|
The following is the procedure to
change the location from the factory default to save event
logs.
By taking the following procedure, the location can
be changed to a desired drive. |
|
|
| ■Procedure |
|
|
|
1. |
Disable the EWF (Write Filter). |
|
|
|
|
2. |
Run the registry editor
(Regedit.exe). To run the editor, go to the start menu and
click [Run...]. Enter "REGEDIT" in [Open] to open the editor.
|
|
|
|
|
3. |
Open the following registry key.
|
|
|
HKEY_LOCAL_MACHINES\SYSTEM\CurrentControlSet\Services\Eventlog
|
|
4. |
The following subkeys are located
under the [Eventlog] key. In the subkeys, the settings
corresponding to each event log are saved.
Perform the
operation instructed in the following 5 to all of the six
subkeys. |
|
|
<Application>
<Security>
<System>
<Directory
Service>
<DNS Server>
<File Replication
Service>
|
|
5. |
Double click the [File] registry entry to open the dialog
box of [Edit String]. Change the name in the [Value data] box
indicated by the red frame to that of a new location. The
folder for saving event logs should be created in advance.
Ex.) If you would like the location to be the Z drive
(RAM disk), enter "Z:\Test.Evt". |
|
|
|
|
|
| Important |
| The Z drive in Windows XP Embedded
is RAM disk. Regardless of whether the EWF (Write
Filter) is enabled or disabled, the data in the
drive gets cleared when the OS reboots. To
continuously save the data, specify another drive.
| |
|
|
6. |
Reboot Windows XP Embedded. |
|
7. |
Make sure if the location is changed
by checking the property of [System] in [Event Viewer]. |
|
|
 |
|
|
|
|
8. |
After completing the steps above,
enable the EWF again. |
|
|
返回顶端
返回上一页
沪ICP备05028659号-3