Solved

Windows XP Event Log export/copy

Posted on 2006-11-20
14
3,090 Views
Last Modified: 2012-06-27
I'm looking for a way to generate an export or copy of windows XP event log data via a batch file.  Copying seems to corrupt the file (presumably because it is an open file), and I will not be present at the PC to export manually.

any ideas would be appreciated.
0
Comment
Question by:dbeckwitt
  • 4
  • 2
  • 2
  • +2
14 Comments
 
LVL 67

Expert Comment

by:sirbounty
ID: 17981086
There's several scripting methods located here: http://www.microsoft.com/technet/scriptcenter/resources/qanda/events.mspx
I know of no way with batch scripting...
0
 
LVL 14

Expert Comment

by:yessirnosir
ID: 17981629
Are you just trying to archive the logs for occasional access?  If that is the goal, one easy solution would be to use backup software on a schedule.  Even the built-in ntbackup tool should do the job; it uses volume shadow copy to get around the open file problem.   To view the files, you would have to restore them as a second step, although I image that could also be automated and scheduled.  
0
 
LVL 70

Expert Comment

by:Merete
ID: 17985686
Yes I  played arouynd with this oneday wondering how I could save them too, I found an easy that works too.
open one of the errors
control panel administrative tools event errors>applications
 by double clicking an error to open the panel then look over to the right see the little white icon below teh down arrow click on that that copies it. then paste it into here or word etc.
In the Action button export list.

Here is proof it works by left clicking that littler white icon.

Event Type:      Information
Event Source:      SecurityCenter
Event Category:      None
Event ID:      1800
Date:            21/11/2006
Time:            7:23:33 AM
User:            N/A
Computer:      USER
Description:
The Windows Security Center Service has started.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

0
 
LVL 70

Expert Comment

by:Merete
ID: 17985694
or r/click applications in the left coloumn and save  logfile as  or export list
0
 
LVL 1

Accepted Solution

by:
hughtwg earned 125 total points
ID: 17996229
You can create the following vb script and add it to the task scheduler. It will export than truncate all of your logs. You may need to change the folder location d:\EventLogs to where ever you wish to store the logs.

------------------------------------------

dtmThisDay = Day(Date)
dtmThisMonth = Month(Date)
dtmThisYear = Year(Date)
strBackupName = dtmThisYear & "_" & dtmThisMonth & "_" & dtmThisDay

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")

For Each objLogfile in colLogFiles
    If objLogFile.FileSize <> 100000 Then
       strBackupLog = objLogFile.BackupEventLog _
           ("D:\Eventlogs\" & strBackupName & objLogFile.LogFileName & ".evt")
       objLogFile.ClearEventLog()
    End If
Next

------------------------------------

-hughtwg

0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 14

Expert Comment

by:yessirnosir
ID: 17996368
hughtwg rocks!
0
 
LVL 14

Expert Comment

by:yessirnosir
ID: 17999848
this isn't even my thread, but that script was really educational for me.  thanks hughtwg!  The script worked first time with no modification on my system (other than creating the D:\eventlogs folder)

as I was learning how your script worked, I came across this reference that helped me understand it.  http://www.microsoft.com/technet/scriptcenter/guide/sas_log_pcna.mspx?mfr=true
there is a good explanation in there of why you can't just copy an event log; you have to use the "Event Log Backup API"
0
 
LVL 1

Expert Comment

by:hughtwg
ID: 18000490
Glad I could help. Hopefully dbeckwitt will find it useful also. ;)

-Hugh
0
 
LVL 67

Expert Comment

by:sirbounty
ID: 18154508
hughtwg certainly has (imo) the best automated solution, though there were other likely solutions as well, depending on what the author was trying to accomplish.  The link I posted has scripts that will only pull out a certain date range or specified error/warning type...
0
 
LVL 14

Expert Comment

by:yessirnosir
ID: 18154922
I'd say all points to hughtwg...
0
 
LVL 15

Expert Comment

by:riteheer
ID: 18193557
If everyone was as easy to get along with and as helpful as you guys, cleanup would be a breeze, if not completely unnecessary. Thanks for the help guys, as per your recommendations I'm going to recommend hughtwg
0

Featured Post

Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Can I download Google sheets program to my PC? 13 83
Edit header 19 101
contractual requirements for app hosting 3 76
best free software for ripping cd's 11 68
Today companies are subjected to more-and-more data, and it won't stop any time soon.  But there are obvious opportunities for reducing data, particularly data duplicated among companies.
Workplace bullying has increased with the use of email and social media. Retain evidence of this with email archiving to protect your employees.
The viewer will learn common shortcuts with easy ways to remember them. The viewer will then learn where to find all of the keyboard shortcuts, how to create/change them, and how to speed up their workflow.
An overview on how to enroll an hourly employee into the employee database and how to give them access into the clock in terminal.

919 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now