I have this script that is running on a couple of servers on a daily basis.
It's supposed to check and see if the security event log is greater than
20MB and if so, back it up and clear the log if the backup was successful.
Otherwise do nothing.
It works fine on one of the computers, however on the other it only "kind
of" works. On the computer I'm having trouble with I will see a .evt file
that was backed up (and is over 20 megs), then after that there are several
more .evt files that are created on a daily basis which are 1KB in size. If
I open these in event viewer nothing shows up (although it will say there
are a couple hundred thousand events). Then after a few days of creating
these 1KB files there will be a successfully backed up .evt file which is
about 50 megs by this time.
I suspect the problem has something to do with the log not being "locked"
properly or what ever needs to be done. The server that is having this
problem can get dozens of events per second at times (mostly b/c it's the
domain controller and it's logging all the login/logout stuff).
At anyrate, here is the portion of my script that does the work. Any ideas
on how to make it backup correctly every time? Oh, and a small side note.
I have an If to test the size to see if it's big enough. I tried making a
constant variable for the comparison but that never worked, for some reason
I had to type the literal value into the if expression. I'd also appreciate
any insight on why that is.
-mike
--------------------
Set objWMIService =
GetObject("winmgmts:{impersonationLevel=impersonate,(Backup,Security)}!\\" &
Computer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Security'")
For Each objLogfile in colLogFiles
If (objLogFile.FileSize > 20000000) Then
errBackupLog = objLogFile.BackupEventLog(SavePath & Computer & "\" &
Computer & "Security" & Today(1) & Today(0) & Today(2) & ".evt")
If errBackupLog <> 0 Then
if (DEBUG) then
Wscript.Echo "The Security event log could not be backed up."
end if
Else
if (DEBUG) then
wscript.echo "Clearing Log"
end if
objLogFile.ClearEventLog()
End If
else
if (DEBUG) then
wscript.echo "Filesize not big enough: " & objLogFile.FileSize
end if
End If ' if filesize
Next ' for each objLogfile