Hi, I'm trying to figure out how to move the event logs to a separate drive in one swoop instead of changing each and every log 1 at a time?
It seems like a symbolic link does the job but it still writes to the hard drive as well.
Any ideas?
Well as they are usually stored here
%SystemRoot%\System32\Winevt\Logs\
and a click on properties in the right hand pane of event viewer will confirm the location as above
eg
%SystemRoot%\System32\Winevt\Logs\Application.evtx
and you only have to change that location in properties, it will not take that long and when you say
it is not of course each and every entry but only each log and there are not that many of them to move.each and every log 1 at a time?
That all said I see the reason although you have not mentioned it in your post - is I think
I have recently installed Windows 10 on a new SSD drive (C) I have two other drives which are not SSD one of which just contains saved data, ...
and you want to move them to one of those none SSD drives
I have to admit that I do not know for certain the implications of doing so.
I suspect, it may prove to have some implications on the system, as 10 is IMHO a little unusual compared with 7, in that so many aspects of the system and its self management are comprehensively interlinked.
IMHO a limit on the logs capacity would be the preferred option
same procedure
properties
log size
Note - please
you cannot change size allowed for security log it is determined by windows and the capacity of the drive.
I'm just trying to offload writes on my ssd but not to help it live longer but to better the performance by reducing writes. I have my temp files and page file and downloads on a separate disk (no not a ram disk)
I want to move all logs in 1 swoop instead of going to each and every log.
Every single Log in this directory C:\Windows\System32\winevt\Logs which according to my folder is 321 different logs without having to go to every 321 logs
The whole point of having a SSD is take advantage of it's performance. If you move everythi9ng off of it, especially things that are written there often, you lose that advantage, unless the drive you move it to is also a SSD.
There are not 321 logs to move
the entries shown on your screenshot as you can see, list the logs, differently to the actual main event log under which they are recorded.
The main recording bases are shown in the event viewer.
What's the purpose of the move?
If the aim is to reduce the use of disk storage ... isn't there an option to purge the logs?
I think few people ever have need of the logs.
Indeed, I'm sure there are hundreds of millions of people who have never looked at the logs, don't know the logs are there, and wouldn't know what to make of the contents.
So the logs are useless for most people.
I could understand it if @smirk24 wanted to relocate the existing logs for archiving purposes [ although they would not be of much use ] or because of a problem. This would then make it easier to diagnose problems as it would only contain the most recent logs available. I have created a script [ see my signature ] that deletes ALL the logs. This however, should ONLY be performed if your system has been running smoothly for a while. In my opinion, it is just good housekeeping.
I hope this helps!
Quote
