Avatar of Irrylyn
Irrylyn
 asked on

Can I backup event logs without clearing them?

I am currently running the following script to backup event logs to C:/EventLogs and clear them.  

Instead, i would like to know if I can backup the event logs and not clear them from the event log viewer.  I assume I'd just have to replace "objLogFile.ClearEventLog" with something else.

How can I do this?

----------------
Here is the script I'm using:

Dim DestServer
' Put in the UNC path for where you want the logs to be stored
DestServer = "C:\EventLogs"

'Create the Time variables
sDate=Right("0" & Month(Date),2) _
& "-" & Right("0" & Day(Date),2) _
& "-" & Right(Year(Date),2)

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")
Set wshShell = WScript.CreateObject( "WScript.Shell" )
strServerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )

'If correct folder doesn't exist, make it
if Not oFSO.FolderExists(DestServer) then
   set oFolder = oFSO.CreateFolder(DestServer)
end if

'Gets the log files for this machine
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")

'This section goes out and gets the hostname this is run on for us.

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
  strHOSTNAME = objItem.Name
NEXT

'Now archive the logs and clear them
if oFSO.FolderExists(DestServer & strComputerName) then
  For Each objLogfile in colLogFiles
    strBackupLog = objLogFile.BackupEventLog _
        (DestServer & strComputerName & "\"  & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
    objLogFile.ClearEventLog()
  Next
end if
IT AdministrationMicrosoft Server OS

Avatar of undefined
Last Comment
Irrylyn

8/22/2022 - Mon
ASKER CERTIFIED SOLUTION
Randy Downs

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
Randy Downs

'objLogFile.ClearEventLog()
Irrylyn

ASKER
Yep, that was all I had to do.

Thank you
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck