Migrate log files (1)

In Windows 2000, the log file is the system's diary. It can record the events according to the established settings, including application logs, security logs, and system logs, corresponds to AppEvent. evt, SecEvent. evt and SysEvent. three Evt files are stored in the C: \ WINNT \ system32 \ config folder by default. When the system encounters major or minor faults, experienced network administrators will find some clues from these log files, in particular, some security-related network intrusion evidence can be used to find relevant IP addresses, logon accounts, and other information ).
Similarly, hackers with some minds are aware of this point, so in order to prevent being held, they usually use tools or manually to clear all the log Content During the retreat, such behavior is commonly known as "footprint" or "PP ), or simply create a holiday log. Therefore, you must be careful when protecting log files. A more feasible and simple method is to migrate log files and change their default paths to unexpected places.
1. default path

 
Figure 1 Application Properties window

Open "Control Panel> Management Tools> Computer Management", select "Event Viewer" in the left-side pane, and the following three items are displayed: "application", "security", and "system. Take the first "application" as an example. Right-click on the top and choose "properties" 1). The default log destination folder for Windows 2000 is displayed in the "log name" area: "C: \ WINNT \ system32 \ config \ AppEvent. evt ".