Automated way to clear custom event log

Hi,

Anyone know how to automate clearing of custom event logs?

I've been able to clear the default logs with an modified script repository
example:

'clears the event logs.

strComputer = "."
Set objWMIService = GetObject("winmgmts:" &
"{impersonationLevel=impersonate,(Backup,Security)}!\\" & strComputer &
"\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery ("Select * from
Win32_NTEventLogFile where LogFileName='Application'")
For Each objLogfile in colLogFiles
objLogFile.ClearEventLog()
Next

Wscript.Echo "Application Log Cleared"

Set colLogFiles = objWMIService.ExecQuery ("Select * from
Win32_NTEventLogFile where LogFileName='Security'")
For Each objLogfile in colLogFiles
objLogFile.ClearEventLog()
Next

Wscript.Echo "Security Log Cleared"

Set colLogFiles = objWMIService.ExecQuery ("Select * from
Win32_NTEventLogFile where LogFileName='System'")
For Each objLogfile in colLogFiles
objLogFile.ClearEventLog()
Next

Wscript.Echo "System Log Cleared"

Set colLogFiles = objWMIService.ExecQuery ("Select * from
Win32_NTEventLogFile where LogFileName='Scripts'")
For Each objLogfile in colLogFiles
objLogFile.ClearEventLog()
Next

Wscript.Echo "Scripts Log Cleared"
_________________________________________________________

But the custom log "Scripts" (also created from an example in the Script
Repository) doesn't get cleared:


Any idea how I can make this work?

David
Mon Feb 20 17:11:28 CST 2006



"David" wrote:

> Hi,
>
> Anyone know how to automate clearing of custom event logs?
>
> I've been able to clear the default logs with an modified script repository
> example:
>
> 'clears the event logs.
>
> strComputer = "."
> Set objWMIService = GetObject("winmgmts:" &
> "{impersonationLevel=impersonate,(Backup,Security)}!\\" & strComputer &
> "\root\cimv2")
> Set colLogFiles = objWMIService.ExecQuery ("Select * from
> Win32_NTEventLogFile where LogFileName='Application'")
> For Each objLogfile in colLogFiles
> objLogFile.ClearEventLog()
> Next
>
> Wscript.Echo "Application Log Cleared"
>
> Set colLogFiles = objWMIService.ExecQuery ("Select * from
> Win32_NTEventLogFile where LogFileName='Security'")
> For Each objLogfile in colLogFiles
> objLogFile.ClearEventLog()
> Next
>
> Wscript.Echo "Security Log Cleared"
>
> Set colLogFiles = objWMIService.ExecQuery ("Select * from
> Win32_NTEventLogFile where LogFileName='System'")
> For Each objLogfile in colLogFiles
> objLogFile.ClearEventLog()
> Next
>
> Wscript.Echo "System Log Cleared"
>
> Set colLogFiles = objWMIService.ExecQuery ("Select * from
> Win32_NTEventLogFile where LogFileName='Scripts'")
> For Each objLogfile in colLogFiles
> objLogFile.ClearEventLog()
> Next
>
> Wscript.Echo "Scripts Log Cleared"
> _________________________________________________________
>
> But the custom log "Scripts" (also created from an example in the Script
> Repository) doesn't get cleared:
>
>
> Any idea how I can make this work?

Looks like I've found a way around this.

It seems that a custom log does not have the required info in the registry
that WMI needs to clear the log.

To fix the problem, one way is to run the following at the command prompt:

reg add "hklm\SYSTEM\CurrentControlSet\Services\Eventlog\Scripts" /v File /t
REG_EXPAND_SZ /d "%SystemRoot%\System32\config\Scripts.Evt" /f

This technique will work for other custom logs as well