This article describes how to change the default location of the Event Log files.
A Windows operating system.
Using Standard Image mode, the Event Log files containing the current System, Application, and Security event messages are lost when the system shuts down.
To retain the event messages, modify the default location to point to the different location using the following procedure.
Caution! This procedure requires you to edit the registry. Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. Back up the registry before you edit it.
1. Go to Start > Run, enter regedt32, then click OK.
2. In the registry browse and select HKEY_LOCAL_ MACHINE.
For the System log
Click SystemCurrentControlSetServicesEventLogSystem folder, then double-click the FILE value.
Type the new drive and path in the String box, include the file name SysEvent.Evt, and then click OK.
For the Application log
Click the SystemCurrentControlSetServicesEventLogApplication folder, and then double-click the FILE value.
Type the new drive and path in the String box, include the file name AppEvent.Evt, and then click OK.
For the Security log
Click the SystemCurrentControlSetServicesEventLogSecurity folder, and then double-click the FILE value.
Type the new drive and path in the String box, include the file name SecEvent.Evt, and then click OK.
3. Quit the Registry Editor and restart the computer in Standard Image mode.