Is it possibile to create a simple way to backup the event log, with such as a batch file or a simple app ? I need to make it working on a customer's site, where the reference is an non-expert user. Thanks
-
If you're using Windows 2008, use the built-in wevtutil command. Example:
wevtutil epl Application c:\temp\foo.evtx
Otherwise, get dumpel.exe from the resource kit, or psloglist from http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx
-
The Microsoft Script Center has some sample code for Backing Up and Clearing Event Logs using VBScript and WMI.
Frank-Peter Schultze's Scripting Site has some code to clear an event log ( http://www.fpschultze.de/uploads/clrevt.vbs.txt) that you can modify to backup or backup then clear.
If you have access to the server you can backup from the Event Viewer by right-clicking on a log and using the "Save Log File As..." command. You can save to a binary, tab delimited or comma delimited file.
-
Finally I made a little winapp using this method found on the internet:
public void DoBackup(string sLogName) { string sBackup = sLogName; // could be for example "Application" EventLog log = new EventLog(); log.Source = sBackup; var query = from EventLogEntry entry in log.Entries orderby entry.TimeGenerated descending select entry; string sBackupName = sBackup+"Log"; var xml = new XDocument( new XElement(sBackupName, from EventLogEntry entry in log.Entries orderby entry.TimeGenerated descending select new XElement("Log", new XElement("Message", entry.Message), new XElement("TimeGenerated", entry.TimeGenerated), new XElement("Source", entry.Source), new XElement("EntryType", entry.EntryType.ToString()) ) ) ); DateTime oggi = DateTime.Now; string sToday = DateTime.Now.ToString("yyyyMMdd_hhmmss"); string path = String.Format("{0}_{1}.xml", sBackupName, sToday); xml.Save(Path.Combine(Environment.CurrentDirectory, path)); }this is the source link:
It simply works great!
-
With powershell and
export-clixmlits oneliner.get-eventlog -list | %{ get-eventlog $_.Log | export-clixml -path ($_.Log + ".xml") }
