Re: change event log location to remote drive?

From: Pegasus \(MVP\) (I.can_at_fly.com)
Date: 11/15/05

  • Next message: Bernard Cheah [MVP]: "Re: IUSR & IWAM account" 
    Date: Tue, 15 Nov 2005 11:56:58 +1100

    "JAQK" <johnny@tamtam.com> wrote in message
    news:sy9ef.5870$vS4.3083@trnddc01...
    > Is it possible to modify the registry to redirect the event viewer log to
    a
    > mapped drive or UNC path, instead of local?
    >
    > We don't think it's possible, other than by using scripting, but maybe
    > somebody knows better, thanks.

    The location of the event logger files is defined here:
    HKLM\SYSTEM\CurrentControlSet\Services\Eventlog

    I suggest you replace the current entry of
    %SystemRoot%\system32\config\SysEvent.Evt

    with something like

    \\SomeServer\SomeShare\SomeFolder\SysEvent.Evt

    Seeing that such a file would not be available until quite late
    in the startup process, I suspect that Windows will run into
    some severe problems. You are also likely to encounter
    permission problems: Windows is likely to use the System
    account to write to the Event Logger, and this account
    has no access rights to networked resources.

  • Next message: Bernard Cheah [MVP]: "Re: IUSR & IWAM account"

    Relevant Pages
    • Quantcast