在Windows Server上备份事件日志的简单方法

Question

是否有可能创建一种备份事件日志的简单方法,例如批处理文件或简单的应用程序？我需要让它在客户的网站上工作,其中参考是非专家用户.谢谢

Answer 1

如果您使用的是Windows 2008,请使用内置的wevtutil命令.例:

wevtutil epl应用程序c:\ temp\foo.evtx

否则,从资源工具包中获取dumpel.exe,或者从http://technet.microsoft.com/en-us/sysinternals/bb897544.aspx获取psloglist

Answer 2

最后我用网上找到的这个方法做了一个小winapp：

public void DoBackup(string sLogName)
{
    string sBackup = sLogName;  // could be for example "Application"
    EventLog log = new EventLog();
    log.Source = sBackup;

    var query = from EventLogEntry entry in log.Entries
                orderby entry.TimeGenerated descending
                select entry;

    string sBackupName = sBackup+"Log";
    var xml = new XDocument(
        new XElement(sBackupName,
            from EventLogEntry entry in log.Entries
            orderby entry.TimeGenerated descending
            select new XElement("Log",
              new XElement("Message", entry.Message),
              new XElement("TimeGenerated", entry.TimeGenerated),
              new XElement("Source", entry.Source),
              new XElement("EntryType", entry.EntryType.ToString())
            )
          )
        );

    DateTime oggi = DateTime.Now;
    string sToday = DateTime.Now.ToString("yyyyMMdd_hhmmss");
    string path = String.Format("{0}_{1}.xml", sBackupName, sToday);
    xml.Save(Path.Combine(Environment.CurrentDirectory, path));
}

这是源链接：

它简直太好用了！