How can I relocate the Application, Security, and System event logs in Windows Server 2008 R2? The KB for 2003 does not work, neither does going into the properties of each log and changing the path. By all accounts it should work, but it simply does not move the event log.
You can do this from the GUI or command line.
- Start the Server Manager Diagnostics
- Event Viewer
- Windows Logs
- Right click the event log of your choosing
- Change the “Log Path” variable to an existing dir / file name
The registry key that sets the value is HKLM\SYSTEM\ControlSet001\Services\eventlog\$LogName
You can modify it as well by using the following commands (modify to fit your environment)
reg add “HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application” /f /v File /t REG_SZ /d G:\Logs\Application.evtx reg add ”HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application”/f /v Flags /t REG_DWORD /d 0x00000001
The registry change didn't work for me but you can also execute the following command in power shell
wevtutil sl application /lfn:"D:\MyDir\Application.evtx"
If you want to do it via GPO or local Policy you can do it via
computer configuration\administrative templates\windows components\event log service
Just make sure in the "
control the location" setting you enter so something like
<drive letter>\<folder>\<name of the log>.evtx or it won't work without returning an error. Took me some time to find it out.