Export Windows Log to CSV VB Script

Posted on 2008-11-19
Last Modified: 2012-05-05
I found this script online and modified it to get it working to export the Windows security event log to a CSV file. I need the event description in the CSV so I can not just use the event viewer export. I know I can use Event Log Explorer but I really want the script working. It writes the csv file but it does not populate anything in the file - 0 bytes. The name of my server is fs01.
'Retrieve *Audit Failures, Warnings, and Errors* from the EventLog files

On Error Resume Next

strComputer = "fs01"


Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate,(Security)}!\\" & strComputer & "\root\cimv2") 

Set colLoggedEvents = objWMIService.ExecQuery ("Select * From Win32_NTLogEvent Where Logfile = 'Security'") 


Set FileSystem = WScript.CreateObject("Scripting.FileSystemObject")

Set oFile = FileSystem.CreateTextFile("EventsSearc.csv", True)


' Event properties are:

' objEvent.

' Category

' CategoryString

' ComputerName

' Data

' EventCode

' EventIdentifier

' EventType

' InsertionStrings

' Logfile


' RecordNumber

' SourceName

' TimeGenerated

' TimeWritten

' Type

' User


For Each objEvent in colLoggedEvents

oFile.WriteLine (objEvent.Logfile & "," & objEvent.EventCode & "," & chr(34) & Trim( Replace( objEvent.Message, vbCrLf, " ")) & chr(34))




Wscript.Echo "Done!!"



Open in new window

Question by:mmcodefive
    1 Comment
    LVL 27

    Accepted Solution

    When I take out the "on error resume next" I get an error messages concerning the computer "fs01". If I replace that with ".", the script runs on my machine and I get the required file.

    I suggest that :-

    a) fs01 is not a computer in your domain, or
    b) fs01 is not accessible via the impersonation you have used, or
    c) fs01 has the winmgmts service not available to remote machines.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    I met Paul Devereux (@pdevereux) today when I responded to his tweet asking “Anybody know how to automate adding files from disk to a folder in #outlook  ?”.  I replied back and told Paul that using automation, in this case scripting, to add files t…
    Learn about cloud computing and its benefits for small business owners.
    It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now