event viewer file relocation

datchcha

Is there a way to change the default location of the Event Viewer? I have configured a partition called "Logs", and i want to be able to have Event Viewer redirect the real time log files to this partition.

I thought this would be a good idea incase something happened to the OS partition. I could review log files once i get the OS backup or any other hardware failures...i could still view the log files...

Thank you.

bertieb

Use regedit to navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog

Then under the specific logfile you want to move alter the value in the 'File' entry (expandable string type I think...)
e.g. to move the Application event log to L:\Logfiles

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application and change the 'File' entry to 'L:\Logfiles\AppEvent.evt'

Detailed beautifully here : http://support.microsoft.com/kb/315417

dynamik

I was just going to post that link

Also, you might want to consider moving the logs to a different drive, not just a different partition on the same drive. I think you're more likely to have a disk die than to have your entire system partition completely corrupted. You'll also get better R/W performance as well, if you're doing heavy logging.

datchcha

dynamik wrote:

I was just going to post that link

Also, you might want to consider moving the logs to a different drive, not just a different partition on the same drive. I think you're more likely to have a disk die than to have your entire system partition completely corrupted. You'll also get better R/W performance as well, if you're doing heavy logging.

I didn't explain myself 100%, sorry about the if i confused anyone. I have a second drive installed. Thanks for the insight...