Being a System administrator, it is your responsibility to backup even logs of your system regularly. Event logs help us for troubleshooting systems. In this tutorial, you will get a simple batch script to take windows event log backups on your Windows system.
Step 1 – Create Backup Directory
Create a backup directory named c:\backup for containing backups and c:\backup\logs for containing log files. You can use your own directory structure for backup.
Open a command prompt and run below commands to create the directory structure.
mkdir c:\backup mkdir c:\backup\logs
Step 2 – Create Backup Script
Now, create a batch script c:\backup\evt-backup.bat and copy the below script in this batch script. Change the BACKUP_PATH if you are using a different location for backup directory.
rem Script starts here rem Timestamp Generator set BACKUP_PATH=c:\backup\logs rem Parse the date (e.g., Thu 02/28/2013) set cur_yyyy=%date:~10,4% set cur_mm=%date:~4,2% set cur_dd=%date:~7,2% rem Parse the time (e.g., 11:20:56.39) set cur_hh=%time:~0,2% if %cur_hh% lss 10 (set cur_hh=0%time:~1,1%) set cur_nn=%time:~3,2% set cur_ss=%time:~6,2% set cur_ms=%time:~9,2% rem Set the timestamp format set timestamp=%cur_yyyy%%cur_mm%%cur_dd%-%cur_hh%%cur_nn%%cur_ss%%cur_ms% wevtutil epl System %BACKUP_PATH%\system_%timestamp%.evtx wevtutil epl Application %BACKUP_PATH%\application_%timestamp%.evtx wevtutil epl Security %BACKUP_PATH%\security_%timestamp%.evtx rem End of Script
Step 3 – Execute Script Manullly
Let’s execute this script manually to test. Open Windows command prompt as Administrator. Navigate to c:\backup directory and execute the script like below:
Then check, if event log backup files created successfully.
Step 4 – Configure Script in Scheduler
Finally, configure this script in windows task schedulers to run it automatically on a regular interval. A daily backup is much sufficient for normal uses systems.
Thanks for reading this article, I hope this script will help you to take automatic backup of windows logs.