This article applies to System Change Log.

Last updated: 5/23/2002

Question

How do I change the service log filename or path?

Answer

The System Change Log service normally writes its log file to scl.log in the system32 directory (usually c:\winnt\system32 or c:\windows\system32). By setting a registry value, you can change the location of the log file.

---

Caution:
Modifying Registry entries requires basic familiarity with the Windows Registry and its operations. Incorrect changes to the Registry can result in unpredictable, perhaps non-repairable, damage, up to and including a non-bootable system! Have a qualified technician make the changes for you if you are not comfortable with the process. We cannot be responsible for registry problems.

---

To change the service log file location, use Registry Editor to:

1. Locate the HKEY_LOCAL_MACHINE\Software\Greyware\System Change Log\Parameters key.

2. Add a new string (REG_SZ) entry called Service Log Filename (three words).

3. Set the Service Log Filename entry to the fully-qualified path and filename where you want the log file. Example: c:\logs\scl.log. The service will not create the path for you. In this example, the path c:\logs must already exist.

4. Since the service runs in its own security context, it cannot know about drives you have mapped when you are logged on. Therefore, you must either use a local drive or the fully-qualified UNC path to a remote drive.

5. If you set the log file location to a remote drive using a UNC path (example, \\FRED\logs\scl.log, where FRED is the name of the remote machine, logs is the name of a share on that machine, and scl.log is the filename you want to use), you must also change how the service logs on.

   By default, the service logs on as LocalSystem, a special internal account that has authority on the local machine but no network access. You must change this to a user account that has the authority to access the UNC path you choose for the log file. (Make sure to pick an account that also has read access to the paths you are trying to monitor.)

   Use Control Panel | Services to change the startup settings for the service.

   We do not recommend setting the log file to another machine. Doing so can cause significant overall system performance slowdowns if the log file is busy or the connection is slow. In addition, if the remote share becomes unavailable for any reason, log entries during that time will be lost and the system may appear to freeze for long periods of time.

6. Changes take effect the next time the service is started. You may either stop and restart the service from Control Panel, or reboot the machine.