集中备份Windows 日志
公司要求集中备份系统日志，手上又没有可用的工具，为了应付检查，使用Powershell 将几台服务器的日志集中备份。在Technet上找到这个脚本，非常实用，记录并分享在这，提供日后查询。
Param(
$LogsArchive ="c:\logarchive",
$List,
$computers,
$AD,
$Localhost,
$clear,
$Help
)
Function Get-ADComputers
{
$ds = New-ObjectDirectoryServices.DirectorySearcher
$ds.Filter = "ObjectCategory=Computer"
$ds.FindAll() |
ForEach-Object {$_.Properties['dnshostname']}
} #end Get-AdComputers
Function Test-ComputerConnection
{
ForEach($Computer in$Computers)
{
$Result = Get-WmiObject -Classwin32_pingstatus -Filter "address='$computer'"
If($Result.Statuscode -eq 0)
{
if($computer.length -ge 1)
{
Write-Host "+ Processing$Computer"
Get-BackUpFolder
}
} #end if
else { "Skipping $computer .. notaccessible" }
} #end Foreach
} #end Test-ComputerConnection
Function Get-BackUpFolder
{
$Folder ="{1}-Logs-{0:MMddyymm}" -f ::now,$computer
New-Item"$LogsArchive\$folder" -type Directory -force| out-Null
If(!(Test-Path "\\$computer\c$\LogFolder\$folder"))
{
New-Item "\\$computer\c$\LogFolder\$folder"-type Directory -force | out-Null
} #end if
Backup-EventLogs($Folder)
} #end Get-BackUpFolder
Function Backup-EventLogs
{
$Eventlogs = Get-WmiObject -ClassWin32_NTEventLogFile -ComputerName $computer
Foreach($log in $EventLogs)
{
$path = "\\{0}\c$\LogFolder\$folder\{1}.evt"-f $Computer,$log.LogFileName
$ErrBackup =($log.BackupEventLog($path)).ReturnValue
if($clear)
{
if($ErrBackup -eq0)
{
$errClear =($log.ClearEventLog()).ReturnValue
} #end if
else
{
"Unable to clearevent log because backup failed"
"Backup Errorwas " + $ErrBackup
} #end else
} #end if clear
Copy-EventLogsToArchive -path$path -Folder $Folder
} #end foreach log
} #end Backup-EventLogs
Function Copy-EventLogsToArchive($path, $folder)
{
Copy-Item -path $path -dest"$LogsArchive\$folder" -force
} # end Copy-EventLogsToArchive
Function Get-HelpText
{
$helpText= `
@"
DESCRIPTION:
NAME: BackUpAndClearEventLogs.ps1
This script will backup, archive, andclear the event logs on
both local and remote computers. It willaccept a computer name,
query AD, or read a text file for thelist of computers.
PARAMETERS:
-LogsArchive local or remote collectionof all computers event logs
-List path to a list of computer namesto process
-Computers one or more computer namestyped in
-AD switch that causes script to queryAD for all computer accounts
-Localhost switch that runs scriptagainst local computer only
-Clear switch that causes script toempty the event log if the back succeeds
-Help displays this help topic
SYNTAX:
BackUpAndClearEventLogs.ps1 -LocalHost
Backs up all event logs on local computer. Archives them toC:\logarchive.
BackUpAndClearEventLogs.ps1 -AD -Clear
Searches AD for all computers. Connects to these computers, andbacks up all event
logs. Archives all event logs toC:\logarchive. It then clears all event logs
if the backup operation was successful.
BackUpAndClearEventLogs.ps1 -List C:\fso\ListOfComputers.txt
Reads the ListOfComputers.txt file to obtain a list of computer.Connects to these
computers, and backs up all event logs.Archives all event logs to C:\logarchive.
BackUpAndClearEventLogs.ps1 -Computers "Berlin,Vista"-LogsArchive "\\berlin\C$\fso\Logs"
Connects to a remote computers named Berlin and Vista, and backsup all event
logs. Archives all event logs from allcomputers to the path c:\fso\Logs directory on
a remote computer named Berlin.
BackUpAndClearEventLogs.ps1 -help
Prints the help topic for the script
"@ #end helpText
$helpText
}
# *** Entry Point To Script ***
If($AD) { $Computers = Get-ADComputers; Test-ComputerConnection;exit }
If($List) { $Computers = Get-Content -path $list; Test-ComputerConnection; exit}
If($LocalHost) { $computers = $env:computerName; Test-ComputerConnection; exit}
If($Computers)
{
if($Computers.Contains(",")){$Computers = $Computers.Split(",")}
Test-ComputerConnection; exit
}
If($help) { Get-HelpText; exit }
"Missing parameters" ; Get-HelpText
源文档 <http://technet.microsoft.com/zh-cn/library/2009.07.heyscriptingguy.aspx>
页:
[1]