Pro-face America Technical Resources

 FAQ
 How to change the location to save event logs.

Applicable Models
Windows XP Embedded (CF Card Type)

The following is the procedure to change the location from the factory default to save event logs.
By taking the following procedure, the location can be changed to a desired drive.

■Procedure
 
1. Disable the EWF (Write Filter).
 
 MEMO
How to disable the EWF (Write Filter)

2. Run the registry editor (Regedit.exe). To run the editor, go to the start menu and click [Run...]. Enter "REGEDIT" in [Open] to open the editor.
 

3. Open the following registry key.
  HKEY_LOCAL_MACHINES\SYSTEM\CurrentControlSet\Services\Eventlog
4. The following subkeys are located under the [Eventlog] key. In the subkeys, the settings corresponding to each event log are saved.
Perform the operation instructed in the following 5 to all of the six subkeys.
  <Application>
<Security>
<System>
<Directory Service>
<DNS Server>
<File Replication Service>
5.

Double click the [File] registry entry to open the dialog box of [Edit String]. Change the name in the [Value data] box indicated by the red frame to that of a new location. The folder for saving event logs should be created in advance.

Ex.) If you would like the location to be the Z drive (RAM disk), enter "Z:\Test.Evt".
 

 
 Important
The Z drive in Windows XP Embedded is RAM disk. Regardless of whether the EWF (Write Filter) is enabled or disabled, the data in the drive gets cleared when the OS reboots. To continuously save the data, specify another drive.

6. Reboot Windows XP Embedded.
7. Make sure if the location is changed by checking the property of [System] in [Event Viewer].
 
 

8. After completing the steps above, enable the EWF again.
 
↑Back to page top → Return to the previous page
Protection of Personal Information | Trademark Acknowledgments | Terms of Use
© Copyright 2004-2012. Pro-face. All rights reserved.