Event, System, Application Logs

[Richard]

I have a single RAM EWF protected Partition, and the second none protected
device is simply a USB Pen Drive.

Is it possible to have my application Zip up copies of these logs every so
often and store them to the Pen Drive. I'd rather not have them reside
there full time so I do not want to change the permanant location of them.

I already do this with numerous logs generated by my application, I zip them
up by day and then keep so many days available before they're disposed of.
Since these are un-manned systems in the middle of no-where, we have those
logs on hand in case we need to perform any type of troubleshooting.

Richard

 

[KM]

Richard,

Why not? You can just copy the files (they are locked at run time by the EvenLog service from any writes but you can read them just
fine).

Or you can backup the logs programmatically.
E.g., using Advanced32 API: BackupEventLog
Or WMI: BackupEventlog Method of the Win32_NTEventlogFile Class.