Where/how does Windows store the data in the event logs?

Question

We run some financial systems that log error messages to the system logs. I need to find out if we can clean these error messages from a PCI DSS point of view.

I am specificaly interested in the answer for:

Windows 2000 Server and
Windows 2003 SP1

Ron, Windows 2000 reached end-of-life in 2010, and afaik a system running Windows 2000 cannot be considered PCI compliant. — Lucky Luke, Jul 19 '12 at 15:34

score 40 · Accepted Answer · edited Apr 04 '16 at 21:04

40

With Windows 2000/Server2003/Windows XP, the logs are stored in the %SystemRoot%\System32\Config directory, with an .evt extension.

With Server 2008/Vista and up, the log are stored in the %SystemRoot%\system32\winevt\logs directory, and have an .evtx extension. It's possible to convert old .evt files to the newer .evtx format

Within the Computer Manager you can also export them to a .txt or .csv file.

edited Apr 04 '16 at 21:04

Drifter104

3,693
2
22
39

answered Oct 01 '09 at 11:15

Keith

2,419
1
22
18

30

In case any future readers come here looking for the Windows Vista/7/Server2008 location, here it is: %SystemRoot%\system32\winevt\logs – Skyhawk Jun 23 '10 at 18:56
4

@MilesErickson, thank you - from a future reader :) – Moo-Juice Oct 14 '13 at 13:14
can you please tell me which file hold the details for copy and paste done in system? – Narendra Jaggi Nov 26 '15 at 06:46
@NarendraJaggi There is no log of copy and paste operations. Why would such a thing even exist?!? – Massimo Apr 04 '16 at 21:27

Where/how does Windows store the data in the event logs?

1 Answers1