Is it possible to automatically back up the Event Logs? 1

[AJZnSD]

Hello All,

Has anyone seen or know of a program that is capable of Backing up the Event logs automatically within 2k or 2k3?

Thanks in advance,

AJZ

 

[NetIntruder]

I have a script that i use to dump security logs to a network share. You will need to put in a few mods for your environment, but here it is:

Option Explicit
'On Error Resume Next

'Define Variables
Dim strMachine
Dim strArchivePath
Dim strDate
Dim strMoniker
Dim objWMIService
Dim colLogFiles
Dim objLogFile
Dim errBackupLog
Dim objFs
Dim objNetwork
Dim strLocalArchive
Dim strErrorLog
Dim errlog
Dim drv

Const ForReading = 1
Const ForWriting = 2
Const TriStateFalse = 0

drv = "L:"
Set objNetwork = CreateObject("WScript.Network")
Set objFs = CreateObject("Scripting.FileSystemObject")
strMachine = objNetwork.ComputerName
strLocalArchive = "C:\" & makeFileName()
If (objFs.DriveExists(drv)) Then
objNetwork.RemoveNetworkDrive drv
Else
objNetwork.MapNetworkDrive drv,"\\PUTYOURSERVERHERE\SHARENAME"
End If
strArchivePath = drv & "\"

Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate,(Backup)}!\\" & strMachine & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery("Select * from Win32_NTEventLogFile where LogFileName='Security'")
For Each objLogfile in colLogFiles
errBackupLog = objLogFile.BackupEventLog(strLocalArchive)
If errBackupLog <> 0 Then
strErrorLog = "C:\Error-" & strMachine & "-" & Month(Now) & "-" & Day(Now) & "-" & Year(Now) & "-"& Hour(Now) & "-"& Minute(Now) & ".log"
Set errlog = objFs.OpenTextFile(strErrorLog, ForWriting, True)
errlog.WriteLine "an error occured backing up the security logs on " & strMachine
errlog.Close
objFs.MoveFile strErrorLog,strArchivePath
Else
objLogFile.ClearEventLog()
objFs.MoveFile strLocalArchive,strArchivePath
End If
Next
objNetwork.RemoveNetworkDrive drv

Function makeFileName()
makeFileName = strMachine & "-Security-" & Month(Now) & "-" & Day(Now) & "-" & Year(Now) & "-"& Hour(Now) & "-"& Minute(Now) & ".evt"
End Function

~Intruder~
CEH, MCSA/MCSE 2000/2003

"The Less You Do, The Less Can Go Wrong"

 

[AJZnSD]

NetIntruder,
Thanks for the post! I will give this a shot.

AJZ

 

[NetIntruder]

be aware that i have the script set to export then clear the log - this may or may not be what you want... adjust accordingly!!!

~Intruder~
CEH, MCSA/MCSE 2000/2003

"The Less You Do, The Less Can Go Wrong"