Are Your Event Logs Recoverable and Viewable?

Editor's note: This article was originally launched on the Scripting Pro VIP Web site. Thanks to Jim Turner for also making it available to Security Pro VIP readers.

Executive Summary:

Backing up event logs can be problematic because they're open and actively capturing and storing new events just about all of the time, even during backups. If you back up an active, changing file, you'll likely find that the backup file is corrupt and inaccessible. Fortunately, you can use the BackupEventLog method of the Windows Management Instrumentation's (WMI's) Win32_NTEventLogFile class to create recoverable and viewable copies of all your event logs. Here are two scripts that demonstrate how to use the BackupEventLog method.

. . .