Where are archived evtx files stored?

logging event-viewer
parchambeau picture parchambeau · Jul 5, 2012 · Viewed 35.4k times · Source

I know that you can view any evtx files in the event viewer but when you use the option to archive them off what folder are they stored in?

I know that I can find all my evtx files in C:\Windows\System32\winevt\Logs but when I go into that folder I do not see any archived files. Then again I don't think that my logs have filled up enough to even archive anything.

I am running Windows 7 Home and also Windows 7 professional on my desktop. I would like to know if there is any difference between the two.

Also, are the files just named Archive-* ? Meaning the word archive and then whatever they come from (security, application etc...)

Thank you in advance for your help.

Answer

gdbcore picture gdbcore · Aug 10, 2012

You was close to answer. By default eventlogs are get archived into %System32%\winevt\Logs folder. Their names are formed by the next template:

Archive + <Event log name> + <Date> + <Time>.evtx

You can change the path for backuped logs only by changing the path of actual log file. Because atchived logs are put in the same folder with actual log file.

Related questions

How to interpret windows APPCRASH mysterious log?

How should I interpret these logs to identify the cause of the appcrash? Fault bucket , type 0 Event Name: APPCRASH Response: Not available Cab Id: 0 Problem signature: P1: InsightAnalysisEngine.exe P2: 1.0.0.0 P3: 4f4dee84 P4: KERNELBASE.dll P5: 6.1.7600.16850 P6: 4e211485 P7: …

Read More
Windows.old event viewer logs

Is it possible to see old event log files, those that you can see in event viewer? But I only have windows.old folder available. Situation is that, that some of our company's computers were hacked. I want to check …

Read More
grep a file, but show several surrounding lines?

I would like to grep for a string, but also show the preceding five lines and the following five lines as well as the matched line. How would I be able to do this?

Read More