Help with VBS script to copy/clear event logs.

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

iSCSIdude

Thread Starter
Account Closed
Joined
Oct 30, 2008
Messages
1
Windows 2003/2008 server event logs automation question.
Okay, I need help! This is my first post, and if I get an answer that resolves it, I swear that I will donate to the site! (okay, I will anyway, but what other motivation could I offer?):)
Problem: I need to collect the system,application and security event logs
from multiple servers that I am testing often. Manually saving the logs and
resetting them is a chore for dozens of systems, each time i run a test.
What I would like is a VBS script that I could call from a shortcut on the
desktop, which points to a COLLECT.VBS script located on a mapped drive. This
would be to allow me to use 1 script on all systems. I could log in and run
it quickly or set it up on the scheduler to run daily.
The code below does the capture and clear of the logs, but i have had to edit one per server. I also have to create a different name or location each time to allow multiple captures to exist together and not overwrite each other.
So, here are the features that I would like some help with how to code a solution to my problem:
1. vbs script called from a desktop icon or tripped off by a daily scheduled
job.
2. must copy then clear the system,security and application logs (code below
does do that, btw)
3. Pickup the system name and date stamp so as to write them on the x:
drive in a location that lets you easily see what they came from and where
they are.
Example- when I click on this from SYSTEM A, it creates the 3 logs they look like this:
/hard coded mapped drive for central storage of logs
| /Name of the System
| | /Name of the Log
| | | /Date (and maybe time?)
| | | |
Z:\drivelogs\SYSTEMAsecuritylog10292008.evt
Z:\drivelogs\SYSTEMAsystemlog10292008.evt
Z:\drivelogs\SYSTEMAapplicationlog10292008.evt
and from SYSTEMB it looks like this:
Z:\drivelogs\SYSTEMBsecuritylog10292008.evt
Z:\drivelogs\SYSTEMBsystemlog10292008.evt
Z:\drivelogs\SYSTEMBapplicationlog10292008.evt

so all the logs can play together in one massive folder on the Z drive. The date on the files will tell me when they were collected.
------------------------------------------------------------
This works to capture and reset the logs...the
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Application'")
For Each objLogfile in colLogFiles
errBackupLog =
objLogFile.BackupEventLog("c:\scripts\ServerAapplicationlog.evt")
If errBackupLog <> 0 Then
Wscript.Echo "The Application event log could not be backed up."
Else
objLogFile.ClearEventLog()
End If
Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Security'")
For Each objLogfile in colLogFiles
errBackupLog =
objLogFile.BackupEventLog("c:\scripts\ServerAsecuritylog.evt")
If errBackupLog <> 0 Then
Wscript.Echo "The Application event log could not be backed up."
Else
objLogFile.ClearEventLog()
End If
Next
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='System'")
For Each objLogfile in colLogFiles
errBackupLog =
objLogFile.BackupEventLog("c:\scripts\ServerAsystemlog.evt")
If errBackupLog <> 0 Then
Wscript.Echo "The Application event log could not be backed up."
Else
objLogFile.ClearEventLog()
End If
Next
----------------------------------------------------------------------

Thanks to any and all that can point me in the right direction. New to VBS scripting and this would really kickstart my use of it.

iSCSIdude
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online

Top