Posted By

Rectifier on 07/01/12


Tagged

event clear delete windows save batch dos export logs


Versions (?)

Save (and clear) Windows Event Logs


 / Published in: DOS Batch
 

Uses the sysinternals (microsoft) utility PsLogList to save specified event logs to files and then clears them. Method can be used to save logs as .evt and .evtx. This script has four event logs listed as an example and has a template command commented. Tested on a local windows 7 machine, but should work for xp, server 2k3 and 2k8.

  1. @echo off
  2. @cls
  3. ::Originally written by the user wesil on spiceworks.com
  4. ::Modified by Rectifier 06-30-2012
  5. ::This batch requires you to download the sysinternals (microsoft) utility psloglist
  6. ::Try http://technet.microsoft.com/en-us/sysinternals or google psloglist
  7.  
  8. ::Tested on a local machine using psloglist.exe version 2.71 on Windows 7 x64 Home Premium
  9. ::Use the ping command to wait from XP onward, timeout works for server 2k3
  10. ::The -g switch only works after the -c switch; this saves the log to file and clears it
  11.  
  12. ::You can change the file extension from evt (older) to evtx (newer) and vice versa
  13.  
  14. ::Change pstooldir to where psloglist.exe is located
  15. set pstooldir=C:\PSTools
  16. cd /d %pstooldir%
  17. ::Error handling
  18. if not exist psloglist.exe goto ERR0
  19. if not exist "Event Logs" md "Event Logs"
  20. if not exist "Event Logs" goto ERR1
  21. ::Change logdir to where you want to save the event logs
  22. set logdir=C:\Event Logs
  23. ::Template command for saving an event log:
  24. ::psloglist.exe -s -c -g "yourdir\filename %date:~4,2%-%date:~7,2%-%date:~10,4%.extension" "log name"
  25. ::Saved files appear as "filename MM-DD-YYYY.extension" without quotations
  26.  
  27. ::Exports to file and then clears the following event logs
  28. psloglist.exe -s -c -g "%logdir%\Security %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Security
  29. psloglist.exe -s -c -g "%logdir%\Application %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Application
  30. psloglist.exe -s -c -g "%logdir%\System %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" System
  31. psloglist.exe -s -c -g "%logdir%\Internet Explorer %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" "Internet Explorer"
  32. goto end
  33.  
  34. :ERR0
  35. echo psloglist.exe not found !
  36. ping 127.0.0.1 -n 2 >nul
  37. goto emd
  38.  
  39. :ERR1
  40. echo Can't create folder "Event Logs"
  41. ping 127.0.0.1 -n 2 >nul
  42. goto end
  43.  
  44. :end
  45. ::Uncomment the pause to view the output before ending the batch file
  46. ::pause
  47. exit /b

Report this snippet  

You need to login to post a comment.