Backup and clear EventLogs and move to an AWS S3 Bucket. Keeps the last XX days of backups locally. #Utility #Public #S3 #BackUp #Event_Log #AWS #Windows

eventlog_S3_backup_purge.ps1

# eventlog_S3_backup_purge.ps1
<#
Description: Backup and clear EventLogs and move to an AWS S3 Bucket. Keeps the last XX days of backups locally.
Written: Ed Walsh
PowerShell.Core tested: Not Tested
Version: 1.0.0
Create Date: 10/6/2021
Revised Date: 10/6/2021
#>
#

$server = Hostname
#EventLogs to Backup and Purge
$ELNames = "Security", "Application", "Setup", "System"


#Backup/Purge the Event Logs Loop

foreach ($elname in $ElNames) {
    $folderpath = "c:\logs\eventlogs\$server"
    $elFile = "$(get-date -f yyyyMMdd-hhmm)_$server-$elname.evtx"
    $fullpath = Join-Path $folderpath $elFile

    ##Check if $folderpath exists, if it doesnt create it. 
    If (-not(Test-Path -Path $folderpath))
    { New-Item -ItemType Directory -Force -Path $folderpath }

    #Backup and Clear the Event Log
    wevtutil cl $Elname /bu:$fullpath  


    #S3 File Move
       
    # accessKey and secretKey can be removed below and from Write-S3Object if running on an EC2 instance and using IAM roles for security.
    $accessKey = "<AccessKey here>"
    $secretKey = "<SecretKey Here>"
    $s3Bucket = "<S3 Bucket Name Here>"
    $s3keyprefix = "backups\" #Change to what ever Folder in S3 Bucket you will be putting the files
    $region = "us-east-1" #Change to what ever AWS Region S3 Bucket is in.
    $s3prefixedfilename = $s3keyprefix + $elfile
    

    Write-S3Object -BucketName $s3Bucket -file $fullpath -Key $s3prefixedfilename -Region $region -AccessKey $accessKey -SecretKey $secretKey 



    #Old backups cleanup
    #Keep last 14 backupsets and delete backupfiles older than 14 days.
    Get-ChildItem $folderpath | Where-Object { $_.LastWriteTime -lt ((Get-Date).AddDays(-14)) } | Remove-Item

}