Home
%3CLINGO-SUB%20id%3D%22lingo-sub-707850%22%20slang%3D%22en-US%22%3EScript%20to%20backup%20event%20logs%20using%20a%20server%20list%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-707850%22%20slang%3D%22en-US%22%3E%3CH1%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20inherit%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%20light%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bsegoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bsans-serif%26amp%3Bquot%3B%3B%20font-size%3A%2036px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20500%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.1%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%2020px%200px%2010px%200px%3B%22%20id%3D%22toc-hId-1984456830%22%20id%3D%22toc-hId-1984456830%22%3ESummary%3C%2FH1%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3EHave%20you%20ever%20needed%20to%20back%20up%20event%20logs%20for%20root%20cause%20analysis%20or%20auditing%3F%20Did%20you%20access%20each%20server%20and%20manually%20export%20the%20requested%20log%20file%3F%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3EIf%20yes%2C%20I%20hope%20you%20find%20this%20script%20handy.%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20inherit%3B%20font-family%3A%20inherit%3B%20font-size%3A%2036px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20500%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.1%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%2020px%200px%2010px%200px%3B%22%20id%3D%22toc-hId--567700131%22%20id%3D%22toc-hId--567700131%22%3EThe%20Script%3C%2FH1%3E%0A%3CPRE%3E%23%20Specify%20which%20Log%20File%0A%24EventLogName%20%3D%20%E2%80%9CApplication%E2%80%9D%0A%0A%23%20Specify%20drive%20to%20store%20event%20logs%0A%24drive%3D%20%E2%80%9Cc%24%E2%80%9D%0A%0A%23%20Specify%20server%20to%20store%20event%20logs%0A%24dest%20%3D%20%22SERVERNAME%22%0A%0A%23Simple%20Server%20list%0A%24servers%20%3D%20Get-Content%20C%3A%5Cservers.txt%0A%23%20For%20loop%20to%20do%20the%20work%0Aforeach%20(%24server%20in%20%24servers)%0A%7B%0A%0A%23%20Create%20a%20target%20folder%20on%20host%20if%20does%20not%20exist%0A%20%24TARGETROOT%20%3D%20%22%5C%5C%24server%5C%24drive%5Clogs%22%0A%20if(!(Test-Path%20-Path%20%20%24TARGETROOT))%7B%0A%20New-Item%20-ItemType%20directory%20-Path%20%20%24TARGETROOT%0A%20%7D%0A%20%0A%23%20This%20is%20the%20WMI%20call%20to%20select%20the%20application%20log%20from%20each%20server%0A%24logFile%20%3D%20Get-WmiObject%20-EnableAllPrivileges%20-ComputerName%20%24server%20Win32_NTEventlogFile%20%7C%20Where-Object%20%7B%24_.logfilename%20-eq%20%24EventLogName%7D%0A%0A%23%20Creating%20a%20file%20name%20based%20on%20server%2C%20log%20and%20time%0A%24exportFileName%20%3D%20%24server%20%2B%20%E2%80%9C_%E2%80%9D%20%2B%20%24EventLogName%20%2B%20%E2%80%9C_%E2%80%9D%20%2B(get-date%20-f%20yyyyMMdd)%20%2B%20%E2%80%9C.evt%E2%80%9D%0A%0A%23%20Perform%20the%20backup%0A%24logFile.backupeventlog(%24TARGETROOT%20%2B%20%E2%80%9C%5C%E2%80%9D%20%2B%20%24exportFileName)%0A%0A%23%20Create%20an%20export%20folder%20if%20it%20does%20not%20exist%0A%24target%20%3D%20%22%5C%5C%24dest%5C%24drive%5Clogs%5Cexport%22%0A%20if(!(Test-Path%20-Path%20%20%24target))%7B%0A%20New-Item%20-ItemType%20directory%20-Path%20%24target%0A%20%7D%0A%0A%23%20Since%20WMI%20does%20the%20work%20on%20the%20remote%20machine%20you%20can%E2%80%99t%20copy%20to%20file%20share.%0A%23%20This%20is%20a%20workaround%20to%20move%20to%20files%20to%20a%20single%20location%20after%20the%20backup%0AMove-Item%20%24TARGETROOT%5C%24exportFileName%20%24target%0A%7D%20%3C%2FPRE%3E%0A%3CH1%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20inherit%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%20light%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bsegoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bhelvetica%26amp%3Bquot%3B%2C%26amp%3Bquot%3Bsans-serif%26amp%3Bquot%3B%3B%20font-size%3A%2036px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20500%3B%20letter-spacing%3A%20normal%3B%20line-height%3A%201.1%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%2020px%200px%2010px%200px%3B%22%20id%3D%22toc-hId-1175110204%22%20id%3D%22toc-hId-1175110204%22%3EWhat%20does%20it%20the%20script%20do%3F%3C%2FH1%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3COL%3E%0A%3CLI%20style%3D%22text-align%3A%20left%3B%20color%3A%20%23333333%3B%20text-transform%3A%20none%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20text-decoration%3A%20none%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20-webkit-text-stroke-width%3A%200px%3B%22%3EThis%20script%20will%20read%20a%20list%20of%20servers%20and%20backup%20the%20specified%20event%20logs%20to%20a%20local%20folder%20on%20the%20source%20servers.%3C%2FLI%3E%0A%3CLI%20style%3D%22text-align%3A%20left%3B%20color%3A%20%23333333%3B%20text-transform%3A%20none%3B%20text-indent%3A%200px%3B%20letter-spacing%3A%20normal%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20text-decoration%3A%20none%3B%20word-spacing%3A%200px%3B%20white-space%3A%20normal%3B%20box-sizing%3A%20border-box%3B%20orphans%3A%202%3B%20-webkit-text-stroke-width%3A%200px%3B%22%3EAfter%20the%20backup%20is%20complete%20it%20will%20move%20the%20event%20logs%20files%20to%20network%20share%20specified%20by%20the%20destination%2C%20so%20all%20backed%20up%20files%20are%20stored%20in%20a%20single%20location.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3EServer%20List%20and%20Script%20completion%20example%3A%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%3CIMG%20width%3D%22727%22%20height%3D%22349%22%20style%3D%22border-image-outset%3A%200%3B%20border-image-repeat%3A%20stretch%3B%20border-image-slice%3A%20100%25%3B%20border-image-source%3A%20none%3B%20border-image-width%3A%201%3B%20box-sizing%3A%20border-box%3B%20height%3A%20auto%3B%20max-width%3A%20100%25%3B%20vertical-align%3A%20middle%3B%20border%3A%200px%20none%20currentColor%3B%22%20alt%3D%22%22%20src%3D%22https%3A%2F%2Fi1.wp.com%2Fmikesblogs.net%2Fwp-content%2Fuploads%2F2019%2F06%2F060619_0200_Scripttobac1.png%3Fw%3D1280%26amp%3Bssl%3D1%22%20border%3D%220%22%20%2F%3E%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3EI%20hope%20you%20find%20this%20useful%20the%20next%20time%20you%20need%20to%20backup%20event%20logs%20from%20multiple%20servers.%3C%2FP%3E%0A%3CP%20style%3D%22box-sizing%3A%20border-box%3B%20color%3A%20%23333333%3B%20font-family%3A%20%26amp%3Bquot%3B%20segoe%20ui%26amp%3Bquot%3B%2Ctahoma%2Carial%2C%26amp%3Bquot%3Bhelvetica%20neue%26amp%3Bquot%3B%2Chelvetica%2Csans-serif%3B%20font-size%3A%2014px%3B%20font-style%3A%20normal%3B%20font-variant%3A%20normal%3B%20font-weight%3A%20400%3B%20letter-spacing%3A%20normal%3B%20orphans%3A%202%3B%20text-align%3A%20left%3B%20text-decoration%3A%20none%3B%20text-indent%3A%200px%3B%20text-transform%3A%20none%3B%20-webkit-text-stroke-width%3A%200px%3B%20white-space%3A%20normal%3B%20word-spacing%3A%200px%3B%20margin%3A%200px%200px%2010px%200px%3B%22%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-707850%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESharePoint%20On-Prem%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Support%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E

Summary

Have you ever needed to back up event logs for root cause analysis or auditing? Did you access each server and manually export the requested log file?

 

If yes, I hope you find this script handy.

 

The Script

# Specify which Log File
$EventLogName = “Application”

# Specify drive to store event logs
$drive= “c$”

# Specify server to store event logs
$dest = "SERVERNAME"

#Simple Server list
$servers = Get-Content C:\servers.txt
# For loop to do the work
foreach ($server in $servers)
{

# Create a target folder on host if does not exist
 $TARGETROOT = "\\$server\$drive\logs"
 if(!(Test-Path -Path  $TARGETROOT)){
 New-Item -ItemType directory -Path  $TARGETROOT
 }
 
# This is the WMI call to select the application log from each server
$logFile = Get-WmiObject -EnableAllPrivileges -ComputerName $server Win32_NTEventlogFile | Where-Object {$_.logfilename -eq $EventLogName}

# Creating a file name based on server, log and time
$exportFileName = $server + “_” + $EventLogName + “_” +(get-date -f yyyyMMdd) + “.evt”

# Perform the backup
$logFile.backupeventlog($TARGETROOT + “\” + $exportFileName)

# Create an export folder if it does not exist
$target = "\\$dest\$drive\logs\export"
 if(!(Test-Path -Path  $target)){
 New-Item -ItemType directory -Path $target
 }

# Since WMI does the work on the remote machine you can’t copy to file share.
# This is a workaround to move to files to a single location after the backup
Move-Item $TARGETROOT\$exportFileName $target
} 

What does it the script do?

 

  1. This script will read a list of servers and backup the specified event logs to a local folder on the source servers.
  2. After the backup is complete it will move the event logs files to network share specified by the destination, so all backed up files are stored in a single location.

 

Server List and Script completion example:

 

I hope you find this useful the next time you need to backup event logs from multiple servers.