Event Viewer - scheduling backups of event logs

[Wayne]

Hi

I created a VBS Windows Host Script to backup the security
log on a server. It backs up the file, but when I try to
open it in Event Viewer, I get the error:

Unable to complete the operation on "Saved System
Log" The event log file is corrupted.

I also tried going into c:\WINNT\system32\config\ myself.
I copied the security log, and tried opening it in event
viewer. I got the same error message.

Does the event log service need to be temporarily stopped
while I make copies of the event logs? If so, I wonder how
I can do that using VBS scripting?


Here is my code:

Dim FSO, MyDate
Set FSO = CreateObject("Scripting.FileSystemObject")
MyDate = Month(now) & "-" & Day(now) & "-" & Year(now)

FSO.CopyFile "c:\WINNT\system32
\config\SecEvent.Evt", "e:\Security Log Archive\" & _
MyDate & " SecEvent.Evt"

Set FSO = Nothing
Set MyDate = Nothing
WScript.Quit(1)

 

[Carrie Garth \(MVP\)]

Hi Wayne,

The TechNet Script Center has a WMI script to Backup and Clear an Event Log. For
more information, see:

TechNet Script Center: Backup and Clear an Event Log
http://www.microsoft.com/technet/scriptcenter/logs/scrlog04.asp

And if you have any more questions about scripting, I suggest you post to the
microsoft.public.windows.server.scripting , as noted on the Web Page with the "Backup
and Clear an Event Log" script.

--
Carrie Garth, Microsoft MVP for Windows 2000
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- c x g

: "Wayne" <deskpost45 AT hotmail DOT com>
: Wrote in message : Sent: Tuesday, July 22, 2003 02:00 PM
: Hi
:
: I created a VBS Windows Host Script to backup the security
: log on a server. It backs up the file, but when I try to
: open it in Event Viewer, I get the error:
:
: Unable to complete the operation on "Saved System
: Log" The event log file is corrupted.
:
: I also tried going into c:\WINNT\system32\config\ myself.
: I copied the security log, and tried opening it in event
: viewer. I got the same error message.
:
: Does the event log service need to be temporarily stopped
: while I make copies of the event logs? If so, I wonder how
: I can do that using VBS scripting?
:
:
: Here is my code:
:
: Dim FSO, MyDate
: Set FSO = CreateObject("Scripting.FileSystemObject")
: MyDate = Month(now) & "-" & Day(now) & "-" & Year(now)
:
: FSO.CopyFile "c:\WINNT\system32
: \config\SecEvent.Evt", "e:\Security Log Archive\" & _
: MyDate & " SecEvent.Evt"
:
: Set FSO = Nothing
: Set MyDate = Nothing
: WScript.Quit(1)

 

[Harald Bilke]

Hi/2

You don't have always use that VBS-sc...

Somarsoft has a prefectly working DUMPEVT tool that may be perfectly
scheduled w/taskplaner or AT.
BTW: Somarsoft has some free tools like DUMPSEC (Dumps ACLs of all
kinds) that are a must for an Admin.


There is even a DUMPEL on the Reskit (both NT4 and W2k variants).


So why bother and use VBS or WSH ????