• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 477
  • Last Modified:

How to seperate back up path logs

This utility built in as a command line for Server 2008 works perfectly, besides the fact that it is placed in one folder and not separated ie. folder called:  application, security, system.  Is there a variable that i can place in this command to send each backup to a specified folder.

For example i would like this >>>> wevtutil epl Security BACKUP_PATH%\security_%timestamp%.evtx to go a D:\Logs\Security etc.

rem Script start here
rem Timestamp Generator

set BACKUP_PATH=D:\logs\

rem Parse the date (e.g., Thu 02/28/2013)
set cur_yyyy=%date:~10,4%
set cur_mm=%date:~4,2%
set cur_dd=%date:~7,2%

rem Parse the time (e.g., 11:20:56.39)
set cur_hh=%time:~0,2%
if %cur_hh% lss 10 (set cur_hh=0%time:~1,1%)
set cur_nn=%time:~3,2%


rem Set the timestamp format
set timestamp=%cur_yyyy%%cur_mm%%cur_dd%-%cur_hh%%cur_nn%%

wevtutil epl System %BACKUP_PATH%\system_%timestamp%.evtx
wevtutil epl Application %BACKUP_PATH%\application_%timestamp%.evtx
wevtutil epl Security %BACKUP_PATH%\security_%timestamp%.evtx

rem End of Script

Open in new window

0
cgooden01
Asked:
cgooden01
  • 4
  • 3
  • 3
1 Solution
 
Steve KnightIT ConsultancyCommented:
From a quick look, in your backup commandlines you are specifying the filename, just change it to the path you want, i.e. at most basic replace the _ after system, application etc. with a \.

Curious why you want to extract your event logs to backup?

Steve
0
 
Bill PrewCommented:
Give this a try, it should do what you are looking for.  It processes a list of the logs to backup and then makes sure the destination directory exists, and sends the eventlog extract there.

rem Script start here
rem Timestamp Generator

set BACKUP_PATH=D:\logs
set BACKUP_LOGS=System,Application,Security

rem Parse the date (e.g., Thu 02/28/2013)
set cur_yyyy=%date:~10,4%
set cur_mm=%date:~4,2%
set cur_dd=%date:~7,2%

rem Parse the time (e.g., 11:20:56.39)
set cur_hh=%time:~0,2%
if %cur_hh% lss 10 (set cur_hh=0%time:~1,1%)
set cur_nn=%time:~3,2%

rem Set the timestamp format
set timestamp=%cur_yyyy%%cur_mm%%cur_dd%-%cur_hh%%cur_nn%

for %%A in (%BACKUP_LOGS%) do (
  if not exist "%BACKUP_PATH%\%%A\" md "%BACKUP_PATH%\%%A\"
  wevtutil epl %%A "%BACKUP_PATH%\%%A\system_%timestamp%.evtx"
)

rem End of Script

Open in new window

~bp
0
 
cgooden01Author Commented:
I will try this in the morning. So it is to my understanding that each log will go to its respective folder on D.  The purpose of this is for off-line viewing of Security Personnel and also to alleviate the C Volume from getting full.  

So System Logs will have a System Folder, Application Logs>>Application Folder and Security Logs>>Security folder .....Correct

If Im not mistaken, (dragon-it)  You are saying in-place  of:

wevtutil epl System D:\Logs\SystemLog\system_%timestamp%.evtx
wevtutil epl Application D:\Logs\ApplicationLog\application_%timestamp%.evtx
etc.......
0
Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

 
Bill PrewCommented:
Yes, that is what my script did.

~bp
0
 
Steve KnightIT ConsultancyCommented:
Yes that is what I meant, and as Bill says what he has done in his script.  I was using mobile as I am now hence why I didn't copy/past it all.

All you need to do is make sure those three dirs are already there, or your app extract might make them itself, I don't know off hand.

Bill's script includes making sure dir is there too.

Steve
0
 
cgooden01Author Commented:
Worked great as advised and anticipated.  Now is there a way that i can loop into a clear command to run moments after the backup is accomplished instead of running another script.  

Currently, I have another batch file running 5 minute later to clear the logs
wevtutil cl System
wevtutil cl Application
wevtutil cl Security
0
 
Steve KnightIT ConsultancyCommented:
Just add those commands to the bottom of the above script, i.e. in Bill's script before the line rem End of Script.

There is nothing too magic about batch files, they just run the commands you ask in order.

If you want a pause before the next bit you can do a PING command most easily to pause, i.e. add to the end:

REM Wait approx. 1 minute
PING 127.0.0.1 -n 60 >NUL 2>&1

REM Clear logs
wevtutil cl System
wevtutil cl Application
wevtutil cl Security
0
 
Bill PrewCommented:
Or, using my approach:

rem Script start here
rem Timestamp Generator

set BACKUP_PATH=D:\logs
set BACKUP_LOGS=System,Application,Security

rem Parse the date (e.g., Thu 02/28/2013)
set cur_yyyy=%date:~10,4%
set cur_mm=%date:~4,2%
set cur_dd=%date:~7,2%

rem Parse the time (e.g., 11:20:56.39)
set cur_hh=%time:~0,2%
if %cur_hh% lss 10 (set cur_hh=0%time:~1,1%)
set cur_nn=%time:~3,2%

rem Set the timestamp format
set timestamp=%cur_yyyy%%cur_mm%%cur_dd%-%cur_hh%%cur_nn%

for %%A in (%BACKUP_LOGS%) do (
  if not exist "%BACKUP_PATH%\%%A\" md "%BACKUP_PATH%\%%A\"
  wevtutil epl %%A "%BACKUP_PATH%\%%A\system_%timestamp%.evtx"
)

rem Wait 10 seconds
ping -n 1 -w 10000 192.0.0.0 >NUL 2>&1

rem Clear the logs
for %%A in (%BACKUP_LOGS%) do (
  wevtutil cl %%A
)

rem End of Script

Open in new window

~bp
0
 
cgooden01Author Commented:
Worked Great!  Thanks a bunch.  Perfect Results and respond.
0
 
Bill PrewCommented:
Welcome, glad that helped.

~bp
0

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

  • 4
  • 3
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now