How to Change the Default Event Viewer Log File Location (216169)


The information in this article applies to:

  • Microsoft Windows NT Server 4.0 Terminal Server Edition
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows NT Workstation 4.0
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Server, Enterprise Edition 4.0
  • Microsoft BackOffice Server 4.0
  • Microsoft BackOffice Server 4.5
  • Microsoft BackOffice Small Business Server 4.0
  • Microsoft BackOffice Small Business Server 4.0a
  • Microsoft BackOffice Small Business Server 4.5
This article was previously published under Q216169
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SUMMARY

The Event Viewer tool maintains three log files containing the System, Application, and Security event messages. However, the Event Viewer tool may not be able to write event messages to one of these log files if there is no disk space available. To increase the disk space that can be used for these log files, you can modify their default location.

MORE INFORMATION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To modify the location of the Event Viewer log files:
  1. Click Start, click Run, type regedt32, and then click OK.
  2. On the Windows menu, click HKEY_LOCAL_ MACHINE on Local Machine.
    • For the System log:
      1. Click the System\CurrentControlSet\Services\EventLog\System folder, and then double-click the FILE value.
      2. Type the new drive and path in the String box, include the file name \SysEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\SysEvent.Evt
    • For the Application log:
      1. Click the System\CurrentControlSet\Services\EventLog\Application folder, and then double-click the FILE value.
      2. Type the new drive and path in the String box, include the file name \AppEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\AppEvent.Evt
    • For the Security log:
      1. Click the System\CurrentControlSet\Services\EventLog\Security folder, and then double-click the FILE value.
      2. Type the new drive and path in the String box, include the file name \SecEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\SecEvent.Evt
  3. Quit Registry Editor, and then restart the computer.
Modification Type:MinorLast Reviewed:7/15/2004
Keywords:kbenv kbhowto KB216169
©2004 Microsoft Corporation. All rights reserved.