topic Re: Eventvwr command line in Windows Server 2003

Eventvwr command line

Edgar Zapata — Thu, 20 Dec 2007 16:00:43 GMT

Hi,

Is there a way to get eventvwr save either Application or System LOG through a DOS command?

Thanks.

Re: Eventvwr command line

Daniel Leblanc — Thu, 20 Dec 2007 18:06:41 GMT

Why do you want this?

Dan

Re: Eventvwr command line

Edgar Zapata — Thu, 20 Dec 2007 18:25:10 GMT

Hi,
We need to automate as much as possible the collecting of data when an incident ocurrs.

We are having a recurrent incident and we need to stablish a pattern of behavior.

Thanks.

Re: Eventvwr command line

Daniel Leblanc — Thu, 20 Dec 2007 19:03:37 GMT

Did you try think of applying HP SIM or if you need Event Sentry is a good monitoring for event ,but but if i knew what was you want to get info,Event sentry cost $ and HP Sim is free and very powerfull (easy to use)is can monitore Hardware problem and software, it can even warn you when a service goes down or up.

Dan

Re: Eventvwr command line

clausw — Fri, 21 Dec 2007 05:18:07 GMT

definitly yes,
pleas checke the Help and Support Center on your Windwos 2003 Server and search for Command-line reference A-Z.
There you can find under e "Eventcreate"; "Eventquery"; "Eventtriggers"; "Eventcmd".
I think these are helpful tools, but dont forget to WSH (Windows Scripting Host) and the new Windows Powershell (this will be the future environment for scripting Windows Systems and will be so powerful as UNIX-Shell).

Re: Eventvwr command line

Peter Turek — Fri, 21 Dec 2007 14:09:48 GMT

Your best bet really is just to get an event log archiver/analyzer. They vary widely in price and capability and the one that I like by far is manage engine event log analyzer. http://manageengine.adventnet.com/products/eventlog/index.html

This product also analyzes events and can alert on them but if you're really interested in that, get something like MS MOM/SCOM (HP openview is, err, expensive and more complex but competes with SCOM). Its cheap compared to others and free for 5 hosts.

It runs a service on a central host that polls remote servers (and it can syslog firewalls, etc) say every 5 min and sucks up events. Then pushes to a mysql database to store events and can archive them out from that db to .zip files which can be imported later. You can then keep the storage requirements down.

The thing I like most is that since it's in a real database you can use both the standard reports with the product as well as write your own SQL queries if you like to get just about anything you want.

This is all important because some servers can literally blow through a 100mb limit on a log file in hours so it's good to know you've got everything. You can go back 3 months ago to see who deleted a file etc. Nice.

Re: Eventvwr command line

Lucky Luciano — Tue, 19 Feb 2008 20:56:05 GMT

strComputer = "."

dtmThisMonth = Month(Date)-1
strBackupName = dtmThisMonth
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
("Select * from Win32_NTEventLogFile where LogFileName='Security'")
For Each objLogfile in colLogFiles
objLogFile.BackupEventLog("c:\scripts\results\" & strBackupName & _
"_security.evt")
objLogFile.ClearEventLog()
Next

Re: Eventvwr command line

Peter Turek — Tue, 19 Feb 2008 21:12:02 GMT

You can also use the resource kit utility called dumpEL. This dumps to csv and other formats. easy to use from cmd.

Re: Eventvwr command line

Edgar Zapata — Tue, 19 Feb 2008 23:41:02 GMT

Thank you all.
Lots of information to manage.
I didn't know about the dumpEL.exe utility.

Thanks again.

Re: Eventvwr command line

Gfuss — Wed, 27 Feb 2008 12:32:37 GMT

Edgar,
Not sure if you are looking for a pay vs. free product, but I have used GFi EventsManager.

http://www.gfi.com/eventsmanager/

Like most of these products, it runs on SQL and has a Web-based front end making it accessible from anywhere.

The nice thing about a product like this (or any of the others mentioned), Edgar, is that it will go and collect all logs from all of your servers and store them in a central location. This is better for security (the logs are no longer on the remote system), management, being proactive, etc.

I also currently use HP SIM and find it an excellent free solution for inventory, alerting, reporting, etc.

Re: Eventvwr command line

Edgar Zapata — Thu, 28 Feb 2008 11:36:58 GMT

I was looking for a command line utility, so dumpel is what I was looking for.

Tnks.