Event Log Management

TheMSsForum.com: The Microsoft Software Forum

I would like to write a script that dumps the Security event log to a file
called %machine%_%date%_Security.txt and then clears the event log. I am
successfull in dumping the log but I have been unsuccessful in clearing the
event log; Anyone have a sample that shows how to save them clear a given
log?

Thanks
Top

Re: Event Log Management by Torgeir

Torgeir
Mon Jul 19 13:36:30 CDT 2004

David Doumani wrote:

> I would like to write a script that dumps the Security event log to a file
> called %machine%_%date%_Security.txt and then clears the event log. I am
> successfull in dumping the log but I have been unsuccessful in clearing the
> event log; Anyone have a sample that shows how to save them clear a given
> log?
Hi

See e.g. "Backup and Clear an Event Log" and "Backup and Clear
Large Event Logs" here:
http://www.microsoft.com/technet/community/scriptcenter/logs/default.mspx

Note that you need to "take" the Security privilege to access the
security event log (see the "Backup and Clear Large Event Logs"
example).


--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx
Top

Re: Event Log Management by David

David
Tue Jul 20 08:54:14 CDT 2004

Thanks for the input. Using that example and putting in a date function I
came up with this...

'Backup and Clear Large Event Logs
'Description
'Backs up and clears am event log if the log file size is larger than 20
megabytes.
'Script Code

txtDay = Day(Date())
txtMonth = Month(Date())
txtYear = Year(Date())
myDate = txtMonth & "." & txtDay & "." & txtYear & "."

strComputer = "."
Set objWMIService = GetObject("winmgmts:" &
"{impersonationLevel=impersonate, (Backup, Security)}!\\" & strComputer &
"\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery ("Select * from
Win32_NTEventLogFile")
For each objLogfile in colLogFiles
If objLogFile.FileSize > 20000 Then
strBackupLog = objLogFile.BackupEventLog ("c:\scripts\" & myDate &
objLogFile.LogFileName & ".evt")
objLogFile.ClearEventLog()
End If
Next


That works perfectly if run on each machine locally, however if I change
strComputer to MACHINE1 it "appears" to run and it clears the event logs;
however the files are not saved to either the local c:\scripts or the remote
machines c:\scripts.

Also can you tell me if objlogfile.filesize = 20000 is is bytes; thus
20000=20meg? I thought that to be true but this backed up and cleared a log
file with 4 megs in it.

Thanks for your help

"Torgeir Bakken (MVP)" <Torgeir.Bakken-spam@hydro.com> wrote in message
news:u8gWN%23bbEHA.3792@TK2MSFTNGP09.phx.gbl...
> David Doumani wrote:
>
> > I would like to write a script that dumps the Security event log to a
file
> > called %machine%_%date%_Security.txt and then clears the event log. I
am
> > successfull in dumping the log but I have been unsuccessful in clearing
the
> > event log; Anyone have a sample that shows how to save them clear a
given
> > log?
> Hi
>
> See e.g. "Backup and Clear an Event Log" and "Backup and Clear
> Large Event Logs" here:
> http://www.microsoft.com/technet/community/scriptcenter/logs/default.mspx
>
> Note that you need to "take" the Security privilege to access the
> security event log (see the "Backup and Clear Large Event Logs"
> example).
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scriptcenter/default.mspx


Top