Windows Forum

Ask something
Discussion Locked

Automating NT to save the eventlog

0 helpful
10 replies

by dsaim 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Can anyone help me out?
I would like to find out how I can save the event log to a file automatically. Is their any utilityor batch command that I can use to do this. I would like to collect EventLog from multiple computer if so posible. I wouldlike to automate this process on a dialy basis.

10 replies

by todd

The event logs are saved in multiple files. They can be found in c:\winnt\system32\config
I would just create a batch file that is scheduled to copy the log files you want to another directory.

by dsaim

I have already tried to copy those events file to a different location but when I tried to open it, it say that it is a corrupted file.

by dsaim

I have already tried to copy those events file to a different location but when I tried to open it, it say that it is a corrupted file.

by mckaytech

I think your answer might be a utility in the NT Resource Kit called dumpel.exe. On the resource kit CD, it's in the /i386/diagnose directory.

This utility can pull the contents of the event logs into a central file. I'm currently working on a project to use this utility to pull the backup entries from 52 servers into a central text file.

Hope this helps!

paul

by dsaim

Sorry, that was just not what i was looking for. I would like to save in an .evt format so I can later on open it with event viewer.

But thank you for your effort.

David

by todd

I tried the same, and it worked for me. I opened event viewer, then selected open log file of the specified type.

by dsaim

I gave it another tried on a different computer and it has the same result. I went into c:\winnt\system32\config\ and founf alt the evt file but was not able to open it. When I try yo open it the error message say 'the event log file is corrupted.
Well you must be doing something right. Please explain further.

Thank you,

David

by todd

Ok. Exact Specifics. 1st I am running windows 2000 server.

I open event viewer. Click on Action, Open log file. Browse to winnt/system32/config.
Select the Sysevent.evt file and select log type as SYSTEM. and it opens up as a saved event log file.

Hmm. just tried something new. I made a copy of the evt file and tried to open the copy, and got the same error you did.

Interesting.
Let me play some more. I'll let you know my results.

by dsaim

WEll thank you for trying to find the solution for my problem. I appreciate all the helps.

by mike.phillips

There are a couple of freeware utilities I'm evaluating to automate an Event Log download to a database: 1) Exporter (Adkins Resource/www.adkins-resource.com) which has an easy-to-use command line structure, and 2) DumpEVT (Somarsoft/www.systemtools.com/somarsoft)which is also run from a command line.

I haven't worked out all the details, but both programs do a good job of exporting the logs to text files. Now all I've got to do is automate the importing of the text files into an MS Access database. ;)

This discussion is closed to new replies.