0

My goal is to move the Windows Log files to a different drive. There are some posts which describe how to do this, like this one .

I used a script which to set the log location to an alternative folder:

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application" /v File /t REG_SZ /d "D\windowslog\Application.evtx" /f

This script runs without errors and does what it's supposed to do. It modifies the registry like it should do, however on one of the PC's where this script is run the log files are still run on the old, default location (C:\Windows\System32\winevt\Logs)

Any idea why the event logs are written to a different location as indicated in the registry.

notes:

  • the system was rebooted
  • copying or moving the log files to the new location didn't help. They still kept being written at the default location

When I look on the Security settings of the C:\Windows\System32\winevt\Logs folder I see a user "EventLog". I thought to add this user to have rights on the folder I created manually, but I can't select this user from the list of users and groups. Security C:\Windows\System32\winevt\Logs All Windows users

0

I've found another command which solves my problem. Note that on some systems you need to execute it as an administrator.

wevtutil sl application /lfn:"D:\windowslog\Application.evtx"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.