## UPDATED… ADDED a EVT format Script as Well ##
I saw a post on EE that backups up the eventlogs on Server using VBScript… I wanted to see what I could do with Powershell and this is what I came up with. I put this together pretty quick, so not much Error checking or anything, but the vbscript was 207 lines long without comments.
Basically it does the following
- Takes a BackupLoccation as a Parameter
- Takes a List file or a -FromAD switch
– List gets the computers from a file
– FromAD gets computers from AD
- Creates a Backup folder Named -Logs-
– Like Server1-Logs-09110750
- Processes Each Event Log and backs up to a File
- Clears Log
- I put the output of the script on the bottom.
- NOTE: Security Logs Take awhile. I assume this because I am Generating Events by Reading the Log.
Param($BackupLocation,
$list,
$FromAD)
function Get-ADComputers{
$filter =
"(&(objectcategory=computer))"
$root =
[ADSI
]""
$props =
"dNSHostName",
"sAMAccountName"
$Searcher =
new-Object System.
DirectoryServices.
DirectorySearcher($root,
$filter,
$props)
$Searcher.
PageSize =
1000
$Computers =
$Searcher.
findAll() |
%{$_.
properties[‘dnshostname’]}
$Computers
}
function Ping-Server {
Param([string]$server)
$pingresult =
Get-WmiObject win32_pingstatus
-f "address=’$Server’"
if($pingresult.
statuscode -eq 0) {$true} else {$false}
}
if($FromAD){$computers = Get-ADComputers}
else{if($list){$computers = get-Content $list}else{Write-Host "Please Provide List";return}}
foreach($computer in $computers)
{
$Folder = "{2}\{1}-Logs-{0:MMddyymm}" -f [DateTime]::now,$computer,$backupLocation
Write-Host "+ Processing Server $Computer"
new-Item $folder -type Directory -force | out-Null
if(Ping-Server $computer)
{
Write-Host " + Created Backup Folder $folder"
$eventlogs = [System.Diagnostics.EventLog]::GetEventLogs($computer)
foreach($log in $eventlogs)
{
$LogFile = "{0}\{1}.csv" -f $Folder,$log.Log
Write-Host " + Processing $($log.Log) Log"
Write-Host " - Backing up $($log.Log)"
$logEntries = $log.Entries | %{"{0},{1},{2},{3},{4}" -f $_.TimeGenerated,$_.EntryType,$_.Source,$_.EventID,$_.Message}
$logEntries | out-File $LogFile -enc ASCII -width 500
Write-Host " - Backed up to $logFile"
Write-Host " - Clearing Log $($Log.Log)"
$log.Clear()
}
Write-Host
}
else
{
Write-Host "Server $Computer failed PING!" -foregroundcolor red
}
}
For those that perfer EVT format and WMI…. I left the Clear part commented
Param($BackupLocation,
$list,
$FromAD)
function Get-ADComputers{
$filter = "(&(objectcategory=computer))"
$root = [ADSI]""
$props = "dNSHostName","sAMAccountName"
$Searcher = new-Object System.DirectoryServices.DirectorySearcher($root,$filter,$props)
$Searcher.PageSize = 1000
$Computers = $Searcher.findAll() | %{$_.properties[‘dnshostname’]}
$Computers
}
function Ping-Server {
Param([string]$server)
$pingresult = Get-WmiObject win32_pingstatus -f "address=’$Server’"
if($pingresult.statuscode -eq 0) {$true} else {$false}
}
if($FromAD){$computers = Get-ADComputers}
else{if($list){$computers = get-Content $list}else{Write-Host "Please Provide List";return}}
foreach($computer in $computers)
{
if(ping-server $computer)
{
$Folder = "{1}-Logs-{0:MMddyymm}" -f [DateTime]::now,$computer
Write-Host "+ Processing Server $Computer"
New-Item "$backupLocation\$folder" -type Directory -force | out-Null
If(!(Test-Path "\\$computer\c$\LogBackups")){New-Item "\\$computer\c$\LogBackups" -type Directory -force | out-Null}
$Eventlogs = Get-WmiObject Win32_NTEventLogFile -ComputerName $computer
Foreach($log in $EventLogs)
{
$path = "\\{0}\c$\LogBackups\{1}.evt" -f $Computer,$log.LogFileName
$result = ($log.BackupEventLog($path)).ReturnValue
Copy-Item $path -dest "$backupLocation\$folder" -force
#if($result -eq 0){$log.ClearEventLog()}
}
}
}
NOTE: Shortly after writing this… I found this little tibit… it seems to have been around since SP3 of Win2000
Found it Here
http://blogs.msdn.com/spatdsg/default.aspx
AutoBackupLogFiles – backs up the event logs “Using this entry causes the Event Log service to automatically clear a full event log and to back up the log file. ”
http://support.microsoft.com/kb/312571
tshell :: Sep.12.2007 ::
.NET, functions, HowTo, Powershell, Scripting ::
5 Comments »
