Event Viewer Dumping

Hello All,

I'm trying to find a script or some method to dump all Security Events into a shared UNC path to which I run the batch or script file on, then it should automatically clear the logs. I have a few different methods in place to push out scripts and batch files remotely, but we have a new rentention policy for audit trails and this one one that I haven't quie been able to nail down.

Any help would be appreciated.
LVL 4
ValleyENTAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
ThinkPaperConnect With a Mentor IT ConsultantCommented:
What I did previously was create a scheduled task on each server, which references this script.

What it does it run regularly to check the size of the log. When it reaches a "maxium" size, it then copies the logfile on the share, which is named the "Servername_EventLogType_Date.evt" and clears out the original Log (so the size is back down again).
Dim objShell: Set objShell=CreateObject("Wscript.Shell")

set shell = WScript.CreateObject( "WScript.Shell" )

'Set Date format for file save
'--------------------------
If Month(Date) < 10 Then
  currDate="0" & Month(Date)
Else
  currDate= Month(Date)
End If
If Day(Date) <10 Then
  currDate = currDate & "0" & Day(Date)& Year(Date)
Else
  currDate = currDate & Day(Date) & Year(Date)
End If
'--------------------------


'objShell.Popup "1", 1

'grab server name
computername = shell.ExpandEnvironmentStrings("%COMPUTERNAME%")
 
'create folder if does not exist
'--------------------------
dim newFolder
Set objFSO = CreateObject("Scripting.FileSystemObject")
If  Not objFSO.FolderExists("\\ServerShare\ArchivedLogs\" & computername & "\") Then
   newfolder = objFSO.CreateFolder ("\\ServerShare\ArchivedLogs\" & computername & "\")
End If
'--------------------------


strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate, (Backup, Security)}!\\" & strComputer & "\root\cimv2")
 
Set colLogFiles = objWMIService.ExecQuery ("Select * from Win32_NTEventLogFile")
'objShell.Popup "2", 1
For Each objLogfile in colLogFiles
    'objShell.Popup "3!", 1
    If objLogFile.FileSize > 82837504 Then
	'objShell.Popup "4!", 1
       	strBackupLog = objLogFile.BackupEventLog("\\ServerShare\ArchivedLogs\" & computername & "\" & computername & "_" & objLogFile.LogFileName & "_" & currDate & ".evt")
       	objLogFile.ClearEventLog()
    End If
Next

Open in new window

0
 
Bill PrewCommented:
0
 
ThinkPaperIT ConsultantCommented:
Also take a look at an old question I posted, on how to create the Scheduled Tasks remotely on all servers...

http://www.experts-exchange.com/Programming/Languages/Scripting/Shell/Batch/Q_24155714.html
0
 
ValleyENTAuthor Commented:
Worked perfectly. Thank you.
0
All Courses

From novice to tech pro — start learning today.