+ Post New Thread
Results 1 to 7 of 7
Scripts Thread, Grabbing remote event logs using wevtutil in Coding and Web Development; ...
  1. #1
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    604
    Thank Post
    68
    Thanked 17 Times in 16 Posts
    Rep Power
    20

    Grabbing remote event logs using wevtutil

    Hi,

    I found the below script (Script to collect all event logs off a remote Windows 7 / Server 2008 machine | chentiangemalc) which basically grabs event logs off of a remote machine.
    Code:
    @echo off
    REM GetEventLogs.cmd by Malcolm McCaffery
    SETLOCAL ENABLEDELAYEDEXPANSION
    SET /P remotePC=Please type remote computer name or blank for local computer: 
    IF "%remotePC%" EQU "" set remotePC=%computername%
    REM change this to wherever you want to output the logs
    SET OUTPUTDIR="D:\Temp\RemoteLogs\!remotePC!"
    IF NOT EXIST %OUTPUTDIR% MD %OUTPUTDIR%
    pushd "%OUTPUTDIR%"
    echo Get ALL Event Logs on System
    for /F "delims=\" %%i IN ('wevtutil el /r:%remotePC%') DO (
    echo Retreving Log %%i
    for /F "tokens=1,2 delims=/" %%j IN ("%%i") DO (
       IF "%%k" EQU "" (
        SET OUTPUTFILE=%computername%-%%j.evtx
       ) ELSE (
       SET OUTPUTFILE=%computername%-%%j-%%k.evtx
       )
    )
    wevtutil epl "%%i" "!OUTPUTFILE!" /ow:true /r:%remotePC%
    )
    REM cleanup by deleting any empty event files…
    for /R %%i IN (*.evtx) DO (
      echo Processing %%i
      REM if file is 69,632 bytes or less then delete it – don’t want empty files
      IF %%~zi LEQ 69632 (
        echo empty event file…deleting…
        del "%%i" /q
      )
    )
    popd
    echo.
    echo Completed – events stored in %OUTPUTDIR%
    pause
    However, when run, it'll go through the process of trying to obtain these but shows the message
    Failed to export log "LogName". The system cannot find the path specified
    for each log.

    I'm running this as a domain administrator and the remote even log management exception is in place and have even tried disabling the firewall and rebooting to it still not playing ball.

    I'm drawing a blank on a resolution from web searches so any ideas?

  2. #2
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    604
    Thank Post
    68
    Thanked 17 Times in 16 Posts
    Rep Power
    20
    Anyone?

  3. #3

    X-13's Avatar
    Join Date
    Jan 2011
    Location
    /dev/null
    Posts
    9,839
    Thank Post
    669
    Thanked 2,188 Times in 1,493 Posts
    Blog Entries
    19
    Rep Power
    900
    Batch file?

    !remotePC! needs to be %remotePC% in the output path. [I think... I'm braindead today.]
    Last edited by X-13; 25th February 2014 at 03:45 PM.

  4. #4
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    604
    Thank Post
    68
    Thanked 17 Times in 16 Posts
    Rep Power
    20
    I know but this was this was the source script. I wanted to get this working as intended before PSing it up.

    The Output path works fine in the script. It's the actual wevtutil command that I'm getting this error with however, this looks to be the output destination permissions that's the problem. I've since managed to get the command to run on a remote computer, storing them on it's local disk and then opening this folder to end the script in order to obtain them.

  5. #5

    Join Date
    Aug 2014
    Posts
    1
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0

    Question

    Hello, I'm having the same issue noted in original post. I'm running out of ideas.

    As a domain administrator with an elevated command prompt, I get the following:
    Failed to export log "LogName". The system cannot find the path specified
    Remote Registry service is running. As for firewall, it is controlled by GPO so I am unable to modify at the moment. The Win7 incoming firewall rules for Remote Event Log Management are not turned on so I "believe" this should not be blocking.

    So I tried copying the script to the local machine and using PsExec to launch elevated command prompt as system and also tried with my domain admin account and get the following:
    Failed to open channel enumeration. Access is denied.
    So now it creates the folder however it is empty because it is never able to export the logs. How did you get it to work in your scenario on the targeted remote machine?

    Thanks

  6. #6
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    604
    Thank Post
    68
    Thanked 17 Times in 16 Posts
    Rep Power
    20
    Ended up creating a powershell script to do what I wanted. The following code will export the Application log to the specified location.

    Code:
    wevtutil export-log Application /r: C:\Windows\Temp\ /ow:True
    Obviously replace 'Application' with 'System' respectively.

  7. #7

    Join Date
    Sep 2014
    Posts
    2
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    I'm completely new to this and was wondering if I could just export the logs from the local PC. I have the same script and pretty much lost... anyone wanna give me a quick tutorial??!



SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 10
    Last Post: 4th September 2014, 08:29 PM
  2. Error in event logs - thumbnail generation?
    By agibson in forum Home Access Plus+
    Replies: 3
    Last Post: 29th April 2012, 10:36 PM
  3. CC3 event log Failure Audit
    By superaz300 in forum Windows Server 2000/2003
    Replies: 0
    Last Post: 14th February 2012, 10:43 AM
  4. What Event Log Management Tool do you use?
    By darknova in forum Windows
    Replies: 12
    Last Post: 13th April 2008, 03:57 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •