Monday, December 1, 2008

VBScript to backup Windows System, Application and Security event logs

To diagnose my crashing Windows 2003 server (Mystic Hare) mentioned previously, I needed to backup the server's System, Application and Security event logs every half hour. At first, I thought of just copying the *.evt files to another location, using the Windows Scheduler. But this might not be the best idea as the latest entries might not be in the event logs. So I clobbered together a VBScript from the following links:
http://msdn.microsoft.com/en-us/library/aa394593.aspx
http://www.microsoft.com/technet/scriptcenter/guide/sas_log_pcna.mspx?mfr=true
http://www.informit.com/content/images/9780672329470/downloads/SPSiteBackup.wsf.txt

The script will backup the event logs using standard WMI methods to "C:\scripts\" and append the current date and time to the saved event log files.

'*******************************************************************
'********************** Begin Script *******************************
'*******************************************************************

dtmThisSecond = PadDigits(Second(Now), 2)

dtmThisMinute = PadDigits(Minute(Now), 2)
dtmThisHour = PadDigits(Hour(Now), 2)
dtmThisDay = PadDigits(Day(Now), 2)
dtmThisMonth = PadDigits(Month(Now), 2)
dtmThisYear = Year(Now)


strBackupName = dtmThisYear & "-" & dtmThisMonth _
& "-" & dtmThisDay & "_" & dtmThisHour & "-" & dtmThisMinute & "-" & dtmThisSecond
strComputer = "."

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup, Security)}!\\" & _
strComputer & "\root\cimv2")


Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='Application'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\" _
& strBackupName & _
"_application.evt")
' WScript.Echo "File saved: " & strBackupName & _
' "_application.evt"
Next

Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='System'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\" _
& strBackupName & _
"_system.evt")
Next



Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile " _
& "Where LogFileName='Security'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\" _
& strBackupName & _
"_security.evt")
Next


'===================================================================
' Functions
'===================================================================
' This function is used to pad date variables that contain only on digit.
Function PadDigits(n, totalDigits)
If totalDigits > len(n) then
PadDigits = String(totalDigits-len(n),"0") & n
Else
PadDigits = n
End If
End Function

'*******************************************************************
'************************ End Script *******************************
'*******************************************************************

PS: The script was only tested on a Windows XP system.

No comments: