evtbak

Tools from www.gorlani.com/portal:
Netboar: free and effective network analysis tool. Similar to iftop
Mac Makeup: change (spoof) your mac address
TurnItOn: enable disabled controls
Peks: checksum verification and modification tool for PE executables
Evtbak: batch backup your local/remote Windows NT event log
MyGears: gear/speed calculator
CTI: calculate rally times
Pinta: free simple customizable Mailenable antispam plugin

www.gorlani.com and all of its contents are (c) by Marcello Gorlani

Current version is 1.67sst350c. You can get it here along with its signature.
MD5 hash is: D1F4BB9D8519C8234734755A47FA2400

Evtbak is a tool that lets you backup and clear Windows NT/2000/XP/2003 event logs.
It has no interactive interface, so you can schedule it to run at proper time without intervention. It lets you collect logfile from remote machines, so a single workstation can backup the entire network file logs.

Use is extremely straightforward:
EvtBak <UNC_machine_name> <LogType> <Backup_File> [t] [a | A]

with LogType meaning

0 Application log
1 Security log
2 System log
3 Internet Explorer log

So if you need to backup the security log for your remote server "FileServer1" type:

evtbak \\fileserver1 1 f:\backup\security

If your run this daily, the file will be overwritten each time, loosing information. You can use the "t" switch to append timestamp to the file name and solve the problem:

evtbak \\MyDomCtrl 2 e:\logs\systemlog t

Each time the log is backed up, it is also cleared. You can clear a log without backup using "" as file name:

evtbak \\myserver 1 ""

You need admin privileges on the target machine to run this tool.

There is also a or A switch that performs a simple analisys of logfile. This function is beta code since 1999 :-) and should not be regarded as affordable.

Distribution

This tool is provided as is, without any kind of implicit or explicit warranty. You can distribute and must obtain it for free. If you publish it on your site, don't forget a link to this page.

If you find it useful, you're encouraged to donate a little money with paypal. Sending 1 to 5 Euro will help in developing this and other tools. If you don't donate, you can still use the program without limitations and get assistance by the forum.

www.gorlani.com and all of its contents are (c) by Marcello Gorlani