Skip to content

Instantly share code, notes, and snippets.

@iomoath
Last active February 2, 2025 17:36
Show Gist options
  • Select an option

  • Save iomoath/b1fb258abc4353ac2c44b586d2d0f267 to your computer and use it in GitHub Desktop.

Select an option

Save iomoath/b1fb258abc4353ac2c44b586d2d0f267 to your computer and use it in GitHub Desktop.
Powershell script to export Windows Events logs
# Logs to extract from server
$logArray = @("System","Security","Application", "Setup")
# Grabs the server name to append to the log file extraction
$servername = $env:computername
# Provide the path with ending "\" to store the log file extraction.
$destinationpath = "C:\WindowsEventLogs\"
# Checks the last character of the destination path. If it does not end in '\' it adds one.
# '.+?\\$' +? means any character \\ is looking for the backslash $ is the end of the line charater
if ($destinationpath -notmatch '.+?\\$')
{
$destinationpath += '\'
}
# If the destination path does not exist it will create it
if (!(Test-Path -Path $destinationpath))
{
New-Item -ItemType directory -Path $destinationpath
}
# Get the current date in YearMonthDay format
$logdate = Get-Date -format yyyyMMddHHmm
# Start Process Timer
$StopWatch = [system.diagnostics.stopwatch]::startNew()
# Start Code
Clear-Host
Foreach($log in $logArray)
{
# If using Clear and backup
$destination = $destinationpath + $servername + "-" + $log + "-" + $logdate + ".evtx"
Write-Host "Extracting the $log file now."
# Extract each log file listed in $logArray from the local server.
wevtutil epl $log $destination
# Write-Host "Clearing the $log file now."
# Clear the log and backup to file.
# WevtUtil cl $log
}
# End Code
# Stop Timer
$StopWatch.Stop()
$TotalTime = $StopWatch.Elapsed.TotalSeconds
$TotalTime = [math]::Round($totalTime, 2)
write-host "The Script took $TotalTime seconds to execute."
@ck-7
Copy link
Copy Markdown

ck-7 commented Mar 11, 2022

How to zip or rar the all the event logs in a common .zip or .rar file
EX : ComputerName-YYYY-DD-MM-HH-MM-SS.zip or rar format ?

@opabravo
Copy link
Copy Markdown

You could add Windows PowerShell to the set

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment