Change the Default Event Viewer Log File Location

If there is insufficient disk space, the Event Viewer may not be able to write event messages to any of the log files. To increase the disk space that can be used for these log files, the default location can be changed in order to relocate the files to a larger disk or partition. To modify the location of the Event Viewer log files:

Warning: Using Registry Editor incorrectly can cause serious, system-wide problems that may require reinstallation of Windows 2000 to correct them. Microsoft cannot guarantee that any problems resulting from the use of Registry Editor can be solved.

  1. Click Start, click Run, type regedt32, and then click OK.

  2. On the Windows menu, click HKEY_LOCAL_ MACHINE on Local Machine.

    • For the System log:

Click the System\CurrentControlSet\Services\EventLog\System folder, and then double-click the FILE value.

Type the new drive and path in the String box, include the file name \SysEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\SysEvent.Evt

  • For the Application log:

Click the System\CurrentControlSet\Services\EventLog\Application folder, and then double-click the FILE value.

Type the new drive and path in the String box, include the file name \AppEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\AppEvent.Evt

  • For the Security log:

Click the System\CurrentControlSet\Services\EventLog\Security folder, and then double-click the FILE value.

Type the new drive and path in the String box, include the file name \SecEvent.Evt, and then click OK. The default path is %SystemRoot%\System32\Config\SecEvent.Evt

  1. Exit the Registry Editor by selecting Exit from the Registry menu, and then restart the computer for the settings to take effect.