Change Event Viewer default location

[Veets]

Hello,
As per the subject line, I need to change the default event viewer logfile
location. I've read the following Microsoft aticle ->
http://support.microsoft.com/defaul...port/kb/articles/Q216/1/69.ASP&NoWebContent=1,
but I would like to write the files to a remote server (via mapped drives)
as opposed to keeping them on the same, physical server. I've tried setting
it up with the mapped drive , but whenever I try to access the lofiles
(after the server reboots), I get the following:

Unable to complete the operation on "Application".
A required privilege is not held by the client.

Is it even possible to do this? Any workarounds? Third-party utilities? Any
advice/suggestions are greatly appreciated. TIA
Regards,
Veets

 

[ptwilliams]

It's probably failing because the event viewer is staring before the drives
have mapped or the workstation service has started.

Can you do this via UNC paths instead??

--

Paul Williams
_________________________________________
http://www.msresource.net


Join us in our new forums!
http://forums.msresource.net
_________________________________________


Hello,
As per the subject line, I need to change the default event viewer logfile
location. I've read the following Microsoft aticle ->
http://support.microsoft.com/defaul...port/kb/articles/Q216/1/69.ASP&NoWebContent=1,
but I would like to write the files to a remote server (via mapped drives)
as opposed to keeping them on the same, physical server. I've tried setting
it up with the mapped drive , but whenever I try to access the lofiles
(after the server reboots), I get the following:

Unable to complete the operation on "Application".
A required privilege is not held by the client.

Is it even possible to do this? Any workarounds? Third-party utilities? Any
advice/suggestions are greatly appreciated. TIA
Regards,
Veets

 

[Veets]

Thanks for replying Paul, but that didn't help either.
Here are a couple of other things I tried:
1) Used the AutoExNT service to try & connect to the UNC (didn't work)
2) Ran the Event Viewer service under an account that had access to the
drive (I also setup the 'logon as a service in the local security policy).
This didn't work either & the server actually hung on Startup. The only way
to get back into the system was to boot in safe mode & put the event service
back under the 'Local System'.
Has anyone been able to get this to work? As far as third-party products are
concerned, I've only found the following ->
http://www.monitorware.com/en/Product/. I haven't check it out yet.

Thanks again for any advice/suggestions. TIA
Best regards,
Veets