Cannot Save a Log File to a Mapped Network Drive Before You Clear All Events

When you try to save and clear event messages from one of the event logs in Event Viewer, you may receive the following error message: However, you can save the event log to the location that you specified when you tried to save and clear the log file, and you can clear the log file without saving it.

You may experience this behavior when you try to save the log file to a mapped network drive before you clear it.

To work around this problem, use one of the methods that are described in this section.

Method 1: Save the Log File Before You Clear It

Manually save the log file and then clear the contents of the log. To do so:

1. In Event Viewer, click the log whose contents you want to clear.
2. On the Action menu, click Save Log File As.
3. In the Save in list, double-click the drive letter that you mapped, type a name for the saved log file in the File name box, and then click Save.
4. On the Action menu, click Clear all Events.
5. Click No to not save the log before you clear it.

Method 2: Specify the Path to the Share

Include the Universal Naming Convention (UNC) path to the share in the File name box when you save the log before you clear it. To do so:

1. In Event Viewer, click the log whose contents you want to clear.
2. On the Action menu, click Clear all Events.
3. Click Yes to save the log before you clear it.
4. In the File name box, type the UNC path to the network share and the name that you want to use for the file, and then click Save.
   
   For example, type the following path, where servername is the name of the computer on which the share is created, share is the name of the network share, and applicationlog is the name of the file that you want to create:
   \\servername\share\applicationlog

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

If you save an event log file by clicking Save Log File As on the Action menu, the operating system uses the account of the currently logged on user (it impersonates the user) to find the network path to the mapped drive letter. However, when you click Clear all Events, and then click Yes to save the log file before you clear the events, the operating system does not impersonate the currently logged on user to find the path that corresponds to the mapped drive letter. As a result, the operating system cannot save the log file to a mapped network drive that has been created by an account other than the SYSTEM account.