Back-up event log

[thabrock]

Sorry if this is a basic question, but is there a way to back-up the event log in Windows Server 2003? Will a System State back-up save the event log?

Thanks.

Tim

 

[GrimR]

I would use a scheduled task, Vbscript, dump the logs to a folder that gets backed up.

 

[ITPangaeaArchitect]

can use the dumpel.exe command (i think its resource kit tool).
I dont believe the system state contains the event logs, but cant remember for sure...

-Brandon Wilson
MCSE00/03, MCSA:Messaging00, MCSA03, A+
Manager - Global AD Operations
ACS, Inc.

 

[GrimR]

Here is a script Mark made that works well.

'==========================================================================
'
' NAME: DumpEventLogs.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spiders Parlor
' URL: [URL unfurl="true"]http://www.TheSpidersParlor.com[/URL]
' DATE  : 1/12/2004
'
' COMMENT: Edit the Destination Server path below to indicate where to dump files to.  
'          Run this script on the server who's event logs are to be saved.
'
'==========================================================================

Dim DestServer
' Put in the UNC path for where you want the logs to be stored
DestServer = "c:\backup"


'Create the Time variables
sDate=Right("0" & Month(Date),2) _
& "-" & Right("0" & Day(Date),2) _
& "-" & Right(Year(Date),2)

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")


'If correct folder doesn't exist, make it
if Not oFSO.FolderExists(DestServer & sDate) then
   set oFolder = oFSO.CreateFolder(DestServer & sDate )
end if

'Gets the log files for this machine
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
        & strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile")


'This section goes out and gets the hostname this is run on for us.

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
  strHOSTNAME = objItem.Name
NEXT


'Now archive the logs and clear them
if oFSO.FolderExists(DestServer & sDate) then
  For Each objLogfile in colLogFiles
    strBackupLog = objLogFile.BackupEventLog _
        (DestServer & sDate & "\"  & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
    objLogFile.ClearEventLog()
  Next
end if