Three Ways to Change Event Log File Location – Full Guide

Event logs are records of operations related to the system, security, or application. Sometimes, you may want to change the Windows logs file location for some reason. How to change it? This post in NewsPivot focuses on this topic and teaches you how to change event log file location.

Where Are Event Logs Stored by Default in Windows

An event is a significant operation recognized by a software system. It is usually recorded in a special file called event log, which is a recorded event list ordered by time.

The event log is crucial for the root reasons for the issues and events, whether these issues are derived from hardware failures, operating system errors, and security bugs. Reviewing the event log for events that occurred before a related event is an important step in troubleshooting and performance optimization.

The default location of Windows event logs is: %SystemRoot%\System32\winevt\Logs. You can open Event Viewer to find the event logs. Here you will see different event logs related to application, system, security, etc. To get the specific log file path, you can simply right-click on the target log and select Properties.

Related Post: Two Ways to Change Search Index Location on Windows

How to Change Event Log File Location

If you want to release space on the system drive and back up or manage log files, changing the event log storage path is a good choice. There are several ways to change event log file location on Windows. In this article, we take changing the location of the application log file as an example.

Method 1: Change Event Log File Location via Event Viewer 

Event Viewer is a tool in the Microsoft Windows operating system that provides a comprehensive log of the system event and information on system maintenance, security, and accountability for the administrators. You can use it to change log file location. Here are the steps:

Step 1: Press the Win + S keys, input Event Viewer in the search box, and hit Enter.

Step 2: In the left pane, click on Windows Logs to expand it.

Step 3: Under Windows Logs, right-click on the log you want to change in the right pane and select Properties.

Step 4: In the General tab, input the path to where you want the log files to be stored in Log path. Note that you need to keep the log file name .evtx at the end of the path.

Step 5: Click on Clear Log > Save and Clear.

Step 6: Choose a location where you want to store the file and click on Save.

Step 7: Back to the Log Properties interface, click on Apply > OK.

Method 2: Change Event Log File Location by Using Group Policy Editor

Group Policy Editor is a management tool that allows you to configure the important settings on computers. The administrators can set the password requirements, start the programs, and define what programs and settings the users can modify. Here are some instructions to change event log file location on Windows with Group Policy Editor:

Step 1: Right-click on the Start button and choose Run to open the Run Window.

Step 2: Input gpedit.msc in the Open box and press Enter.

Step 3: Double-click on Computer Configuration > Administrative Templates > Windows Components > Event Log Service > Application.

Step 4: Under Application, choose Control the location of the log file.

Step 5: Switch to the Enabled option. Under Options, input the log file path you wantin the Log File Path box.

Step 6: Click on Apply > OK.

Method 3: Change Event Log File Location With Registry Editor

The registry is a database used to store the low-level settings for Windows and applications. Registry Editor allows you to modify the settings, such as system strategies, installed applications, and the file type which can be accessed by some applications. So, it is a feasible way to use it to change event log file location. The operations are as follows:

Step 1: Click on the Search icon on the Taskbar, input Registry Editor in the search box, and press Enter.

Step 2: When the UAC prompt shows, click on Yes to continue.

Step 3: Input Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog in the address bar and press Enter.

Step 4: In the left pane, under EventLog, click on Application.

Step 5: In the right pane, locate File and double-click on it to change the Value data.

Step 6: Input the log file path you like under Value data and click on OK.

Final Words

This article offers the above methods to help you change event log file location. If you have such a requirement, follow the steps listed to complete the operation.