How to Change the Default Event Viewer Log File Location

Article translations Article translations
Article ID: 216169 - View products that this article applies to.
This article was previously published under Q216169
Notice
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.
Expand all | Collapse all

SUMMARY

The Event Viewer tool maintains three log files containing the System, Application, and Security event messages. However, the Event Viewer tool may not be able to write event messages to one of these log files if there is no disk space available. To increase the disk space that can be used for these log files, you can modify their default location.

MORE INFORMATION

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756 How to back up and restore the registry in Windows

To modify the location of the Event Viewer log files:
  1. Click Start, click Run, type regedt32, and then click OK.
  2. On the Windows menu, click HKEY_LOCAL_ MACHINE on Local Machine.
    • For the System log:
      1. Click the System\CurrentControlSet\Services\EventLog\System folder, and then double-click the FILE value.
      2. Type the new drive and path in the String box, include the file name \SysEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\SysEvent.Evt
    • For the Application log:
      1. Click the System\CurrentControlSet\Services\EventLog\Application folder, and then double-click the FILE value.
      2. Type the new drive and path in the String box, include the file name \AppEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\AppEvent.Evt
    • For the Security log:
      1. Click the System\CurrentControlSet\Services\EventLog\Security folder, and then double-click the FILE value.
      2. Type the new drive and path in the String box, include the file name \SecEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\SecEvent.Evt
  3. Quit Registry Editor, and then restart the computer.

Properties

Article ID: 216169 - Last Review: February 20, 2007 - Revision: 2.6
APPLIES TO
  • Microsoft Windows NT Server 4.0, Terminal Server Edition
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT Server 4.0 Enterprise Edition
  • Microsoft BackOffice Server 4.0
  • Microsoft BackOffice Server 4.5
  • Microsoft BackOffice Small Business Server 4.0
  • Microsoft BackOffice Small Business Server 4.0a
  • Microsoft BackOffice Small Business Server 4.5
Keywords: 
kbenv kbhowto KB216169

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com