Skip to content

Instantly share code, notes, and snippets.

@iomoath
Last active February 2, 2025 17:36
Show Gist options
  • Save iomoath/b1fb258abc4353ac2c44b586d2d0f267 to your computer and use it in GitHub Desktop.
Save iomoath/b1fb258abc4353ac2c44b586d2d0f267 to your computer and use it in GitHub Desktop.
Powershell script to export Windows Events logs
# Logs to extract from server
$logArray = @("System","Security","Application", "Setup")
# Grabs the server name to append to the log file extraction
$servername = $env:computername
# Provide the path with ending "\" to store the log file extraction.
$destinationpath = "C:\WindowsEventLogs\"
# Checks the last character of the destination path. If it does not end in '\' it adds one.
# '.+?\\$' +? means any character \\ is looking for the backslash $ is the end of the line charater
if ($destinationpath -notmatch '.+?\\$')
{
$destinationpath += '\'
}
# If the destination path does not exist it will create it
if (!(Test-Path -Path $destinationpath))
{
New-Item -ItemType directory -Path $destinationpath
}
# Get the current date in YearMonthDay format
$logdate = Get-Date -format yyyyMMddHHmm
# Start Process Timer
$StopWatch = [system.diagnostics.stopwatch]::startNew()
# Start Code
Clear-Host
Foreach($log in $logArray)
{
# If using Clear and backup
$destination = $destinationpath + $servername + "-" + $log + "-" + $logdate + ".evtx"
Write-Host "Extracting the $log file now."
# Extract each log file listed in $logArray from the local server.
wevtutil epl $log $destination
# Write-Host "Clearing the $log file now."
# Clear the log and backup to file.
# WevtUtil cl $log
}
# End Code
# Stop Timer
$StopWatch.Stop()
$TotalTime = $StopWatch.Elapsed.TotalSeconds
$TotalTime = [math]::Round($totalTime, 2)
write-host "The Script took $TotalTime seconds to execute."
@ck-7
Copy link

ck-7 commented Mar 11, 2022

How to zip or rar the all the event logs in a common .zip or .rar file
EX : ComputerName-YYYY-DD-MM-HH-MM-SS.zip or rar format ?

@opabravo
Copy link

You could add Windows PowerShell to the set

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment