0

My goal is to move the Windows Log files to a different drive. There are some posts which describe how to do this, like this one .

I used a script which to set the log location to an alternative folder:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application" /v File /t REG_SZ /d "D\windowslog\Application.evtx" /f

This script runs without errors and does what it's supposed to do. It modifies the registry like it should do, however on one of the PC's where this script is run the log files are still run on the old, default location (C:\Windows\System32\winevt\Logs)

Any idea why the event logs are written to a different location as indicated in the registry.

notes:

  • the system was rebooted
  • copying or moving the log files to the new location didn't help. They still kept being written at the default location

When I look on the Security settings of the C:\Windows\System32\winevt\Logs folder I see a user "EventLog". I thought to add this user to have rights on the folder I created manually, but I can't select this user from the list of users and groups. Security C:\Windows\System32\winevt\Logs All Windows users

1

The registry command in the initial post is missing a colon character ':' after the drive letter 'D' in the target folder name: D\windowslog\Application.evtx

I can't tell if the missing colon was just a typo in the post above, or if it's why the registry command failed.

What led me to this thread today is that I want to move several Windows event logs from the C: ssd to a hard drive, in order to slow down the rate at which the ssd lifetime is being used up. (Unlike a hard drive, an ssd can handle only a finite amount of writing before it can no longer be written further.) In other words, I found this thread by googling: 'windows winevt logs move' The "wevtutil sl" command mentioned in the second post looks very promising, and I plan to research it. If it works, an additional question is whether it makes a permanent change or whether wevtutil would need to be executed each time Windows starts (by using a Windows Task Scheduler task).

UPDATE: I tested the "wevtutil sl" command on three log files -- System.evtx, Security.evtx and Application.evtx -- and I'm unsure whether it succeeded. I see three new log files in the new folder on the hard drive, but Procmon64 has shown continued writing to Security.evtx and Application.evtx in the original folder on the ssd. Perhaps there's a delay in when the redirection begins to take effect?? UPDATE #2: My tentative conclusion is that the commands did succeed and that there was a delay before the commands took effect.

0

I've found another command which solves my problem. Note that on some systems you need to execute it as an administrator.

wevtutil sl application /lfn:"D:\windowslog\Application.evtx"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.