powershell script to save the event log and clear it

Hi Guys,

I have a text file that contains a list of computer names.
I need a script to read the content of the text file and get the event logs from each computer on the list, if the event size is bigger than 20MB, save it and clear it.

Can someone help with this?

Thanks in advance.
changjiaAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Chris DentPowerShell DeveloperCommented:

Hopefully nice and easy :) Naturally it requires testing.

HTH

Chris
# Get Event Logs files over 20Mb
Get-WMIObject Win32_NTEventLogFile -Filter "FileSize>20971520" | %{
  # Save it
  $_.BackupEventLog("C:\SomePath\$($_.LogFileName).evt")
  # Clear it
  $_.ClearEventLog()
}

Open in new window

0
changjiaAuthor Commented:
Thanks Chirs.

I have a text file that has a list of computer names. How to read each computer name and do the above script on each computer?


Thanks
0
Chris DentPowerShell DeveloperCommented:

Sorry, I had meant to include that part. Modified here.

You are quite likely to find that the path is saves to is local to the system you're running against. I'd be surprised if it were anything else.

Chris
Get-Content "SomeFile.txt" | %{

  # Get Event Logs files over 20Mb
  Get-WMIObject Win32_NTEventLogFile -Computer $_ `
      -Filter "FileSize>20971520" | %{
    # Save it
    $_.BackupEventLog("C:\SomePath\$($_.LogFileName).evt")
    # Clear it
    $_.ClearEventLog()
  }
}

Open in new window

0
MSSPs - Are you paying too much?

WEBINAR: Managed security service providers often deploy & manage products from a variety of solution vendors. But is this really the best approach when it comes to saving time AND money? Join us on Aug. 15th to learn how you can improve your total cost of ownership today!

changjiaAuthor Commented:
Awesome! Is there a way to add computername and date to name of the saved event log?

Thanks
0
Chris DentPowerShell DeveloperCommented:

Sure. How do you want the date formatted? This makes it ddMMyyyy (day, month, year).

Chris
$Date = Get-Date -Format ddMMyyyy
Get-Content "SomeFile.txt" | %{
  $Computer = $_
  # Get Event Logs files over 20Mb
  Get-WMIObject Win32_NTEventLogFile -Computer $Computer `
      -Filter "FileSize>20971520" | %{
    # Save it
    $_.BackupEventLog("C:\SomePath\$Computer-$($_.LogFileName)-$Date.evt")
    # Clear it
    $_.ClearEventLog()
  }
}

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
changjiaAuthor Commented:
That will do it! I am doing the test now and will let you know the result.

Thanks for your help and you 100% deserver the 500 points.
0
changjiaAuthor Commented:
I am getting this error when excute this script:

Exception calling "BackupEventlog" : "Access denied

Please advise.

Thanks
0
Chris DentPowerShell DeveloperCommented:

Either you don't have permission to perform the operation (at all) or you can't write to the specified path. Does the path exist? Remember it's almost certainly going to be using a path relative to the client (rather than relative to where you run the script).

Chris
0
changjiaAuthor Commented:
I figured it out, I added this to the middle of the script,
%{$_.PSBase.Scope.Options.EnablePrivileges = $True;

Then it works beautifully!

Thanks for your help!
0
changjiaAuthor Commented:
So this is the script running now, beatiful.


$Date = Get-Date -Format ddMMyyyy
Get-Content "SomeFile.txt" | %{
  $Computer = $_
  # Get Event Logs files over 20Mb
  Get-WMIObject Win32_NTEventLogFile -Computername $Computer `
      -Filter "FileSize>20971520" | %{$_.PSBase.Scope.Options.EnablePrivileges = $True;
    # Save it
    $_.BackupEventLog("C:\SomePath\$Computer-$($_.LogFileName)-$Date.evt")
    # Clear it
    $_.ClearEventLog()
  }
}
0
Chris DentPowerShell DeveloperCommented:

Excellent :) I forgot about user account control :)

Chris
0
Skibo187Commented:
Question,

I need something like this, but I can't seem to run it. I created a folder and a txt file with the computer names, and a vbs file with changjia script. I run the script and i get an error:  Invalid Character Line 1 char 1. Can you help me please. What am i doing wrong.
thanks in advance
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Powershell

From novice to tech pro — start learning today.