Move Event logs

[Derek Benak]

Quick question. I know there is a Powershell script that can change the path for all the event logs in Windows, but I cannot find it. I would rather not have to install BIS-F just to run this function.

 

Can someone provide a link to the script?

 

Thanks

[Kasper Johansen1709159522]

This should do the trick:

https://github.com/kaspersmjohansen/Citrix/blob/master/Set-EventLogPath

On my test server I have more than 1000 event logs, so the script might run for a few minutes.

[Kasper Johansen1709159522]

Hi,

Is this helpful?

 

New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application" -Name "Flags" -Value "1" -PropertyType "Dword" -Force | Out-Null -ErrorAction SilentlyContinue
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application" -Name "File" -Value "D:\Application.evtx" -PropertyType ExpandString -Force | Out-Null -ErrorAction SilentlyContinue

New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Security" -Name "Flags" -Value "1" -PropertyType "Dword" -Force | Out-Null -ErrorAction SilentlyContinue
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Security" -Name "File" -Value "D:\Security.evtx" -PropertyType ExpandString -Force | Out-Null -ErrorAction SilentlyContinue

New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\System" -Name "Flags" -Value "1" -PropertyType "Dword" -Force | Out-Null -ErrorAction SilentlyContinue
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\System" -Name "File" -Value "D:\System.evtx" -PropertyType ExpandString -Force | Out-Null -ErrorAction SilentlyContinue

D:\ is the cache disk drive letter. Also remember that the event log path change requires a reboot.

[Derek Benak]

Looking to move all the logs, 'Windows Logs' and 'Applications and Services logs'

[Derek Benak]

That is the script I was looking for. Thanks!

[Sam Clift]

On 8/20/2022 at 5:55 PM, Kasper Johansen1709159522 said:

https://github.com/kaspersmjohansen/Citrix/blob/master/Set-EventLogPath

 

I love you