Windows – Export entire Windows Log to XML

powershellwindowswindows-event-logwindows-server-2008

I want to create a printer statistic and I have a simple but powerfull XML parser. So I want to export all Events from the printer log to the XML format.

The print server runs Win2008R2. When I want to export the filtered log to XML (I have filtered event ID 307) I've got only 300 events from almost 6000.

Could you help me? I have also tried powershell to export the log, but I'am not able to get the xml structure.

Best Answer

The windows utility wevtutil can do just what you're looking for. I was using it for archiving certain event-log entries into a database. The powershell based methods had several failure-modes that made iterating over a large number of events infeasible. This utility dumps the entire thing in one go, which makes offline parsing much, much faster.

wevtutil qe Security /r:DC01 /q:"*[System[((EventID=307))]]" > evtdump.xml

Specifically, the powershell methods pull events on a retail basis. As it iterates through the loop it's asking the target machine "give me the next event", which requires a lot of back-and-forth to the machine. The speed difference between the wevutil method and the powershell method was significant: it took over an hour to extract an event-log via powershell, but only 2 minutes via wevtutil.

Depends on your use-case though. If the logs you're parsing are not busy or not very large, the powershell method means you don't have to manage files as part of your script.

Related Solutions

Exporting logon/logoff events from Windows event log

It seems to me that if you really want real time data you could do a lot worse then go back to logon/logoff scripts. If you need the IP address of the client machine and are only getting the machine's name why not simply do an nslookup on it in the script? Depending on the scripting language you use there may even be a built-in function to do the lookup.

I'm sure plenty of others will have different ideas but if you do want to parse the event logs, for this or any other reason, Perl not only has the modules, it's hard to beat for processing the data. If you go down that path, regardless of the language you choose to use, I suggest you send the data you are interested to a database, from where it is much more easily manipulated, search, etc. Again, Perl makes this easy.

Powershell – Piping powershell messages to Write-EventLog

What kind of data does the cmdlet return? You could save it into a string like so,

$ret = Get-ClubMembers -Whatever...
Write-EventLog -LogName "Windows Powershell" -Source "Powershell" -Message $ret -EventId 0

If the data returned is an array, you must create an ordinary string first. Othervise, the log message will just contain the array name. Maybe something like this

$ret = Get-ClubMembers -Whatever...
Write-EventLog -LogName "Windows Powershell" -Source "Powershell" -Message $($ret -join [Environment]::NewLine) -EventId 0

Ed:

As far as I know - and I'd really like to be wrong in this one - you have run into a nasty limitation of Powershell. Keith Hill's blog has kind of a work-around. You mentioned that the cmdlet is a custom one. Maybe you could ask its developer to add a switcht that toggles the messages to stdout, so that executing the cmdlet would return its output as an easily logged string array.

Best Answer

Related Solutions

Exporting logon/logoff events from Windows event log

Powershell – Piping powershell messages to Write-EventLog

Related Topic