+ Post New Thread
Results 1 to 4 of 4
Scripts Thread, Grabbing remote event logs using wevtutil in Coding and Web Development; Hi, I found the below script ( Script to collect all event logs off a remote Windows 7 / Server ...
  1. #1
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    594
    Thank Post
    66
    Thanked 16 Times in 15 Posts
    Rep Power
    19

    Grabbing remote event logs using wevtutil

    Hi,

    I found the below script (Script to collect all event logs off a remote Windows 7 / Server 2008 machine | chentiangemalc) which basically grabs event logs off of a remote machine.
    Code:
    @echo off
    REM GetEventLogs.cmd by Malcolm McCaffery
    SETLOCAL ENABLEDELAYEDEXPANSION
    SET /P remotePC=Please type remote computer name or blank for local computer: 
    IF "%remotePC%" EQU "" set remotePC=%computername%
    REM change this to wherever you want to output the logs
    SET OUTPUTDIR="D:\Temp\RemoteLogs\!remotePC!"
    IF NOT EXIST %OUTPUTDIR% MD %OUTPUTDIR%
    pushd "%OUTPUTDIR%"
    echo Get ALL Event Logs on System
    for /F "delims=\" %%i IN ('wevtutil el /r:%remotePC%') DO (
    echo Retreving Log %%i
    for /F "tokens=1,2 delims=/" %%j IN ("%%i") DO (
       IF "%%k" EQU "" (
        SET OUTPUTFILE=%computername%-%%j.evtx
       ) ELSE (
       SET OUTPUTFILE=%computername%-%%j-%%k.evtx
       )
    )
    wevtutil epl "%%i" "!OUTPUTFILE!" /ow:true /r:%remotePC%
    )
    REM cleanup by deleting any empty event files…
    for /R %%i IN (*.evtx) DO (
      echo Processing %%i
      REM if file is 69,632 bytes or less then delete it – don’t want empty files
      IF %%~zi LEQ 69632 (
        echo empty event file…deleting…
        del "%%i" /q
      )
    )
    popd
    echo.
    echo Completed – events stored in %OUTPUTDIR%
    pause
    However, when run, it'll go through the process of trying to obtain these but shows the message
    Failed to export log "LogName". The system cannot find the path specified
    for each log.

    I'm running this as a domain administrator and the remote even log management exception is in place and have even tried disabling the firewall and rebooting to it still not playing ball.

    I'm drawing a blank on a resolution from web searches so any ideas?

  2. #2
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    594
    Thank Post
    66
    Thanked 16 Times in 15 Posts
    Rep Power
    19
    Anyone?

  3. #3

    X-13's Avatar
    Join Date
    Jan 2011
    Location
    /dev/null
    Posts
    9,033
    Thank Post
    591
    Thanked 1,945 Times in 1,345 Posts
    Blog Entries
    19
    Rep Power
    813
    Batch file?

    !remotePC! needs to be %remotePC% in the output path. [I think... I'm braindead today.]
    Last edited by X-13; 25th February 2014 at 02:45 PM.

  4. #4
    randle's Avatar
    Join Date
    Dec 2006
    Location
    Chelmsford, Essex
    Posts
    594
    Thank Post
    66
    Thanked 16 Times in 15 Posts
    Rep Power
    19
    I know but this was this was the source script. I wanted to get this working as intended before PSing it up.

    The Output path works fine in the script. It's the actual wevtutil command that I'm getting this error with however, this looks to be the output destination permissions that's the problem. I've since managed to get the command to run on a remote computer, storing them on it's local disk and then opening this folder to end the script in order to obtain them.

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 9
    Last Post: 17th October 2012, 12:48 PM
  2. Error in event logs - thumbnail generation?
    By agibson in forum Home Access Plus+
    Replies: 3
    Last Post: 29th April 2012, 09:36 PM
  3. CC3 event log Failure Audit
    By superaz300 in forum Windows Server 2000/2003
    Replies: 0
    Last Post: 14th February 2012, 09:43 AM
  4. What Event Log Management Tool do you use?
    By darknova in forum Windows
    Replies: 12
    Last Post: 13th April 2008, 02:57 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •