Improve company productivity with a Business Account.Sign Up

x
?
Solved

Script to delete event viewer logs?

Posted on 2007-11-15
8
Medium Priority
?
4,633 Views
Last Modified: 2010-04-21
Greetings All,

I am currently in charge of 9 servers.  I review the event logs at least 3-4 times a week. My question is this. Does anyone know of a script or tool that will delete all logs from the viewer at one time? We only save serious errors to review later. So I delete the "garbage" after I review them. It isn't a big pain clearing each one manually, but if I could save a few minutes here and there it would help me out.
Thanks for any input you may be able to provide.

Tom
0
Comment
Question by:alank2
  • 3
  • 3
  • 2
8 Comments
 
LVL 11

Expert Comment

by:bsharath
ID: 20290390
Here is a script that will backup the evenlog and clear
strComputer = "machinename"
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate,(Backup)}!\\" & _
 strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Application'")
For Each objLogfile in colLogFiles
 errBackupLog = objLogFile.BackupEventLog("c:\application.evt")
 If errBackupLog <> 0 Then
 Wscript.Echo "The Application event log could not be backed up."
 Else
 objLogFile.ClearEventLog()
 End If
Next

0
 

Author Comment

by:alank2
ID: 20291766
I don't want to backup all the logs - just delete them. We only backup serious event log errors.
0
 
LVL 31

Expert Comment

by:James Murrell
ID: 20292427
0
Get your problem seen by more experts

Be seen. Boost your question’s priority for more expert views and faster solutions

 
LVL 31

Expert Comment

by:James Murrell
ID: 20292446

Here is a script that will backup the evenlog and clear
strComputer = "machinename"
Set objWMIService = GetObject("winmgmts:" _
 & "{impersonationLevel=impersonate,(Backup)}!\\" & _
 strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
 ("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Application'")
For Each objLogfile in colLogFiles
 objLogFile.ClearEventLog()
Next

Open in new window

0
 
LVL 11

Accepted Solution

by:
bsharath earned 2000 total points
ID: 20294323
You need to make two .bat files.

EvtBackup.bat   = This will make backup of Event Logs (Johnb6767 code)
ClearEvents.bat = This will clear Events

Both scripts will use C:\PCNames.txt file where all computer names should be mentioned.
You will have to run both scripts individually. First Run EvtBackup.bat then ClearEvents.bat

:: --- script start ---
@Echo Off
C:
CD\
MD "EVT Backups"
COPY /Y C:\Windows\System32\Config\*.evt "C:\EVT Backups\"
Exit
:: --- script End ---

Copy & Paste above code in notepad.exe and save it with 'EvtBackup.bat'
From command line run following command

Example:
C:\>PSExec @C:\pcnames.txt -d -c evtbackup.bat [enter]

:: --- script start ---
@Echo Off
PsLogList -c "Application"    @C:\pcnames.txt
PsLogList -c "Security"         @C:\pcnames.txt  
PsLogList -c "System"         @C:\pcnames.txt
Exit
:: --- script End ---

Copy & Paste above code in notepad.exe and save it with 'ClearEvents.bat'
From command line run following command

Example:
C:\>ClearEvents.bat [enter]

It will work perfectly.
Skip which ever you want
0
 

Author Closing Comment

by:alank2
ID: 31409363
Thanks, that was exactly what I was looking for.
0
 

Author Comment

by:alank2
ID: 20297815
cs97jjm3,

I had found that Microsoft article previously. It was a little more than what I needed. But thank you for providing a possible answer for this.
0
 
LVL 31

Expert Comment

by:James Murrell
ID: 20297854
NO worries soryy i could not offer more
0

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
In this video I will demonstrate how to set up Nine, which I now consider the best alternative email app to Touchdown.

595 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question