Solved

Script to copy event logs

Posted on 2013-12-10
10
501 Views
Last Modified: 2013-12-12
Hello everyone,

Sorry if this question was posted before, but I did a search and it did not give me the details I needed.

I have an environment of 4 servers (2 Server 2008 and 2 Server 2003) that I would like to run some kind of a script to copy the event logs (Applications, System, and Security) logs to a remote location with a directory that will have the date listed.

I do have domain admin rights on the boxes.

Can someone please provide some help in this area?

Thank you for your time!
0
Comment
Question by:raphabar
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 5
10 Comments
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 39709707
I use this

@echo off
for /f "Tokens=1-4 Delims=/ " %%i in ('date /t') do set dt=%%i-%%j-%%k-%%l
for /f "Tokens=1-4 Delims=/ " %%i in ('date /t') do set dtd=%%j%%k%%l
for /f "Tokens=1" %%i in ('time /t') do set tm=-%%i
set tm=%tm::=-%
set dtt=%dt%%tm%
del c:\util\selogbu.txt
"C:\Program Files\Event Log Explorer\elback.exe" "C:\Documents and Settings\Administrator.OUR\My Documents\servers elog bu.elb"
C:\Util\7zip\7za a -y "e:\event log backups\servers\SERV005-%dtt%.zip" "e:\event log backups\servers\SERV005*.*"
C:\Util\7zip\7za a -y "e:\event log backups\servers\SERV010-%dtt%.zip" "e:\event log backups\servers\SERV010*.*"
C:\Util\7zip\7za a -y "e:\event log backups\servers\SERV011-%dtt%.zip" "e:\event log backups\servers\SERV011*.*"
C:\Util\7zip\7za a -y "e:\event log backups\servers\SERV012-%dtt%.zip" "e:\event log backups\servers\SERV012*.*"
C:\Util\7zip\7za a -y "e:\event log backups\servers\SERV013-%dtt%.zip" "e:\event log backups\servers\SERV013*.*"
del "e:\event log backups\servers\*.evt" >selogbu.txt
dir "e:\event log backups\servers\*.*" >>selogbu.txt
c:\util\febooti\febootimail -from support@email.net -to support@mydomain.com -msg "Servers Event Log BU Report" -subj "Backup Servers Event Log" -dontupdate -attach c:\util\selogbu.txt -smtp 10.168.169.26
exit


This use three utilities

1.  ELBACK from Event Log Viewer
2. 7ZIP command line  Free
3. Febooti batch SMTP email

I run this one a week and then it emails me a report files are zipped up to conserve disk space.

There are other utilities you can use but this script can be modified to use your utils
0
 
LVL 1

Author Comment

by:raphabar
ID: 39709824
Thank you for your prompt reply. Sorry for the simple question but I am not a scripting guy, can you tell me which variables I will need to change on this script so I can test it on my environment?

thanks!
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 39710023
What machine you going to run it on?
0
Office 365 Training for IT Pros

Learn how to provision tenants, synchronize on-premise Active Directory, implement Single Sign-On, customize Office deployment, and protect your organization with eDiscovery and DLP policies.  Only from Platform Scholar.

 
LVL 1

Author Comment

by:raphabar
ID: 39710195
I am going to run it on a local machine that has access to 4 different servers (part of the domain)
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 39710220
What is the OS of the machine?

I will work up the changes to the script

Do you have a way to send email via batch?

You can download 7Zip command line program it is free

The event log backup process depends on the OS running
0
 
LVL 1

Author Comment

by:raphabar
ID: 39710253
The OS of the machine is Win 7. the servers are all Server 2008.

I really do not want to install any applications (like 7 zip)

if it is possible I just want the script to copy and move the logs.

thank you!
0
 
LVL 23

Expert Comment

by:Thomas Grassi
ID: 39711248
Ok on windows 7 you have wevtutil that will do what you need

this is a simple batch that you can modify to your environment

@echo off
for /f "Tokens=1-4 Delims=/ " %%i in ('date /t') do set dt=%%i-%%j-%%k-%%l
for /f "Tokens=1-4 Delims=/ " %%i in ('date /t') do set dtd=%%j%%k%%l
for /f "Tokens=1" %%i in ('time /t') do set tm=-%%i
set tm=%tm::=-%
set dtt=%dt%%tm%
wevtutil epl application "c:\eventlogs\serverapplication-%dtt&.evtx" /r:servername
wevtutil epl system "c:\eventlogs\serversystem-%dtt&.evtx" /r:servername
wevtutil epl security "c:\eventlogs\serversecurity-%dtt&.evtx" /r:servername

move "c:\eventlogs\serverapplication-%dtt&.evtx" x:\eventlogs
move "c:\eventlogs\serversystem-%dtt&.evtx" x:\eventlogs
move "c:\eventlogs\serversecurity-%dtt&.evtx" x:\eventlogs
exit

When you connect to the remote server you may need to use the /u parameter
you can see all the explations of wevtutil by going to a command prompt and typing wevtutil hit enter.
then wevtutil COMMAND /? for more information

Plug in your server name so that you can separate the names in the listing easier.

need anymore help let me know
0
 
LVL 1

Author Comment

by:raphabar
ID: 39711447
Hello trgrassijr55,

Thank you for the help. Sorry but I am not familiar with scripting, so I was unable to get the script to work fully. I ran the script above on a local Win 7 machine to see what it will do and below are the changes that I made:

@echo off
for /f "Tokens=1-4 Delims=/ " %%i in ('date /t') do set dt=%%i-%%j-%%k-%%l
for /f "Tokens=1-4 Delims=/ " %%i in ('date /t') do set dtd=%%j%%k%%l
for /f "Tokens=1" %%i in ('time /t') do set tm=-%%i
set tm=%tm::=-%
set dtt=%dt%%tm%
wevtutil epl application "c:\eventlogs\serverapplication-%dtt&.evtx" /r:RDProject
wevtutil epl system "c:\eventlogs\serversystem-%dtt&.evtx" /r:RDProject
wevtutil epl security "c:\eventlogs\serversecurity-%dtt&.evtx" /r:RDProject

move "c:\eventlogs\serverapplication-%dtt&.evtx" E:\EVENTLOGS
move "c:\eventlogs\serversystem-%dtt&.evtx" E:\EVENTLOGS
move "c:\eventlogs\serversecurity-%dtt&.evtx" E:\EVENTLOGS
exit

RDProject is just a made up name for a server. The first part of the Script worked where it copied the files but I am not sure how to open these files to view them. please see attached image.

the Move part didn't work for me, im not sure why.

Any help is much appreciated.

Thank you
Image.JPG
0
 
LVL 1

Author Comment

by:raphabar
ID: 39711473
Update:

Sorry. Never mind about the file extensions, I was able to add .evt at the end to allow event viewer to open the files.

Thanks!
0
 
LVL 23

Accepted Solution

by:
Thomas Grassi earned 500 total points
ID: 39711482
To view the files just use event viewer
right click on the file and select open.
or use event viewer and chose open saved logs option

test the move command manually first

rem out the echo off and exit command in the script

then you will see in the console the messages copy them and post

rem @echo off

rem exit
0

Featured Post

Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
Deploying a Microsoft Access application in a Citrix environment is not difficult but takes a few steps. However, Citrix system people are often of little help, as they typically know next to nothing about Access. The script provided here will take …
Learn the basics of while and for loops in Python.  while loops are used for testing while, or until, a condition is met: The structure of a while loop is as follows:     while <condition>:         do something         repeate: The break statement m…
The viewer will learn the basics of jQuery, including how to invoke it on a web page. Reference your jQuery libraries: (CODE) Include your new external js/jQuery file: (CODE) Write your first lines of code to setup your site for jQuery.: (CODE)

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question