BackUpAndClearEventLog.ps1<\/B> script is seen here:<\/P>Param($logName = “security”,$backupFolder = “C:\\backupLogs”)<\/p>\nFunction Get-EventLog([string]$logName)\n{\n $log = Get-WmiObject -Class Win32_NTEventLogFile -filter “LogFileName = ‘$logName'”\n If($log.MaxFileSize \/ $log.FileSize -ge 50)\n {\n “Log is half full. Backing up now.”\n Backup-EventLog($log)\n } #end if\n Else \n { \n “Not backed up: $logName is only ” + ($log.MaxFileSize \/ $log.FileSize).tostring(“N2″) + ” percent full” \n } #end else\n} #end Get-EventLog<\/p>\n
Function Backup-EventLog($log)\n{\n $folder = Join-Path -Path $BackUpFolder -ChildPath (Get-Date).ToString(“MMddyy_hhmm”)\n If(-not(Test-Path $folder)) \n { \n New-Item -path $folder -itemtype Directory -force | out-Null\n }\n $rtn = $log.BackupEventLog(“$folder\\$logName.evt”).ReturnValue\n If($rtn -eq 0)\n {\n $log.ClearEventLog() | out-null\n } #end if\n ELSE \n {\n “$logName could not be cleared. Backup ended with $($rtn)” \n }\n} #end Backup-EventLog<\/p>\n
# *** ENTRY POINT ***\nGet-EventLog -logname $logname\n<\/PRE>\n
The first thing that we need to do is to define the command-line parameters that the script will accept. For this script, we wish to accept two input parameters. The first parameter is the name of the log that we will work with. We call this parameter $logname<\/B>. The second parameter we will define is used to specify the path to the backup files. We’ll call this parameter $backupfolder<\/B>. For each of these parameters, we have also defined default values. These default values will be used if the script is called without any modification. This code is seen here:<\/P>Param($logName = “security”,$backupFolder = “C:\\backupLogs”)<\/PRE>\nThe first function that we would like to create is called the Get-EventLog<\/B> function and it receives a single input when the function is called. The input that is stored in the variable $logName<\/B> is a string data type. Because of this we use a type constraint to control the type of data that can be passed to the function. As always when we create a function, we must use the function<\/B> keyword as seen here:<\/P>Function Get-EventLog([string]$logName)\n {\n<\/PRE>\nAfter we begin the function, we now use the Get-WmiObject<\/B> cmdlet with the class parameter to allow us to access the WMI information that is related to the event log. The WMI class that we need to use is the Win32_NTeventlogfile<\/B> class. Because there are a number of the event log files on the computer we need to use the filter parameter to limit our results to only a specific file. To do this we use the Logfilename<\/B> property and specify the name that we have stored in the $logName<\/B> variable. This is seen here:<\/P>$log = Get-WmiObject -Class Win32_NTEventLogFile -filter “LogFileName = ‘$logName'”<\/PRE>\nThe Windows event log we are working with is seen in the Event Viewer utility here:<\/P>![\"Image](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/qanda\/hsg\/2009\/april\/hey0408\/hsg-04-08-09-1.jpg\")
\n
<\/P>\n
After we have stored the WMI object in the $log<\/B> variable, we use the if<\/B> statement and examine the MaxFileSize<\/B> property. We then divide this property value by the FileSize<\/B> property. If the resulting number is greater than 50, we will proceed to back up the file. This is seen here: <\/P>If($log.MaxFileSize \/ $log.FileSize -ge 50)\n {\n<\/PRE>\nThe first thing that we want to do is to provide a status message to the user. In our example, we use a simple string that states the log is half full and we are backing it up now. After we have displayed this information, we call the Backup-EventLog<\/B> function and pass the WMI object that is contained in the $log<\/B> variable to the function. After we have passed the object to the Backup-EventLog<\/B> function, we end our if<\/B> statement by closing the curly brackets. This is seen here:<\/P>“Log is half full. Backing up now.”\n Backup-EventLog($log)\n } #end if\n<\/PRE>\nNow it is time to consider alternative scenarios. If the log is less than half full, we display a status message that states that the log is not backed up. We supply the name of the log and the actual size that is contained in the MaxFileSize<\/B> property of the $log<\/B> object. We then calculate the percentage of the log size in relationship to the maximum file size that the log is permitted to grow. We display a formatted number by using the tostring<\/B> method of the object. Inside the smooth parentheses of the tostring<\/B> method, we use a format specifier from the .NET Framework. The letters used for the format specifier are case sensitive. The capital N<\/B> followed by the number 2<\/B> indicates that the number will be displayed with only two numbers trailing the decimal point. This is shown here: <\/P>Else \n { \n “Not backed up: $logName is only ” + ($log.MaxFileSize \/ $log.FileSize).tostring(“N2″) + ” percent full” \n } #end else\n} #end Get-EventLog\n<\/PRE>\nWe now need to create the Backup\u2013EventLog<\/B> function. To do this we use the Function<\/B> keyword followed by the name of the function that we will create. The Backup\u2013EventLog<\/B> function will accept a single parameter, which is the object that is stored in the $log<\/B> variablevariable: <\/P>Function Backup-EventLog($log)\n{\n<\/PRE>\nNext we need to create the path that will be used to hold the backup file. To do this we use the Join-Path<\/B> cmdlet and use the path parameter to specify the parent folder for the backup. The child folder is created based upon the date. To create the name for the child folder we use the Get\u2013Date<\/B> cmdlet and feed the date time<\/B> object to the tostring<\/B> method. Inside the parentheses of the tostring<\/B> method, we once again use a .NET Framework format specifier. The capital M<\/B> is used to indicate the month, the lowercase d<\/B> is used for the day, and the lowercase y<\/B> indicates the year. The lowercase h<\/B> is the hour and the lowercase m<\/B> stands for the minutes. Because two letters are used in the pattern, it indicates that two numbers will be represented. This is seen here:<\/P>$folder = Join-Path -Path $BackUpFolder -ChildPath (Get-Date).ToString(“MMddyy_hhmm”)<\/PRE>\nIf the folder does not exist, we create it. We use the Test-Path<\/B> cmdlet to see if the folder exists. If the folder does not exist, we use the New-Item<\/B> cmdlet to create the new folder. Because we do not want to see the feedback from the command, we pipeline the output to the Out-Null<\/B> cmdlet:<\/P>If(-not(Test-Path $folder)) \n { \n New-Item -path $folder -itemtype Directory -force | out-Null\n }\n<\/PRE>\nThe BackupEventLog<\/B> method is used to (shocking, we know) back up the event log. The method receives the path as well as the file name and extension for the backup file. When the method is called, it returns an object that indicates the status of the method call. We’re interested in a return code of zero, which means there were no errors. We store the return code in the $rtn<\/B> variable: <\/P>$rtn = $log.BackupEventLog(“$folder\\$logName.evt”).ReturnValue<\/PRE>\nAfter the destination folder has been created and the event log backed up, the directory structure looks similar to the one seen here:<\/P>![\"Image](\"http:\/\/img.microsoft.com\/library\/media\/1033\/technet\/images\/scriptcenter\/qanda\/hsg\/2009\/april\/hey0408\/hsg-04-08-09-2.jpg\")
\n
<\/P>\n
If the $rtn<\/B> variable is equal to zero, we empty the event log by using the ClearEventLog<\/B> method. There are no parameters for this method, so the parentheses used for the method are empty. The ClearEventLog<\/B> method does return an error code; however, we are not interested in this, so we pipeline it to the Out-Null<\/B> cmdlet. This is seen here: <\/P>If($rtn -eq 0)\n {\n $log.ClearEventLog() | out-null\n } #end if\n<\/PRE>\nIf the backup was not successful, the value contained in the $rtn<\/B> variable will not be equal to zero. If this is the case, we do not clear the event log, so we must print a message to this effect: <\/P>ELSE \n {\n “$logName could not be cleared. Backup ended with $($rtn)” \n }\n} #end Backup-EventLog\n<\/PRE>\nWe are now at the entry point to the script. Everything we have seen so far is a lot of preparatory work. The script executes by calling the Get-EventLog<\/B> function and passing the log name, which is contained in the $logname<\/B> variable. This is seen here:<\/P>Get-EventLog -logname $logname<\/PRE>\nWell, DP, we have created a script that looks at the size of an event log, and if the log is more than half full, it backs up the log and then empties it. It was a fun and interesting scenario. Join us tomorrow as we continue with Event Log week. Until then, take care. <\/P>\n
<\/P>\n
Ed Wilson and Craig Liebendorfer, Scripting Guys<\/B><\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! We have recently enabled additional security auditing on our network, and I do not want to increase the size of those logs due to the fact that they are already huge. I do not want to turn on circular logging because I need to keep an audit trail for compliance reasons. I […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[97,98,3,45],"class_list":["post-54013","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-event-logs","tag-logs-and-monitoring","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! We have recently enabled additional security auditing on our network, and I do not want to increase the size of those logs due to the fact that they are already huge. I do not want to turn on circular logging because I need to keep an audit trail for compliance reasons. I […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54013","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=54013"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/54013\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=54013"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=54013"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=54013"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/q-for-powertip.jpg\" "\\"Hey,")
<\/H2>\n![\"Spacer\"](\"https:\/\/devblogs.microsoft.com\/scripting\/wp-content\/uploads\/sites\/29\/2019\/05\/spacer.gif\")
![\"Hey,](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/a-for-powertip.jpg\" "\\"Hey,")
\n