I haven't done this in a while and I'm trying to figure out where I went wrong. I'm looking to save my current audit logs and create a new log in which NT will write the new entries to.
Printable View
I haven't done this in a while and I'm trying to figure out where I went wrong. I'm looking to save my current audit logs and create a new log in which NT will write the new entries to.
I haven't done this in a while either, but I seem to remember that when you go to clear or delete the log, it will ask you if you want to save/back-up first. Like I said, it's been a while so you might want to test it on a log that you don't care if you lose.
Cheers:
Yep, when you right click on the log you want to delete in the Event Viewer, a dialog box comes up asking if you want to save the current log before deletion. Just click yes, specify where, and clear.
Just a little something to add...
When you save logs on a NT box, you have to save them locally unless you change the format from .evt to .csv or .txt. For some reason, NT doesn't like you to save it to a network drive.
If you are connecting to the event viewer of an NT box from a win2k box, then you can save the logs wherever you want. 2k doesn't care where you save the logs either.