• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 4625
  • Last Modified:

Script to delete event viewer logs?

Greetings All,

I am currently in charge of 9 servers.  I review the event logs at least 3-4 times a week. My question is this. Does anyone know of a script or tool that will delete all logs from the viewer at one time? We only save serious errors to review later. So I delete the "garbage" after I review them. It isn't a big pain clearing each one manually, but if I could save a few minutes here and there it would help me out.
Thanks for any input you may be able to provide.

Tom
0
alank2
Asked:
alank2
  • 3
  • 3
  • 2
1 Solution
 
bsharathCommented:
Here is a script that will backup the evenlog and clear
strComputer = "machinename"
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate,(Backup)}!\\" & _
 strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Application'")
For Each objLogfile in colLogFiles
 errBackupLog = objLogFile.BackupEventLog("c:\application.evt")
 If errBackupLog <> 0 Then
 Wscript.Echo "The Application event log could not be backed up."
 Else
 objLogFile.ClearEventLog()
 End If
Next

0
 
alank2Author Commented:
I don't want to backup all the logs - just delete them. We only backup serious event log errors.
0
 
James MurrellProduct SpecialistCommented:
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
James MurrellProduct SpecialistCommented:

Here is a script that will backup the evenlog and clear
strComputer = "machinename"
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate,(Backup)}!\\" & _
 strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Application'")
For Each objLogfile in colLogFiles
 objLogFile.ClearEventLog()
Next

Open in new window

0
 
bsharathCommented:
You need to make two .bat files.

EvtBackup.bat   = This will make backup of Event Logs (Johnb6767 code)
ClearEvents.bat = This will clear Events

Both scripts will use C:\PCNames.txt file where all computer names should be mentioned.
You will have to run both scripts individually. First Run EvtBackup.bat then ClearEvents.bat

:: --- script start ---
@Echo Off
C:
CD\
MD "EVT Backups"
COPY /Y C:\Windows\System32\Config\*.evt "C:\EVT Backups\"
Exit
:: --- script End ---

Copy & Paste above code in notepad.exe and save it with 'EvtBackup.bat'
From command line run following command

Example:
C:\>PSExec @C:\pcnames.txt -d -c evtbackup.bat [enter]

:: --- script start ---
@Echo Off
PsLogList -c "Application"    @C:\pcnames.txt
PsLogList -c "Security"         @C:\pcnames.txt  
PsLogList -c "System"         @C:\pcnames.txt
Exit
:: --- script End ---

Copy & Paste above code in notepad.exe and save it with 'ClearEvents.bat'
From command line run following command

Example:
C:\>ClearEvents.bat [enter]

It will work perfectly.
Skip which ever you want
0
 
alank2Author Commented:
Thanks, that was exactly what I was looking for.
0
 
alank2Author Commented:
cs97jjm3,

I had found that Microsoft article previously. It was a little more than what I needed. But thank you for providing a possible answer for this.
0
 
James MurrellProduct SpecialistCommented:
NO worries soryy i could not offer more
0

Featured Post

VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

  • 3
  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now