[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

powershell script to save the event log and clear it

Posted on 2010-04-08
12
Medium Priority
?
1,927 Views
Last Modified: 2012-06-27
Hi Guys,

I have a text file that contains a list of computer names.
I need a script to read the content of the text file and get the event logs from each computer on the list, if the event size is bigger than 20MB, save it and clear it.

Can someone help with this?

Thanks in advance.
0
Comment
Question by:changjia
  • 6
  • 5
12 Comments
 
LVL 71

Expert Comment

by:Chris Dent
ID: 30133359

Hopefully nice and easy :) Naturally it requires testing.

HTH

Chris
# Get Event Logs files over 20Mb
Get-WMIObject Win32_NTEventLogFile -Filter "FileSize>20971520" | %{
  # Save it
  $_.BackupEventLog("C:\SomePath\$($_.LogFileName).evt")
  # Clear it
  $_.ClearEventLog()
}

Open in new window

0
 

Author Comment

by:changjia
ID: 30135790
Thanks Chirs.

I have a text file that has a list of computer names. How to read each computer name and do the above script on each computer?


Thanks
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 30136108

Sorry, I had meant to include that part. Modified here.

You are quite likely to find that the path is saves to is local to the system you're running against. I'd be surprised if it were anything else.

Chris
Get-Content "SomeFile.txt" | %{

  # Get Event Logs files over 20Mb
  Get-WMIObject Win32_NTEventLogFile -Computer $_ `
      -Filter "FileSize>20971520" | %{
    # Save it
    $_.BackupEventLog("C:\SomePath\$($_.LogFileName).evt")
    # Clear it
    $_.ClearEventLog()
  }
}

Open in new window

0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 

Author Comment

by:changjia
ID: 30137165
Awesome! Is there a way to add computername and date to name of the saved event log?

Thanks
0
 
LVL 71

Accepted Solution

by:
Chris Dent earned 2000 total points
ID: 30137539

Sure. How do you want the date formatted? This makes it ddMMyyyy (day, month, year).

Chris
$Date = Get-Date -Format ddMMyyyy
Get-Content "SomeFile.txt" | %{
  $Computer = $_
  # Get Event Logs files over 20Mb
  Get-WMIObject Win32_NTEventLogFile -Computer $Computer `
      -Filter "FileSize>20971520" | %{
    # Save it
    $_.BackupEventLog("C:\SomePath\$Computer-$($_.LogFileName)-$Date.evt")
    # Clear it
    $_.ClearEventLog()
  }
}

Open in new window

0
 

Author Comment

by:changjia
ID: 30138408
That will do it! I am doing the test now and will let you know the result.

Thanks for your help and you 100% deserver the 500 points.
0
 

Author Comment

by:changjia
ID: 30210208
I am getting this error when excute this script:

Exception calling "BackupEventlog" : "Access denied

Please advise.

Thanks
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 30210360

Either you don't have permission to perform the operation (at all) or you can't write to the specified path. Does the path exist? Remember it's almost certainly going to be using a path relative to the client (rather than relative to where you run the script).

Chris
0
 

Author Comment

by:changjia
ID: 30214061
I figured it out, I added this to the middle of the script,
%{$_.PSBase.Scope.Options.EnablePrivileges = $True;

Then it works beautifully!

Thanks for your help!
0
 

Author Comment

by:changjia
ID: 30214145
So this is the script running now, beatiful.


$Date = Get-Date -Format ddMMyyyy
Get-Content "SomeFile.txt" | %{
  $Computer = $_
  # Get Event Logs files over 20Mb
  Get-WMIObject Win32_NTEventLogFile -Computername $Computer `
      -Filter "FileSize>20971520" | %{$_.PSBase.Scope.Options.EnablePrivileges = $True;
    # Save it
    $_.BackupEventLog("C:\SomePath\$Computer-$($_.LogFileName)-$Date.evt")
    # Clear it
    $_.ClearEventLog()
  }
}
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 30214185

Excellent :) I forgot about user account control :)

Chris
0
 

Expert Comment

by:Skibo187
ID: 33186693
Question,

I need something like this, but I can't seem to run it. I created a folder and a txt file with the computer names, and a vbs file with changjia script. I run the script and i get an error:  Invalid Character Line 1 char 1. Can you help me please. What am i doing wrong.
thanks in advance
0

Featured Post

Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Previously, on our Nano Server Deployment series, we've created a new nano server image and deployed it on a physical server in part 2. Now we will go through configuration.
There are times when we need to generate a report on the inbox rules, where users have set up forwarding externally in their mailbox. In this article, I will be sharing a script I wrote to generate the report in CSV format.
Exchange organizations may use the Journaling Agent of the Transport Service to archive messages going through Exchange. However, if the Transport Service is integrated with some email content management application (such as an antispam), the admini…
Loops Section Overview

640 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question