Facebook Twitter Instagram
    TecAdmin
    • Home
    • Ubuntu 20.04
      • Upgrade Ubuntu
      • Install Java
      • Install Node.js
      • Install Docker
      • Install LAMP Stack
    • Tutorials
      • AWS
      • Shell Scripting
      • Docker
      • Git
      • MongoDB
    • FeedBack
    • Submit Article
    • About Us
    Facebook Twitter Instagram
    TecAdmin
    Home»Windows Tutorials»A Windows Server Event Log Backup Script

    A Windows Server Event Log Backup Script

    RahulBy RahulOctober 24, 20132 Mins ReadUpdated:April 14, 2022

    As a system administrator, this is our responsibility to backup and keep regular backups of Windows server event logs. Also, keep them stored on an external drive or cloud storage. We recommend backup event logs on daily basis and retaining atleast one year of backup. Event logs help us for troubleshooting systems.

    Here is a batch script to take windows logs backup and store them on the local drive.

    Step 1 – Create Backup Directory

    Create a backup directory named c:\backup for containing backups and c:\backup\logs for containing log files. You can use your own directory structure for backup.

    Open a command prompt and run the below commands to create the directory structure.

    mkdir c:\backup 
    mkdir c:\backup\logs 
    

    Step 2 – Create Backup Script

    Now, create a batch script c:\backup\evt-backup.bat and copy the below script in this batch script. Change the BACKUP_PATH if you are using a different location for the backup directory.

    rem Script starts here
    rem Timestamp Generator
    
    set BACKUP_PATH=c:\backup\logs
    
    rem Parse the date (e.g., Thu 02/28/2013)
    set cur_yyyy=%date:~10,4%
    set cur_mm=%date:~4,2%
    set cur_dd=%date:~7,2%
    
    rem Parse the time (e.g., 11:20:56.39)
    set cur_hh=%time:~0,2%
    if %cur_hh% lss 10 (set cur_hh=0%time:~1,1%)
    set cur_nn=%time:~3,2%
    set cur_ss=%time:~6,2%
    set cur_ms=%time:~9,2%
    
    rem Set the timestamp format
    set timestamp=%cur_yyyy%%cur_mm%%cur_dd%-%cur_hh%%cur_nn%%cur_ss%%cur_ms%
    
    wevtutil epl System %BACKUP_PATH%\system_%timestamp%.evtx
    wevtutil epl Application %BACKUP_PATH%\application_%timestamp%.evtx
    wevtutil epl Security %BACKUP_PATH%\security_%timestamp%.evtx
    
    rem End of Script
    

    Step 3 – Execute Script Manullly

    Let’s execute this script manually to test. Open Windows command prompt as Administrator. Navigate to c:\backup directory and execute the script like below:

    evt-backup.bat 
    

    Then check, if event log backup files were created successfully.

    Script to Backup event logs

    Step 4 – Configure Script in Scheduler

    Finally, configure this script in windows task schedulers to run it automatically on a regular interval. A daily backup is much sufficient for normal uses systems.

    Thanks for reading this article, I hope this script will help you to take automatic backup of windows logs.

    batch script event log event log bakcup windows batch script
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email WhatsApp
    Previous ArticleHow to Add Host in Zabbix Server to Monitor
    Next Article How to Install NGINX Web Server on CentOS/RHEL 7/6 and Fedora 27/26

    Related Posts

    How to Clear the ASP.NET Temporary files in Windows

    Updated:June 15, 20221 Min Read

    Creating Python Virtual Environment on Windows

    Updated:June 3, 20222 Mins Read

    How to Enable / disable Firewall in Windows

    Updated:May 17, 20222 Mins Read

    How to Start & Stop Windows Service via Command Line

    Updated:March 29, 20222 Mins Read

    How to Change Windows Hostname (Computer Name)

    Updated:June 2, 20223 Mins Read

    How To Install NVM on Windows

    Updated:April 16, 20223 Mins Read

    12 Comments

    1. Cybercut on April 7, 2022 11:42 pm

      I know this is an old post however, in my WIN 11 install, even when running with elevated cmd, still – Access Denied. Any suggestions? Thanks so very much.

      Reply
      • Rahul on April 8, 2022 4:19 am

        Try to run as administrator prvileges.

        Reply
    2. Naren on August 8, 2019 12:21 pm

      Hi Team,
      This script is working fine for me in Windows server 2012. In windows server 2016 I am getting application and system event logs backup only. Kindly share the script for Windows server 2016 to backup security logs too.

      Thanks in Advance for the script.

      Reply
    3. Shankar D on August 3, 2019 9:44 am

      Hi I am getting error while running the batch file.
      C:\Backup\logs\wevtutil epl Application C:\backup\logs\application_8/01-15052427.evtx
      Failed to export log Application. The system cannotfind the path specified.

      OS : Windows 2008R2 STD

      Kindly help me to resolve this issue.

      Thanks in advance
      Shankar D

      Reply
    4. Ankit Tiwari on July 22, 2019 5:15 pm

      Failed to export log Security. Access is denied.

      Reply
      • karuna on July 9, 2021 5:49 am

        script run as administrator, it will work

        Reply
    5. sugun on January 25, 2019 1:08 pm

      Failed to export log Security. Access is denied.

      Reply
    6. Rami on August 10, 2016 2:02 pm

      Hi,
      Thank you for your script,
      I was wondering if i can specify the date, i mean to export the eventlog in last 72 hours as example.?

      Reply
    7. Ted on February 24, 2016 3:54 pm

      I’d like to suggest that for many situations it might be better to use the clear log feature with backup.

      wevtutil cl System /bu:”%BACKUP_PATH%system_%timestamp%.evtx”

      This will create the same backup file as your script, but it will also clear the log so that you are not backing up the same log events the next time.

      Reply
    8. rajesh on March 19, 2014 11:35 am

      Hi rahul,
      this is very simple and clean …
      in your script, you mentioned about 3 events … but how can we know which event logs we have to observe among around 400 event types … can you suggest …

      Reply
      • FA-EF on February 14, 2019 7:36 am

        Hi LEAVE A REPLY
        You can check name of logs in log properties and use Full Name to insert into script.

        Example
        wevtutil epl Microsoft-Windows-PrintService/Operational %BACKUP_PATH%\Operational_%timestamp%.evtx

        Reply
    9. Avi on November 1, 2013 4:25 pm

      Small but very useful script. Thanks for sharing with us….. keep it up

      Reply

    Leave A Reply Cancel Reply

    Recent Posts
    • What is the /etc/aliases file
    • What is the /etc/nsswitch.conf file in Linux
    • How to Install Ionic Framework on Ubuntu 22.04
    • What is the /etc/hosts file in Linux
    • How to Install Angular CLI on Ubuntu 22.04
    Facebook Twitter Instagram Pinterest
    © 2022 Tecadmin.net. All Rights Reserved | Terms  | Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.