Can the event logs be located on a different volume?

[Mark K Vallevand]

Is it possible to locate the Windows event log files on a different volume?

We have a EWF-protected C: drive and a normal D: on 512mb CF device. Almost
everything is on the boot C: drive. The D: drive is small (about 16mb) and
contains only files that our application software must not loose. There are
some things in the event logs that we don't want to loose either. Can the
event logs go on the D: drive? Any pitfalls to consider? Is the procedure
documented anywhere?

--
Regards.
Mark K Vallevand (e-mail address removed)

Beer is living proof that God loves us and wants us to be happy.
- Benjamin Franklin


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you received
this in error, please contact the sender and delete the e-mail and its
attachments from all computers.

 

[KM]

Mark,

Is it possible to locate the Windows event log files on a different volume?

Yes, it is.

a.. Move the Event log files to an unprotected volume by editing the following registry keys:

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Application
Name: File
Type: REG_EXPAND_SZ
Value: path_to_an_unprotected_volume\AppEvent.evt

-and-

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\Security
Name: File
Type: REG_EXPAND_SZ
Value: path_to_an_unprotected_volume\SecEvent.evt

-and-

Key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\EventLog\System
Name: File
Type: REG_EXPAND_SZ
Value: path_to_an_unprotected_volume\SysEvent.evt

We have a EWF-protected C: drive and a normal D: on 512mb CF device. Almost
everything is on the boot C: drive. The D: drive is small (about 16mb) and
contains only files that our application software must not loose. There are
some things in the event logs that we don't want to loose either. Can the
event logs go on the D: drive? Any pitfalls to consider? Is the procedure
documented anywhere?

http://msdn.microsoft.com/embedded/community/community/tips/xp/ramewf/default.aspx