How to backup windows event logs

Question

I have a business requirement to backup the Windows Event Log files. When I use NT Backup to backup the C:\WINDOWS\System32\config folder, which seems to contain the event log files, they don't appear in the backup catelog after running the backup job. I guess the files are locked and in use, but how then do I backup the Windows Event logs?

Answer 1

http://technet.microsoft.com/en-us/library/ee176696.aspx

Answer 2

You should look into using something like Log Parser to archive your logs to a database instead of just backing them up. Jeff Atwood (The creator of this site) has a good blog article on Log Parser at:

http://www.codinghorror.com/blog/archives/000369.html

Another good tool to do this is Splunk.

You can do useful work on database archived logs (like query who logged in where and when) whereas backups of the logs on tape or disk are really only useful for ticking off some management to-do list.

Answer 3

You could just right click on the log and select save all events as... This exports everything in that log into a file. You can reimport the logs into event viewer to look back at them, I think Splunk and logparser can read the file directly as well.