A Windows Server Event Log Backup Script

As a system administrator, this is our responsibility to backup and keep regular backups of Windows server event logs. Also, keep them stored on an external drive or cloud storage. We recommend backup event logs on daily basis and retaining atleast one year of backup. Event logs help us for troubleshooting systems.

Here is a batch script to take windows logs backup and store them on the local drive.

Step 1 – Create Backup Directory

Create a backup directory named c:\backup for containing backups and c:\backup\logs for containing log files. You can use your own directory structure for backup.

Open a command prompt and run the below commands to create the directory structure.

mkdir c:\backup 
mkdir c:\backup\logs 

Step 2 – Create Backup Script

Now, create a batch script c:\backup\evt-backup.bat and copy the below script in this batch script. Change the BACKUP_PATH if you are using a different location for the backup directory.

rem Script starts here
rem Timestamp Generator

set BACKUP_PATH=c:\backup\logs

rem Parse the date (e.g., Thu 02/28/2013)
set cur_yyyy=%date:~10,4%
set cur_mm=%date:~4,2%
set cur_dd=%date:~7,2%

rem Parse the time (e.g., 11:20:56.39)
set cur_hh=%time:~0,2%
if %cur_hh% lss 10 (set cur_hh=0%time:~1,1%)
set cur_nn=%time:~3,2%
set cur_ss=%time:~6,2%
set cur_ms=%time:~9,2%

rem Set the timestamp format
set timestamp=%cur_yyyy%%cur_mm%%cur_dd%-%cur_hh%%cur_nn%%cur_ss%%cur_ms%

wevtutil epl System %BACKUP_PATH%\system_%timestamp%.evtx
wevtutil epl Application %BACKUP_PATH%\application_%timestamp%.evtx
wevtutil epl Security %BACKUP_PATH%\security_%timestamp%.evtx

rem End of Script

Step 3 – Execute Script Manullly

Let’s execute this script manually to test. Open Windows command prompt as Administrator. Navigate to c:\backup directory and execute the script like below:

evt-backup.bat 

Then check, if event log backup files were created successfully.

Step 4 – Configure Script in Scheduler

Finally, configure this script in windows task schedulers to run it automatically on a regular interval. A daily backup is much sufficient for normal uses systems.

Thanks for reading this article, I hope this script will help you to take automatic backup of windows logs.