Event log export

[aquila125]

Hi all,

thanks to a SAS70 audit, we need to log almost all of the security events (and keep them for half a year). This means we get about 25000 events each day in our event logs.
Is there a way to export these events to a txt file so we can let this script run every day (export to 20050714.evt or something)? Our logs are growing too fast.

Any other insights on this?

Thanks!

Sebastian

 

[aftertaf]

you can make your logs bigger...

but you can also export them to csv, text or .evt format.

.evt format is the only one in which you can reimport into the event viewer for viewing...
rightclick the log and save as.. (i think)

Aftertaf
We shall prevail, and they shall not

 

[aquila125]

Isn't there a script that can do this? I would like to automate the process of exporting the data...

 

[wcburton]

Microsoft Technet Script Center has some examples of using scripting to gather data from event logs.

http://www.microsoft.com/technet/scriptcenter/scripts/default.mspx

Link goes to the main page of the VBS repository. Logs section has many examples that will teach you backing up, clearing, filtering for certain events, and copying to database.

Check the VBScript forum for more help on scripting.

http://www.tek-tips.com/threadminder.cfm?pid=329