Jump to content
Welcome to our new Citrix community!
  • 0

Move Event logs


Derek Benak

Question

5 answers to this question

Recommended Posts

  • 0

Hi,

Is this helpful?

 

New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application" -Name "Flags" -Value "1" -PropertyType "Dword" -Force | Out-Null -ErrorAction SilentlyContinue
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Application" -Name "File" -Value "D:\Application.evtx" -PropertyType ExpandString -Force | Out-Null -ErrorAction SilentlyContinue

New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Security" -Name "Flags" -Value "1" -PropertyType "Dword" -Force | Out-Null -ErrorAction SilentlyContinue
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\Security" -Name "File" -Value "D:\Security.evtx" -PropertyType ExpandString -Force | Out-Null -ErrorAction SilentlyContinue

New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\System" -Name "Flags" -Value "1" -PropertyType "Dword" -Force | Out-Null -ErrorAction SilentlyContinue
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\services\eventlog\System" -Name "File" -Value "D:\System.evtx" -PropertyType ExpandString -Force | Out-Null -ErrorAction SilentlyContinue

D:\ is the cache disk drive letter. Also remember that the event log path change requires a reboot.

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...