Automatically clear and save event logs 1

[pilgie]

Hi,

I am looking for a way to automatically clear and save the event logs to a file server.

Has anyone come across a tool to do this? Or has anyone done this in the past?

Any help appreciated.

Regards,

Luke.

 

[markdmac]

Yup, I have a script that does it.

Save the code to a text file and name it DumpEventLogs.vbs
then schedule the script to run at whatever interval you see fit. Don't forget to edit the destination path.

[green]
'==========================================================================
'
' NAME: DumpEventLogs.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spider's Parlor	
' URL: [URL unfurl="true"]http://www.thespidersparlor.com[/URL]
' DATE  : 1/12/2004
'
' COMMENT: Edit the Destination Server path below to indicate where to dump files to.  
'          Run this script on the server who's event logs are to be saved.
'
' This script and many more are included in 
'               The Spider's Parlor Admin Script Pack
'==========================================================================[/green]

Dim DestServer[green]
' Put in the UNC path for where you want the logs to be stored[/green]
DestServer = "\\backupserver\C$\Logs\"

[green]
'Create the Time variables[/green]
sDate=Right("0" & Month(Date),2) _
& "-" & Right("0" & Day(Date),2) _
& "-" & Right(Year(Date),2)

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")

[green]
'If correct folder doesn't exist, make it[/green]
if Not oFSO.FolderExists(DestServer & sDate) then
   set oFolder = oFSO.CreateFolder(DestServer & sDate )
end if
[green]
'Gets the log files for this machine[/green]
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")

[green]
'This section goes out and gets the hostname this is run on for us.[/green]

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
  strHOSTNAME = objItem.Name
NEXT

[green]
'Now archive the logs and clear them[/green]
if oFSO.FolderExists(DestServer & sDate) then
  For Each objLogfile in colLogFiles
    strBackupLog = objLogFile.BackupEventLog _
        (DestServer & sDate & "\"  & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
    objLogFile.ClearEventLog()
  Next
end if

I hope you find this post helpful.

Regards,

Mark

 

[pilgie]

Thank you very much ******

 

[pilgie]

Just testing this on my home PC which runs XP. But I recieve an invalid character error at line 1.

Will it only run on 2003. Or do i need to install something for it to run?

 

[markdmac]

If line one is

'==========================================================================

Then you probably are missing the leading apostraphe from your copy/paste. The apostraphe indicates the code after it is a comment.

I hope you find this post helpful.

Regards,

Mark