Share via

Archive an event log

  • Article

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

To archive an event log

  1. Open Event Viewer.

  2. In the console tree, right-click the log you want to archive, and then click Save Log File As.

  3. In File name, enter a name for the archived log file.

  4. In Save as type, select a file format, and then click Save.

Notes

  • To perform this procedure on a local computer, you must be a member of the Backup Operators group, Administrators group, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run as to perform this procedure. For more information, see Default local groups, Default groups, and Using Run as.

  • To open Event Viewer, click Start, click Control Panel, double-click Administrative Tools, and then double-click Event Viewer.

  • If you archive a log in log-file format (.evt), you can reopen it in Event Viewer. If you archive a log in text (.txt) or comma-delimited (.csv) format, you can reopen the log in other programs, such as word processing or spreadsheet programs, but not with Event Viewer.

  • You can only save event logs in log-file format on the computer on which the events occur; for example, when using Event Viewer to view event logs on a remote computer.

  • To save a local event log in log-file format on another computer, in File name, type \\remotecomputername\share, and then type the path to and name for your archive file.

  • When you archive a log file, the entire log is saved, regardless of filtering options. The sort order is not retained when logs are saved. However, you can filter and sort the archived log again when you open it in Event Viewer.

  • Archiving has no effect on the current contents of the active log.

  • To remove an archived log file from your system, delete the file in Windows Explorer.

Information about functional differences

  • Your server might function differently based on the version and edition of the operating system that is installed, your account permissions, and your menu settings. For more information, see Viewing Help on the Web.

See Also

Concepts

File formats for archived logs
Clear an event log
Open an archived event log
Event Viewer overview