0

What are the different options to clear Event logs in windows 2003 other than opening event viewer and clearing logs one by one interactively? I don't consider powershell is an option as this also requires to be downloaded.

0

You can use VB scripting and WMI (both built into Windows)...

This VBS code will attempt to backup each log to C:\temp, and then clear them (if they were backed up successfully):

strComputer = "." 
Set objWMIService = GetObject("winmgmts:" _ 
    & "{impersonationLevel=impersonate,(Backup)}!\\" & _ 
        strComputer & "\root\cimv2") 

Set colLogFiles = objWMIService.ExecQuery _ 
    ("Select * from Win32_NTEventLogFile") 

For Each objLogfile in colLogFiles 
    logfileName = objLogFile.LogfileName 
    Wscript.Echo "Processing " + logfileName + " log..."
    errBackupLog = objLogFile.BackupEventLog("c:\temp\" + objLogFile.FileName + ".evt") 
    If errBackupLog <> 0 Then         
        Wscript.Echo "The " + logfileName + " event log could not be backed up." 
    Else 
       objLogFile.ClearEventLog() 
    End If 
Next 

Save it into a text file (ie: LogClear.vbs), and then execute cscript LogClear.vbs to run it from a command-line.

  • do I have to install VB in windows 2003? if not, what is the location of executable? Hoe do you use WMI to access logs? – dhomya Sep 1 '14 at 21:44
0

Source ServerFault answer Save and clear eventlogs ServerFault answer by Bart De Vos

There is a SysInternals-tool you can use for this now called PSLogList. This replaces the EventLog.pl from Windows 2K.

You would need to use the -c option to clear the logs after the command and -g to specify the file. (for some strange reason -g is not in the usage-help).

usage: psloglist [- ] [\\computer[,computer[,...] | @file [-u username [-p password]]] [-s [-t delimiter]] [-m #|-n #|-h #|-d #|-w][-c][-x][-r][-a mm/dd/yy][-b mm/dd/yy][-f filter] [-i ID[,ID[,...] | -e ID[,ID[,...]]] [-o event source[,event source][,..]]] [-q event source[,event source][,..]]] [-l event log file] <eventlog>

@file   Execute the command on each of the computers listed in the file.
-a  Dump records timestamped after specified date.
-b  Dump records timestamped before specified date.
-c  Clear the event log after displaying.
-d  Only display records from previous n days.
-c  Clear the event log after displaying.
-e  Exclude events with the specified ID or IDs (up to 10).
-f  Filter event types with filter string (e.g. "-f w" to filter warnings).
-h  Only display records from previous n hours.
-i  Show only events with the specified ID or IDs (up to 10).
-l  Dump records from the specified event log file.
-m  Only display records from previous n minutes.
-n  Only display the number of most recent entries specified.
-o  Show only records from the specified event source (e.g. \"-o cdrom\").
-p  Specifies optional password for user name. If you omit this you will be prompted to enter a hidden password.
-q  Omit records from the specified event source or sources (e.g. \"-q cdrom\").
-r  SDump log from least recent to most recent.
-s  This switch has PsLogList print Event Log records one-per-line, with comma delimited fields. This format is convenient for text searches, e.g. psloglist | findstr /i text, and for importing the output into a spreadsheet.
-t  The default delimeter is a comma, but can be overriden with the specified character.
-u  Specifies optional user name for login to remote computer.
-w  Wait for new events, dumping them as they generate (local system only).
-x  Dump extended data
eventlog    eventlog

If you are after a command you can execute remotely, you would need something like this:

psexec \\servername -c psloglist.exe -c -g application.evt application
  • I believe sysinternal psexec has to be downloaded first. It is not available as part of windows 2003. Can the VB script be scheduled to run at the time it is desired to run? – dhomya Aug 29 '14 at 15:50
  • Yes, psexec is part of the SystemInternals toolkit and it needs to be downloaded. I guess the VB script can be scheduled. You should ask in a comment to the answer from Ƭᴇcʜιᴇ007 – DavidPostill Aug 29 '14 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.