JAQK said:
Is it possible to modify the registry to redirect the event viewer log to a
mapped drive or UNC path, instead of local?
We don't think it's possible, other than by using scripting, but maybe
somebody knows better, thanks.
The location of the event logger files is defined here:
HKLM\SYSTEM\CurrentControlSet\Services\Eventlog
I suggest you replace the current entry of
%SystemRoot%\system32\config\SysEvent.Evt
with something like
\\SomeServer\SomeShare\SomeFolder\SysEvent.Evt
Seeing that such a file would not be available until quite late
in the startup process, I suspect that Windows will run into
some severe problems. You are also likely to encounter
permission problems: Windows is likely to use the System
account to write to the Event Logger, and this account
has no access rights to networked resources.