NT Event log clearing

[flyfishin]

Category:

NT Admin

Description:

This simple little script clears and saves the event logs for whatever servers you place in @servers. It then copies them all to a central location for easy reference.

#! c:\perl\bin

use Win32::EventLog;
use File::Copy;
use Time::localtime;
open(OUTFH,"+>>\\\\server03\\backup_logs\\buerrs.log");
@servers = ("server01","server02","server03","server04","server05","se
+rver06");
@logs = ("System","Application","Security");
#($sec,$min,$hour,$mday,$mon,$year) = localtime();
$year = localtime->year() + 1900;
$month = localtime->mon()+1;
$day = localtime->mday();
$hour = localtime->hour();
$min = localtime->min();
$sec = localtime->sec();
$date = join("_",$year,$month,$day,$hour,$min,$sec);

for ( $i = 0; $i <= $#servers ; $i++ )
{
    foreach $eventlog (@logs)
    {    

        $filename = $eventlog. "_" . $servers[$i] . "_" . $date;
        $handle = Win32::EventLog->new("$eventlog","\\\\$servers[$i]")
+ or
            die "Can't open $eventlog Eventlog on $servers[$i]:$!\n";

# The directory backup_logs was created on each server.

        $handle->Clear("c:\\backup_logs\\$filename.evt") or
            print OFH "Could not clear and backup the $eventlog Eventl
+og on $servers[$i]\n";
        $handle->Close;
        move("\\\\$servers[$i]\\backup_logs\\$filename.evt","\\\\serve
+r03\\backup_logs\\$eventlog\\$filename.evt")
            or warn "Could not move $filename to server03:$!\n";
    }
}
close OUTFH;