Photo Gallery Member List Search Calendars FAQ Ticket List Log Out


Delete Specific Events From Event Viewer

  		Logged in as: Guest
arrSession:exec spGetSession 2,2,59798
Active Users: There are 0 members and 0 guests.
Users viewing this topic: none
 

 

  
 
  Printable Version
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Delete Specific Events From Event Viewer
  Do you like VisualBasicScript.com? Link to us and help spread the word about our forum. Thanks! 		Page: [1]
Login
Message << Older Topic   Newer Topic >>
Delete Specific Events From Event Viewer - 5/4/2008 7:21:25 PM   
  anurag_cancerian

 

Posts: 5
Score: 0
Joined: 5/4/2008
Status: offline 		Hi,

I am looking for a script which would delete specific events from Security, Application or System events. On the basis of events it would delete those events but before delete it would store those events in some file.

If someone have this script please send me.

Thanks and Regards,

Anurag
 
 
Post #: 1
 
RE: Delete Specific Events From Event Viewer - 5/5/2008 12:24:41 AM   
  dm_4ever


Posts: 2433
Score: 38
Joined: 6/29/2006
From: Orange County, California
Status: offline
quote:


If someone have this script please send me.


We will help you...not give you...and you must post what you have tried first.

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to anurag_cancerian)
 
 
Post #: 2
 
RE: Delete Specific Events From Event Viewer - 5/5/2008 6:26:23 PM   
  anurag_cancerian

 

Posts: 5
Score: 0
Joined: 5/4/2008
Status: offline 		Hi,

I am getting error in this script please let me know where I done wrong as I have given query that in Security event if it's finds Event ID 560 then it will delete that event.

Error : delete_event_specific.vbs(7, 1) (null): 0x80041017
 
Script :
 
strComputer = "WINXPPC"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Security' and " _
& "EventCode='560'")
For Each objLogfile in colLogFiles
 objLogFile.ClearEventLog()
Next

(in reply to dm_4ever)
 
 
Post #: 3
 
RE: Delete Specific Events From Event Viewer - 5/6/2008 12:26:25 AM   
  dm_4ever


Posts: 2433
Score: 38
Joined: 6/29/2006
From: Orange County, California
Status: offline 		In regards to your error...

Your connection needs to be slightly modified

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security,Backup)}!\\" & _
strComputer & "\root\cimv2")

and... you are receiving (Null) because the Win32_NTEventLog does not have an EventCode property making your query invalid.  ClearEventLog either clears the whole thing or is does not...it does not look like you can delete specific entries.

"SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Security' and EventCode='560'"

_____________________________

dm_4ever

My philosophy: K.I.S.S - Keep It Simple Stupid
Read Me: http://www.visualbasicscript.com/m_24727/tm.htm
Frequently Asked Stuff: http://www.visualbasicscript.com/m_47117/tm.htm

(in reply to anurag_cancerian)
 
 
Post #: 4
 
RE: Delete Specific Events From Event Viewer - 5/11/2008 6:06:05 PM   
  anurag_cancerian

 

Posts: 5
Score: 0
Joined: 5/4/2008
Status: offline 		Hi,

Thanks for your reply I have modified my code but still I am getting this error message.

Error : (8, 1) (null): 0x80041017

Modified Script:
 
strComputer = "WINXPPC1"
Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security,Backup)}!\\" & _
strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery("SELECT * FROM Win32_NTEventLogFile WHERE LogFileName='Security' and EventCode='578'")
For Each objLogfile in colLogFiles
 objLogFile.ClearEventLog()
Next

I have used ClearEventLog with for loop when it gets events of 578 then it will start clearning those logs.

Please correct me if I am wrong and also I checked security events and there are 560 and 578 events but still getting error message.

Thanks and Regards,

Anurag

(in reply to dm_4ever)
 
 
Post #: 5
 
 
 
 

If you found our site useful please link to us <a href="http://www.visualbasicscript.com">VisualBasicScript.com</a>.
All Forums >> [Scripting] >> WSH & Client Side VBScript >> Delete Specific Events From Event Viewer Page: [1]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts




Forum Software © ASPPlayground.NET Advanced Edition 2.5.5 ANSI