Backup/export custom view automatically from Event Viewer

eventviewerwindows-server-2008

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically my own whole custom view log with event id's.

Best Answer

Open up the Custom View properties, select Edit Filter and then switch to the XML tab and copy the filter.

enter image description here

You can now use the filter with PowerShell, like this:

[xml]$CustomView = @"
<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(Level=2 or Level=3) and ( (EventID &gt;= 1000 and EventID &lt;= 2000) )]]</Select>
  </Query>
</QueryList>
"@

Get-WinEvent -FilterXML $CustomView | Export-CSV "C:\LogFiles\CustomView_$(Get-Date -format "yyyy-MM-DD").log"

Set up a scheduled task to run a script like the above every week

Related Topic