Return to Snippet

Revision: 58201
at July 1, 2012 03:54 by Rectifier

Initial Code
@echo off
::Originally written by the user wesil on
::Modified by Rectifier 06-30-2012
::This batch requires you to download the sysinternals (microsoft) utility psloglist
::Try or google psloglist

::Tested on a local machine using psloglist.exe version 2.71 on Windows 7 x64 Home Premium
::Use the ping command to wait from XP onward, timeout works for server 2k3
::The -g switch only works after the -c switch; this saves the log to file and clears it

::You can change the file extension from evt (older) to evtx (newer) and vice versa

::Change pstooldir to where psloglist.exe is located
set pstooldir=C:\PSTools
cd /d %pstooldir%
::Error handling
if not exist psloglist.exe goto ERR0
if not exist "Event Logs" md "Event Logs"
if not exist "Event Logs" goto ERR1
::Change logdir to where you want to save the event logs
set logdir=C:\Event Logs
::Template command for saving an event log:
::psloglist.exe -s -c -g "yourdir\filename %date:~4,2%-%date:~7,2%-%date:~10,4%.extension" "log name"
::Saved files appear as "filename MM-DD-YYYY.extension" without quotations

::Exports to file and then clears the following event logs
psloglist.exe -s -c -g "%logdir%\Security %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Security
psloglist.exe -s -c -g "%logdir%\Application %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" Application
psloglist.exe -s -c -g "%logdir%\System %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" System
psloglist.exe -s -c -g "%logdir%\Internet Explorer %date:~4,2%-%date:~7,2%-%date:~10,4%.evtx" "Internet Explorer"
goto end

echo. & echo.
echo psloglist.exe not found !
ping -n 2 >nul
goto emd

echo. & echo.
echo Can't create folder "Event Logs"
ping -n 2 >nul
goto end

::Uncomment the pause to view the output before ending the batch file
exit /b

Initial URL

Initial Description
Uses the sysinternals (microsoft) utility PsLogList to save specified event logs to files and then clears them. Method can be used to save logs as .evt and .evtx. This script has four event logs listed as an example and has a template command commented. Tested on a local windows 7 machine, but should work for xp, server 2k3 and 2k8.

Initial Title
Save (and clear) Windows Event Logs

Initial Tags
event, windows

Initial Language
DOS Batch