troubleshooting Question

Can I backup event logs without clearing them?

Avatar of Irrylyn
Irrylyn asked on
Microsoft Server OSIT Administration
3 Comments1 Solution312 ViewsLast Modified:
I am currently running the following script to backup event logs to C:/EventLogs and clear them.  

Instead, i would like to know if I can backup the event logs and not clear them from the event log viewer.  I assume I'd just have to replace "objLogFile.ClearEventLog" with something else.

How can I do this?

----------------
Here is the script I'm using:

Dim DestServer
' Put in the UNC path for where you want the logs to be stored
DestServer = "C:\EventLogs"

'Create the Time variables
sDate=Right("0" & Month(Date),2) _
& "-" & Right("0" & Day(Date),2) _
& "-" & Right(Year(Date),2)

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")
Set wshShell = WScript.CreateObject( "WScript.Shell" )
strServerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )

'If correct folder doesn't exist, make it
if Not oFSO.FolderExists(DestServer) then
   set oFolder = oFSO.CreateFolder(DestServer)
end if

'Gets the log files for this machine
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")

'This section goes out and gets the hostname this is run on for us.

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
  strHOSTNAME = objItem.Name
NEXT

'Now archive the logs and clear them
if oFSO.FolderExists(DestServer & strComputerName) then
  For Each objLogfile in colLogFiles
    strBackupLog = objLogFile.BackupEventLog _
        (DestServer & strComputerName & "\"  & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
    objLogFile.ClearEventLog()
  Next
end if
Join the community to see this answer!
Join our exclusive community to see this answer & millions of others.
Unlock 1 Answer and 3 Comments.
Join the Community
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 3 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros