Dump NPS logs

How can I dump the events or logs for "Network Policy and Access Services" to a text file ?
soffcecManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dan McFaddenSystems EngineerCommented:
Manually, you can navigate to any event log, right-click and do a "Save All Events As."  Your Save As options are:

1. evtx
2. xml
3. txt
4. csv

Or are you looking for a script?

Dan
0
Dan McFaddenSystems EngineerCommented:
If you are looking for events with specific event IDs or from a specific source, you can go to the appropriate event log and use the "Filter Current Log" function to select the desired events.  After finding the desired info, use the "Save Filtered Log File As" function to drop those events into files types mentioned above.

Dan
0
soffcecManagerAuthor Commented:
Well I need script for this, if have been trying to use wevtutil  and netsh, but not found a way to dump the NPS events.
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Dan McFaddenSystems EngineerCommented:
Have you tried using the plain old Event Viewer?  My posts above are based on using it.

Are you comfortable with PowerShell?

Dan
0
soffcecManagerAuthor Commented:
Yes, but I need to schedule the running of the event dump. PS is ok. I have done this for long time in Windows 2003 but I cant find out how to do this in Windows 2012R2 and I only need the logs for the NPS
0
Dan McFaddenSystems EngineerCommented:
OK, so a litte more info is needed:

1. the scheduled task is run how often?
2. what timeframe should be in the output file?  last 24 hours, last 12h, or all...
3. what event ids or what event source are you looking for?
--- I understand NPS events, but since you've done it before it would be helpful to now exactly what you pulled
4. CSV format?

Dan
0
soffcecManagerAuthor Commented:
Don´t worry about the schedule, I just need wevtutil  and netsh command syntax to dump the NPS events to text file, no matter what format (.cvs,.txt)
I have never dumps NPS events in Server 2003, this is the first time I try to dump them.
On the 2003 server I was dumping other events.
0
Dan McFaddenSystems EngineerCommented:
Have you enabled NPS logging?

Link: http://msdn.microsoft.com/en-us/library/cc730677.aspx

If so, it logs to a text located, by default, at:  systemroot \System32\LogFiles.  You can configure this log to rotate on the regular basis.  See above link.

Here is the netsh nps command reference:  http://technet.microsoft.com/en-us/library/cc754758(v=ws.10).aspx

Here is the wevtutil command reference:  http://technet.microsoft.com/de-de/library/cc732848(v=ws.10).aspx

Dan
0
soffcecManagerAuthor Commented:
The NPS logging does not log anything, I prefer to use the event viewer logs.

I have checked out both aobove links before, As I said, I need the syntax for netsh or wevtutil to dump the event viwer NPS
0
Dan McFaddenSystems EngineerCommented:
The links I posted provide you with the command reference, aka syntax.

If you want the actual command to dump the events, you have to answer a previous post where I asked what events ID you are looking for.  There are more than 100 unique events that are logged in the security event log.

Below is the XML for a custom event filter.

<QueryList>
 <Query Id=”0″ Path=”Security”>
 <Select Path=”Security”>*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and Task = 12552]]</Select>
 </Query>
 </QueryList>

Open in new window


Save that to an .xml file, then import it into the "Custom Views" in the Event Viewer to see if you get the results you want.  If that works for you, use the command below to get the events with wevtutil:

wevtutil qe c:\test\NpsQuery.xml /sq:true /f:text > NpsQuery.txt

Open in new window

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
soffcecManagerAuthor Commented:
Humm , not undestandig this error,

C:\Netuse>wevtutil qe NpsQuery.xml /sq:true /f:text
Failed to open event query. The specified xml text was not well-formed. See Extended Error for more details.
0
Dan McFaddenSystems EngineerCommented:
Error is from the way the xml file content was saved.  I'll guess you used Notepad to save the file.  I suggest that you use another text editor like Notepad++ or Programmer's notepad, either of these text editors will save the file properly.

Dan
0
soffcecManagerAuthor Commented:
Now I have tried to save the text with EditPlus and Notepad++ but get the same error

When I try to import to Custom View I get the error "The specified custom view is not valid."
0
soffcecManagerAuthor Commented:
It is working now. I replaced the double quote with double quote.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2012

From novice to tech pro — start learning today.