Windows – Relocating event logs in Windows Server 2008 R2

windowswindows-event-logwindows-server-2008

How can I relocate the Application, Security, and System event logs in Windows Server 2008 R2? The KB for 2003 does not work, neither does going into the properties of each log and changing the path. By all accounts it should work, but it simply does not move the event log.

Best Answer

You can do this from the GUI or command line.

  1. Start the Server Manager Diagnostics
  2. Event Viewer
  3. Windows Logs
  4. Right click the event log of your choosing
  5. Change the “Log Path” variable to an existing dir / file name

The registry key that sets the value is HKLM\SYSTEM\ControlSet001\Services\eventlog\$LogName

You can modify it as well by using the following commands (modify to fit your environment)

reg add “HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application” /f /v File /t REG_SZ /d 
   G:\Logs\Application.evtx

reg add ”HKLM\SYSTEM\CurrentControlSet\Services\eventlog\Application”/f /v Flags /t REG_DWORD 
  /d 0x00000001

Source : Change Log file location in Windows Server 2008 R2 via registry

Related Topic