Remote event log auditing

Tech-Archive recommends: Speed Up your PC by fixing your registry

From: Jerad (Jerad_at_discussions.microsoft.com)
Date: 02/10/05 

Date: Thu, 10 Feb 2005 14:11:11 -0800

I am looking for a way to get the audit logs of w2k systems into one central
location. The problem I am having is I can only install the script on one
machine. Is there anyway to make a script go out and pull the security log
files onto a network share?

Here is what I have for a single system....

Set fso = CreateObject("Scripting.FileSystemObject")
strComputer = "."

If fso.FolderExists("C:\Event Log") Then

else fso.CreateFolder ("C:\Event Log")

End if

Set objWMIService = GetObject("winmgmts:" _
    & "{impersonationLevel=impersonate,(Security,Backup)}!\\" & _
        strComputer & "\root\cimv2")

Set colLogFiles = objWMIService.ExecQuery _
    ("Select * from Win32_NTEventLogFile where LogFileName='Security'")

strFilePath = "c:\Event Log\"
strFileExtension = ".evt"
strDate = CStr(Year(Date) * 10000 + Month(Date) * 100 + Day(Date))
strFile = strFilePath & strDate & strFileExtension

For Each objLogfile in colLogFiles
    errBackupLog = objLogFile.BackupEventLog(strFile)
    If errBackupLog <> 0 Then
        Wscript.Echo "The Security event log could not be backed up."
    Else
        objLogFile.ClearEventLog()
    End If

Wscript.Echo "Check out C:\Event Logs."

Next

Relevant Pages

  • EventLog Remote Auditing
    ... I am looking for a way to get the audit logs of w2k systems into one central ... Set fso = CreateObject ... Set colLogFiles = objWMIService.ExecQuery _ ... strFile = strFilePath & strDate & strFileExtension ...
    (microsoft.public.scripting.vbscript)
  • RE: Script to backup all event logs
    ... logs on Windows XP). ... For each objLogfile in objInstalledLogFiles ... Now if it were simple I could just grab the EVT file from ... Set colLogFiles = objWMIService.ExecQuery _ ...
    (microsoft.public.scripting.vbscript)
  • RE: Script to backup all event logs
    ... Rather than grab the events for the previous full month, ... schedule the script to run each month on the 1st and would like to tell it to ... logs on Windows XP). ... Set colLogFiles = objWMIService.ExecQuery _ ...
    (microsoft.public.scripting.vbscript)
  • RE: Script to backup all event logs
    ... logs into CSV files. ... For each objLogfile in objInstalledLogFiles ... I'm trying to write a script that will copy all event logs from a computer ... Set colLogFiles = objWMIService.ExecQuery _ ...
    (microsoft.public.scripting.vbscript)
  • RE: Script to backup all event logs
    ... I'm trying to write a script that will copy all event logs from a computer ... I need it to grab all of the event logs (System, Security, Application, DNS ... Set colLogFiles = objWMIService.ExecQuery _ ... For Each objLogfile in colLogFiles ...
    (microsoft.public.scripting.vbscript)