Cannot Save a Log File to a Mapped Network Drive Before You Clear All Events (329974)



The information in this article applies to:

  • Microsoft Windows Server 2003, Standard Edition
  • Microsoft Windows Server 2003, Enterprise Edition
  • Microsoft Windows Server 2003, Datacenter Edition
  • Microsoft Windows Server 2003, 64-Bit Enterprise Edition
  • Microsoft Windows Server 2003, 64-Bit Datacenter Edition
  • Microsoft Windows Server 2003, Web Edition
  • Microsoft Windows Small Business Server 2003, Standard Edition
  • Microsoft Windows Small Business Server 2003, Premium Edition

This article was previously published under Q329974

SYMPTOMS

When you try to save and clear event messages from one of the event logs in Event Viewer, you may receive the following error message:
Clearing the event log failed because of the following error:

The system cannot find the path specified.

However, you can save the event log to the location that you specified when you tried to save and clear the log file, and you can clear the log file without saving it.

CAUSE

You may experience this behavior when you try to save the log file to a mapped network drive before you clear it.

WORKAROUND

To work around this problem, use one of the methods that are described in this section.

Method 1: Save the Log File Before You Clear It

Manually save the log file and then clear the contents of the log. To do so:
  1. In Event Viewer, click the log whose contents you want to clear.
  2. On the Action menu, click Save Log File As.
  3. In the Save in list, double-click the drive letter that you mapped, type a name for the saved log file in the File name box, and then click Save.
  4. On the Action menu, click Clear all Events.
  5. Click No to not save the log before you clear it.

Method 2: Specify the Path to the Share

Include the Universal Naming Convention (UNC) path to the share in the File name box when you save the log before you clear it. To do so:
  1. In Event Viewer, click the log whose contents you want to clear.
  2. On the Action menu, click Clear all Events.
  3. Click Yes to save the log before you clear it.
  4. In the File name box, type the UNC path to the network share and the name that you want to use for the file, and then click Save.

    For example, type the following path, where servername is the name of the computer on which the share is created, share is the name of the network share, and applicationlog is the name of the file that you want to create:

    \\servername\share\applicationlog

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

MORE INFORMATION

If you save an event log file by clicking Save Log File As on the Action menu, the operating system uses the account of the currently logged on user (it impersonates the user) to find the network path to the mapped drive letter. However, when you click Clear all Events, and then click Yes to save the log file before you clear the events, the operating system does not impersonate the currently logged on user to find the path that corresponds to the mapped drive letter. As a result, the operating system cannot save the log file to a mapped network drive that has been created by an account other than the SYSTEM account.

Modification Type:MajorLast Reviewed:3/1/2004
Keywords:kbbug kbpending KB329974