLM\SYSTEM\ControlSetX? And are you sure che active ControlSet didn't switch upon reboot (it sometime does)?

Check which ControlSet is actually active (look at the value of HKLM\SYSTEM\Select\Current).


If anyone is still looking for the answer here...

Change the registry entry in the CurrentControlSet hive as described above (you do NOT have to touch the other control set hives), reboot, in Event View change the log file location for each log you wish to move. Bingo.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.