'name of this script: logarchive.vbs
'-
http://www.ftponline.com/wss/2004_12/magazine/features/kgardinier/page2.aspx'-
http://www.go-itservices.com/Windows_Server_2003_Maintenance_Strategy.pdf'-
http://safari.samspublishing.com/0672326671/index?indexview=L (search: Logs)
strArchiveFolder = "C:\BckEvt"
ServerName = "SrvDC001"
Set WS = CreateObject("Wscript.Shel
l")
Set FSO = CreateObject("Scripting.Fi
leSystemOb
ject")
DateString = CurrentDate()
Purge = False '<--- I changed it to F for testing, it should be*: Purge = True
on error resume next
StartTime = Now
Output "-------------------------
--------"
OutPut "Started at: " & CStr(Now)
Output ""
Set System = GetObject("winmgmts:{(Back
up,Securit
y)}\\" & ServerName & _
"\root\CIMV2")
If Err.Number = 0 Then
Set colLogs = System.ExecQuery("select * from Win32_NTEventLogFile",,48)
For Each refLog In colLogs
LogName = ServerName& "_" & LogFileName(refLog.LogFile
Name) & _
"_" & DateString
If FSO.FileExists(strArchiveF
older & "\" & LogName & ".evt") Then _
FSO.DeleteFile(strArchiveF
older & "\" & LogName & ".evt")
If Purge Then
RetVal = reflog.ClearEventlog(strAr
chiveFolde
r & "\" & LogName & ".evt")
Else
RetVal = reflog.BackupEventlog(strA
rchiveFold
er & "\" & LogName & ".evt")
End If
If RetVal = 0 Then
Output vbTab & "Log was archived in .evt format: " & LogName & ".evt"
If Purge Then Output vbTab & "All events were cleared from the log"
Else
Output vbTab & "Error while archiving in .evt format."
End If
Next
Else
Output vbTab & "Failed connect to the server"
End If
Set colLogs = Nothing
Set refLogs = Nothing
Set System = Nothing
Output "-------------------------
----------
-----"
OutPut "Finished at: " & CStr(Now)
Output ""
Output ""
Set WS = Nothing
' FullLog.Close ???FullLog=unknown
Set FullLog = Nothing
Set FSO = Nothing
Function CurrentDate
Today = Date
If Month(Today) < 10 Then
CurrentDate = "0" & CStr(Month(Today))
Else
CurrentDate = CStr(Month(Today))
End If
If Day(Today) < 10 Then
CurrentDate = CurrentDate & "0" & CStr(Day(Today))
Else
CurrentDate = CurrentDate & CStr(Day(Today))
End If
CurrentDate = CurrentDate & CStr(Year(Today))
If Hour(Time) < 10 Then
CurrentDate = CurrentDate & "0" & CStr(Hour(Time))
Else
CurrentDate = CurrentDate & CStr(Hour(Time))
End If
End Function
Function LogFileName(LogName)
Select Case LogName
Case "Application"
LogFileName = "app"
Case "Directory Service"
LogFileName = "dir"
Case "DNS Server"
LogFileName = "dns"
Case "File Replication Service"
LogFileName = "rep"
Case "Security"
LogFileName = "sec"
Case "System"
LogFileName = "sys"
End Select
End Function
Sub Output(Text)
' wscript.echo text
' FullLog.writeline text ???FullLog=unknown
End Sub