Save (and clear) Windows Event Logs

/ Published in: DOS Batch
Save to your folder(s)

Uses the sysinternals (microsoft) utility PsLogList to save specified event logs to files and then clears them. Method can be used to save logs as .evt and .evtx. This script has four event logs listed as an example and has a template command commented. Tested on a local windows 7 machine, but should work for xp, server 2k3 and 2k8.

Copy this code and paste it in your HTML
  1. @echo off
  2. @cls
  3. ::Originally written by the user wesil on
  4. ::Modified by Rectifier 06-30-2012
  5. ::This batch requires you to download the sysinternals (microsoft) utility psloglist
  6. ::Try or google psloglist
  8. ::Tested on a local machine using psloglist.exe version 2.71 on Windows 7 x64 Home Premium
  9. ::Use the ping command to wait from XP onward, timeout works for server 2k3
  10. ::The -g switch only works after the -c switch; this saves the log to file and clears it
  12. ::You can change the file extension from evt (older) to evtx (newer) and vice versa
  14. ::Change pstooldir to where psloglist.exe is located
  15. set pstooldir=C:\PSTools
  16. cd /d %pstooldir%
  17. ::Error handling
  18. if not exist psloglist.exe goto ERR0
  19. if not exist "Event Logs" md "Event Logs"
  20. if not exist "Event Logs" goto ERR1
  21. ::Change logdir to where you want to save the event logs
  22. set logdir=C:\Event Logs
  23. ::Template command for saving an event log:
  24. ::psloglist.exe -s -c -g "yourdir\filename %date:~4,2%-%date:~7,2%-%date:~10,4%.extension" "log name"
  25. ::Saved files appear as "filename MM-DD-YYYY.extension" without quotations
  27. ::Exports to file and then clears the following event logs
  28. psloglist.exe -s -c -g "%logdir%\Security %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Security
  29. psloglist.exe -s -c -g "%logdir%\Application %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Application
  30. psloglist.exe -s -c -g "%logdir%\System %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" System
  31. psloglist.exe -s -c -g "%logdir%\Internet Explorer %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" "Internet Explorer"
  32. goto end
  34. :ERR0
  35. echo psloglist.exe not found !
  36. ping -n 2 >nul
  37. goto emd
  39. :ERR1
  40. echo Can't create folder "Event Logs"
  41. ping -n 2 >nul
  42. goto end
  44. :end
  45. ::Uncomment the pause to view the output before ending the batch file
  46. ::pause
  47. exit /b

Report this snippet


RSS Icon Subscribe to comments

You need to login to post a comment.