Microsoft KB Archive/329974

= Cannot Save a Log File to a Mapped Network Drive Before You Clear All Events =

Article ID: 329974

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, 64-Bit Datacenter Edition
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Small Business Server 2003 Standard Edition
 * Microsoft Windows Small Business Server 2003 Premium Edition

-



This article was previously published under Q329974



SYMPTOMS
When you try to save and clear event messages from one of the event logs in Event Viewer, you may receive the following error message:

Clearing the event log failed because of the following error:

The system cannot find the path specified.

However, you can save the event log to the location that you specified when you tried to save and clear the log file, and you can clear the log file without saving it.



CAUSE
You may experience this behavior when you try to save the log file to a mapped network drive before you clear it.



WORKAROUND
To work around this problem, use one of the methods that are described in this section.

Method 1: Save the Log File Before You Clear It
Manually save the log file and then clear the contents of the log. To do so:
 * 1) In Event Viewer, click the log whose contents you want to clear.
 * 2) On the Action menu, click Save Log File As.
 * 3) In the Save in list, double-click the drive letter that you mapped, type a name for the saved log file in the File name box, and then click Save.
 * 4) On the Action menu, click Clear all Events.
 * 5) Click No to not save the log before you clear it.

Method 2: Specify the Path to the Share
Include the Universal Naming Convention (UNC) path to the share in the File name box when you save the log before you clear it. To do so:  In Event Viewer, click the log whose contents you want to clear. On the Action menu, click Clear all Events. Click Yes to save the log before you clear it. In the File name box, type the UNC path to the network share and the name that you want to use for the file, and then click Save.

For example, type the following path, where  is the name of the computer on which the share is created,   is the name of the network share, and   is the name of the file that you want to create:

\\ \ \





STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.



MORE INFORMATION
If you save an event log file by clicking Save Log File As on the Action menu, the operating system uses the account of the currently logged on user (it impersonates the user) to find the network path to the mapped drive letter. However, when you click Clear all Events, and then click Yes to save the log file before you clear the events, the operating system does not impersonate the currently logged on user to find the path that corresponds to the mapped drive letter. As a result, the operating system cannot save the log file to a mapped network drive that has been created by an account other than the SYSTEM account.

Keywords: kbbug kbpending KB329974

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.