Link to home
Create AccountLog in
Avatar of Irrylyn

asked on

Can I backup event logs without clearing them?

I am currently running the following script to backup event logs to C:/EventLogs and clear them.  

Instead, i would like to know if I can backup the event logs and not clear them from the event log viewer.  I assume I'd just have to replace "objLogFile.ClearEventLog" with something else.

How can I do this?

Here is the script I'm using:

Dim DestServer
' Put in the UNC path for where you want the logs to be stored
DestServer = "C:\EventLogs"

'Create the Time variables
sDate=Right("0" & Month(Date),2) _
& "-" & Right("0" & Day(Date),2) _
& "-" & Right(Year(Date),2)

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")
Set wshShell = WScript.CreateObject( "WScript.Shell" )
strServerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )

'If correct folder doesn't exist, make it
if Not oFSO.FolderExists(DestServer) then
   set oFolder = oFSO.CreateFolder(DestServer)
end if

'Gets the log files for this machine
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")

'This section goes out and gets the hostname this is run on for us.

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
  strHOSTNAME = objItem.Name

'Now archive the logs and clear them
if oFSO.FolderExists(DestServer & strComputerName) then
  For Each objLogfile in colLogFiles
    strBackupLog = objLogFile.BackupEventLog _
        (DestServer & strComputerName & "\"  & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
end if
Avatar of Randy Downs
Randy Downs
Flag of United States of America image

Link to home
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
Avatar of Irrylyn


Yep, that was all I had to do.

Thank you