Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Event Viewer Dumping

Posted on 2010-11-10
5
Medium Priority
?
463 Views
Last Modified: 2012-05-10
Hello All,

I'm trying to find a script or some method to dump all Security Events into a shared UNC path to which I run the batch or script file on, then it should automatically clear the logs. I have a few different methods in place to push out scripts and batch files remotely, but we have a new rentention policy for audit trails and this one one that I haven't quie been able to nail down.

Any help would be appreciated.
0
Comment
Question by:ValleyENT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
5 Comments
 
LVL 57

Expert Comment

by:Bill Prew
ID: 34108740
0
 
LVL 16

Accepted Solution

by:
ThinkPaper earned 2000 total points
ID: 34121225
What I did previously was create a scheduled task on each server, which references this script.

What it does it run regularly to check the size of the log. When it reaches a "maxium" size, it then copies the logfile on the share, which is named the "Servername_EventLogType_Date.evt" and clears out the original Log (so the size is back down again).
Dim objShell: Set objShell=CreateObject("Wscript.Shell")

set shell = WScript.CreateObject( "WScript.Shell" )

'Set Date format for file save
'--------------------------
If Month(Date) < 10 Then
  currDate="0" & Month(Date)
Else
  currDate= Month(Date)
End If
If Day(Date) <10 Then
  currDate = currDate & "0" & Day(Date)& Year(Date)
Else
  currDate = currDate & Day(Date) & Year(Date)
End If
'--------------------------


'objShell.Popup "1", 1

'grab server name
computername = shell.ExpandEnvironmentStrings("%COMPUTERNAME%")
 
'create folder if does not exist
'--------------------------
dim newFolder
Set objFSO = CreateObject("Scripting.FileSystemObject")
If  Not objFSO.FolderExists("\\ServerShare\ArchivedLogs\" & computername & "\") Then
   newfolder = objFSO.CreateFolder ("\\ServerShare\ArchivedLogs\" & computername & "\")
End If
'--------------------------


strComputer = "."
Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate, (Backup, Security)}!\\" & strComputer & "\root\cimv2")
 
Set colLogFiles = objWMIService.ExecQuery ("Select * from Win32_NTEventLogFile")
'objShell.Popup "2", 1
For Each objLogfile in colLogFiles
    'objShell.Popup "3!", 1
    If objLogFile.FileSize > 82837504 Then
	'objShell.Popup "4!", 1
       	strBackupLog = objLogFile.BackupEventLog("\\ServerShare\ArchivedLogs\" & computername & "\" & computername & "_" & objLogFile.LogFileName & "_" & currDate & ".evt")
       	objLogFile.ClearEventLog()
    End If
Next

Open in new window

0
 
LVL 16

Expert Comment

by:ThinkPaper
ID: 34121278
Also take a look at an old question I posted, on how to create the Scheduled Tasks remotely on all servers...

http://www.experts-exchange.com/Programming/Languages/Scripting/Shell/Batch/Q_24155714.html
0
 
LVL 4

Author Closing Comment

by:ValleyENT
ID: 34142015
Worked perfectly. Thank you.
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Here's a look at newsworthy articles and community happenings during the last month.
Wouldn't it be nice if objects in Active Directory automatically moved into the correct Organizational Units? This is what AutoAD aims to do and as a plus, it automatically creates Sites, Subnets, and Organizational Units.
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
Suggested Courses

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question