Event log backup

Dev Shed Forums Sponsor:

February 22nd, 2012, 07:36 PM

vl654321

Contributing User

Join Date: Apr 2011

Posts: 128

Time spent in forums: 1 Day 2 h 27 m 54 sec
Reputation Power: 3

Event log backup

Hi,
I need a script to do event log backup, system event log only.
I found this script online but when I run it the system.evt file is much smaller than the file I collect manually.
Could you guys help me with this?
Thanks, vl123456

Code:

dtmThisDay = Day(Date)
dtmThisMonth = Month(Date)
dtmThisYear = Year(Date)
strBackupName = dtmThisYear & "_" & dtmThisMonth & "_" & dtmThisDay

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Backup)}!\\" & _
        strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile where LogFileName='System'")

For Each objLogfile in colLogFiles
    objLogFile.BackupEventLog("c:\scripts\" & strBackupName & _
        "_system.evt")
Next

February 26th, 2012, 06:33 PM

vl654321

Contributing User

Join Date: Apr 2011

Posts: 128

Time spent in forums: 1 Day 2 h 27 m 54 sec
Reputation Power: 3

Any help, ideas on this?
Thanks, Vl123456

February 27th, 2012, 12:34 PM

Doug G

Grumpier Old Moderator

Dev Shed God 19th Plane (14000 - 14499 posts)

Join Date: Jun 2003

Posts: 14,238

Time spent in forums: 1 Month 4 Weeks 15 h 7 m 57 sec
Reputation Power: 4445

I don't know, sorry. There should be some documentation on scripting event log backups somewhere in msdn.

__________________
======
Doug G
======
It is a truism of American politics that no man who can win an election deserves to. --Trevanian, from the novel Shibumi

March 3rd, 2012, 07:33 PM

vl654321

Contributing User

Join Date: Apr 2011

Posts: 128

Time spent in forums: 1 Day 2 h 27 m 54 sec
Reputation Power: 3

Thank you Doug!
I found this script and it does what I need.

Code:

dtmThisDay = Day(Date)
dtmThisMonth = Month(Date)
dtmThisYear = Year(Date)
strComputer = "."
strBackupName = dtmThisYear & "_" & dtmThisMonth & "_" & dtmThisDay

strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Backup)}!\\" & _
        strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile where LogFileName='System'")

For Each objLogfile in colLogFiles
    objLogFile.BackupEventLog("c:\scripts\" & strBackupName & _
        "_system.evt")
Next