Event log script 2

[TheNewOne]

Hi guys. I have script that makes .evt file of my logs for backup, and names that .evt file with date that was made. Im not good in scripting so could some of you guys give me some advice how could I script this problem more effective and elegant. Thx for any help

dim SigDate
SigDate = date
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Application'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog("c:\Log Backup\ApplicationLog_" & SigDate & ".evt")
Next

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Security'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog("c:\Log Backup\SecurityLog_" & SigDate & ".evt")
Next

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='System'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog("c:\Log Backup\SystemLog_" & SigDate & ".evt")
Next

 

[EBGreen]

Does what you have work?

[blue]"Well, once again my friend, we find that science is a two headed beast. One head is nice, it gives us aspirin and other modern conveniences,...but the other head of science is BAD! Oh, beware the other head of science, Arthur; it bites!!" - The Tick[/blue]

 

[markdmac]

Give this a try.



'==========================================================================
'
' NAME: DumpEventLogs.vbs
'
' AUTHOR: Mark D. MacLachlan , The Spider's Parlor
' URL:

http://www.thespidersparlor.com

' DATE : 1/12/2004
'
' COMMENT: Edit the Destination Server path below to indicate where to dump files to.
' Run this script on the server who's event logs are to be saved.
'
'==========================================================================

Dim DestServer

DestServer = "\\markdmac\C\Logs\"


'Time to create the vars that hold the date and time
sDate = DatePart("m", Now) & "-"
sDate = sDate & DatePart("d", Now) & "-"
sDate = sDate & DatePart("yyyy", Now) & ""

sTime = DatePart("h", Now) & DatePart("n", Now)

set oFSO = CreateObject("Scripting.FileSystemObject")


'If correct folder doesn't exist, make it
if oFSO.FolderExists(DestServer & sDate) then
else

'This section will create the target folder
set oFolder = oFSO.CreateFolder(DestServer & sDate )
end if

'Gets the log files for this machine
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate, (Backup, Security)}!\\" _
& strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile")


'This section goes out and gets the hostname this is run on for us.

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)

For Each objItem in colItems
strHOSTNAME = objItem.Name
NEXT


'checks to make sure the folder exists, just in case link is down or something
if oFSO.FolderExists(DestServer & sDate) then
For Each objLogfile in colLogFiles
strBackupLog = objLogFile.BackupEventLog _
(DestServer & sDate & "\" & strHOSTNAME & "_" & objLogFile.LogFileName & "_" & sDate & "_" & sTime & ".evt")
objLogFile.ClearEventLog()
Next
end if

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[TheNewOne]

Thx markdmac for your solution. Script works great. Thx

 

[TechieMan]

Cheers Marcdmarc - Also just used your script and it with no problems!

 

[Hiyahoo]

I tried it, GREAT!!
Many thanks Markdmac.

 

[markdmac]

You are all welcome.

 

[buzzlit]

How would you write a script to query the event log file that was backed up?