Link to home
Start Free TrialLog in
Avatar of Irrylyn
Irrylyn

asked on

Can I backup event logs without clearing them?

I am currently running the following script to backup event logs to C:/EventLogs and clear them.  

Instead, i would like to know if I can backup the event logs and not clear them from the event log viewer.  I assume I'd just have to replace "objLogFile.ClearEventLog" with something else.

How can I do this?

----------------
Here is the script I'm using:

Dim DestServer
' Put in the UNC path for where you want the logs to be stored
DestServer = "C:\EventLogs"

'Create the Time variables
sDate=Right("0" & Month(Date),2) _
& "-" & Right("0" & Day(Date),2) _
& "-" & Right(Year(Date),2)

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")
Set wshShell = WScript.CreateObject( "WScript.Shell" )
strServerName = wshShell.ExpandEnvironmentStrings( "%COMPUTERNAME%" )

'If correct folder doesn't exist, make it
if Not oFSO.FolderExists(DestServer) then
   set oFolder = oFSO.CreateFolder(DestServer)
end if

'Gets the log files for this machine
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")

'This section goes out and gets the hostname this is run on for us.

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
  strHOSTNAME = objItem.Name
NEXT

'Now archive the logs and clear them
if oFSO.FolderExists(DestServer & strComputerName) then
  For Each objLogfile in colLogFiles
    strBackupLog = objLogFile.BackupEventLog _
        (DestServer & strComputerName & "\"  & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
    objLogFile.ClearEventLog()
  Next
end if
ASKER CERTIFIED SOLUTION
Avatar of Randy Downs
Randy Downs
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
'objLogFile.ClearEventLog()
Avatar of Irrylyn
Irrylyn

ASKER

Yep, that was all I had to do.

Thank you