Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a business requirement to backup the Windows Event Log files. When I use NT Backup to backup the C:\WINDOWS\System32\config folder, which seems to contain the event log files, they don't appear in the backup catelog after running the backup job. I guess the files are locked and in use, but how then do I backup the Windows Event logs?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

http://technet.microsoft.com/en-us/library/ee176696.aspx

share|improve this answer
    
+1 for LMGTFY =) –  Wesley Dec 23 '09 at 3:50

You should look into using something like Log Parser to archive your logs to a database instead of just backing them up. Jeff Atwood (The creator of this site) has a good blog article on Log Parser at:

http://www.codinghorror.com/blog/archives/000369.html

Another good tool to do this is Splunk.

You can do useful work on database archived logs (like query who logged in where and when) whereas backups of the logs on tape or disk are really only useful for ticking off some management to-do list.

share|improve this answer
    
We use Splunk here and it'll effectively meet the requirements of 'backing up' the event logs. The value add is that it'll let you analyse and search them as well. It is not free though. –  Snellgrove Apr 1 at 9:46
    
Splunk is free in a somewhat limited version for up to 500MB a day of log files. That's certainly adequate for many small companies for their critical systems. It does get pricey though if you want the full version. The lack of AD integration in the free version is it's biggest drawback though in my opinion. –  Ausmith1 Apr 1 at 13:43

You could just right click on the log and select save all events as... This exports everything in that log into a file. You can reimport the logs into event viewer to look back at them, I think Splunk and logparser can read the file directly as well.

share|improve this answer
    
Thanks but I needed something more automated. –  saille Dec 24 '09 at 1:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.