Windows Forum

Ask something
Discussion Locked

Restoring Event Viewer Logs?

0 helpful
3 replies

by Member 32019386

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
On a Win2k Adv. server that we do a full tape backup each night, I need to restore the Event Logs from last week. The logs were cleared and that data needs to be brought back. The logs were in their normal Windows state (non-exported). Is it possible to restore the event logs and view what happened last week? What would the filenames be or directory structure, etc that I need to selectivly restore. Thanks! :)

3 replies

by seanl

The event logs are stored in the following places by default:
Application log - c:\WINNT\system32\config\appevent.evt
System log - C:\WINNT\system32\config\sysevent.evt
Security log - C:\WINNT\system32\config\secevent.evt
File replication log - C:\WINNT\system32\config\ntfrs.evt
DNS log - C:\WINNT\system32\config\dnsevent.evt
Directory Service log - C:\WINNT\system32\config\ntds.evt
Just restore the files to aa alternate location of your choice (just not over the existing one of course).
Open your "management console" - then "system tools". Right click on "event viewer" and choose "open log file". Browse to the location and open the file.
or
go to "administrative tools" - then "event viewer". Right click on "event viewer" and choose "open log file". Browse to the location and open the file.

Hope this helps

by Member 32019386

Poster rated this answer.
Excellent. Thanks for the file locations/names. The only problem I found it that the apps and system logs always remain open/in use so the backup program couldn't properly back them up when open (we don't have the open file add-on piece on this machine). Thus when I restored all of the event logs they all worked except the app/system logs which reported "are corrupt".

Thanks again. :)

This discussion is closed to new replies.