| microsoft 2004-09-28, 3:58 pm |
| Hi all,
I've got some trouble on an W2k3 server, I wrote a vbscript and packed it
into a SCHTASKS, this script should write me a dump eventlog files.
The SCHTASKS log says everything is OK, but my dump logfile is not created.
When I run this script by hand no problemo, so my guess is that the SYSTEM
user can't write there, may I create a special user for this pupose?
Next is the script:
****************************************
'=======================================
===================================
'=======================================
===================================
' M A I N S C R I P T
'=======================================
===================================
Const ForReading = 1
Const ForWriting = 2
Const ForAppending = 8
FolderSave = "D:\BackupEventLog"
MyDate = Date
MyDay = Day(Now)
MyMonth = Month(Now)
MyYear = Year(Now)
Data = MyDay & "_" & MyMonth & "_" & MyYear
dateNow = DateAdd("d", -60, Date())
If WScript.Version < "5.6" then
Call PrereqUsage
End If
If Wscript.Arguments.Count <> 1 Then
'wscript.echo "call the sub firstrun"
Call FirstRun(FolderSave)
wscript.quit 0
Else
Parm = Wscript.Arguments(0)
End If
If Parm = "Check" Then
Call CheckSizeEventLog
wscript.quit 0
ElseIf Parm = "BackUpIt" Then
Call BackUpAndClear
wscript.quit 0
else
Call ErrorAndOut("Start of the script was not correct, parametere given with
is not defined")
End If
'=======================================
===================================
'=======================================
===================================
' F U N C T I O N & S U B R O U T I N E
'=======================================
===================================
'=======================================
===================================
'=======================================
===================================
' Function Name : "PrereqUsage"
' Parameters :
' Comment :
'=======================================
===================================
Sub PrereqUsage
MsgBox "The version of the WINDOWS SCRIPTING HOST " _
& "must be equals or higher to 5.6 ! " _
& vbCrLf _
& vbCrLf _
& "On this system the version is: " _
& vbCrLf _
& "WSH Version: " & WScript.Version _
& vbCrLf _
& vbCrLf _
& "To correct the problem install the script engine 5.6 and retry" _
& vbCrLf _
& vbCrLf _
& "The script will end now ", 4112, "Error on WSH Version"
wscript.quit 0
End Sub
'=======================================
===================================
' Function Name : "FirstRun"
' Parameters :
' Comment :
'=======================================
===================================
Sub FirstRun(BckTarget)
number = 0
On Error Resume Next
Set objFSO = CreateObject("Scripting.FileSystemObject")
If not objFSO.FolderExists(BckTarget) then
Set newfolder = objFSO.CreateFolder(BckTarget)
nError = err.number
If nError <> 0 Then
MsgBox "The Backup of the Security eventlog" _
& "has to be saved on the D partition ! " _
& vbCrLf _
& vbCrLf _
& "This server does not have a D partition, " _
& "this is not an standart setup " _
& vbCrLf _
& "This procedure can't be installed unless you create a D partiion or " _
& "edit the script and change the value of the variable FolderSave" _
& vbCrLf _
& vbCrLf _
& " ****************************************
***************" _
& vbCrLf _
& "Changing the varriables is not the recommended solution" _
& vbCrLf _
& " ****************************************
***************" _
& vbCrLf _
& vbCrLf _
& "The script will end now ", 4112, "PARTITION D NOT EXISTING "
wscript.quit 0
End If
End If
Set oShell = CreateObject("WScript.Shell")
Set strVer = oShell.Exec("cmd /c ver")
OSvar = strVer.stdout.readall
If InStr(OSvar, "4.0") Then GetOS = "AT"
If InStr(OSvar, "5.0") Then GetOS = "AT"
If InStr(OSvar, "5.1") Then GetOS = "schtasks"
If InStr(OSvar, "5.2") Then GetOS = "schtasks"
'wscript.echo GetOs
Select Case GetOS
Case "AT"
strCmd1 = "/EVERY:M,T,W,Th,F,S,Su CMD /C cscript //NOLOGO
c:\Scripts\BackupEventLogAndClear.vbs Check"
strCmd2 = "AT 21:00 /EVERY:M,T,W,Th,F,S,Su CMD /C cscript //NOLOGO
c:\Scripts\BackupEventLogAndClear.vbs BackUpIt"
Do
number = number + 2
oShell.Run "AT " & number & ":00 " & strCmd1, 1, true
nError = err.number
sDescription = "Could not schedule the check schedule."
If nError <> 0 Then
Call ErrorAndOut("Could not schedule the check schedule.")
End If
Loop Until number = 24
oShell.Run(strCmd2)
nError = err.number
sDescription = "Could not schedule the backup schedule."
If nError <> 0 Then
Call ErrorAndOut("Could not schedule the backup schedule.")
End If
Case "schtasks"
strCmd1 = "schtasks /create /tn EventLogCheck /tr " & chr(34) &
"c:\Scripts\BackupEventLogAndClear.vbs Check" _
& chr(34) & " /sc HOURLY /mo 2 /st 00:00:00 /ru " & chr(34) & "System" &
chr(34)
oShell.Run(strCmd1)
nError = err.number
sDescription = "Could not schedule the check schedule."
If nError <> 0 Then
Call ErrorAndOut("Could not schedule the check schedule.")
End If
strCmd2 = "schtasks /create /tn EventLogBackup /tr " & chr(34) &
"c:\Scripts\BackupEventLogAndClear.vbs BackUpIt" _
& chr(34) & " /sc DAILY /st 21:00:00 /ru " & chr(34) & "System" &
chr(34)
oShell.Run(strCmd2)
nError = err.number
sDescription = "Could not schedule the backup check."
If nError <> 0 Then
Call ErrorAndOut("Could not schedule the backup schedule.")
End If
End Select
on error goto 0
End Sub
'=======================================
===================================
' Function Name : "BackUpAndClear"
' Parameters :
' Comment :
'=======================================
===================================
Sub BackUpAndClear
On Error Resume Next
strComputer = "."
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objWMIService = GetObject("winmgmts:{(Backup,Security)}")
Set colItems = objWMIService.ExecQuery("Select * from Win32_NTLogEvent where
Logfile='Security'")
For Each objItem in colItems
Set objTextFile = objFSO.OpenTextFile(FolderSave & "\BackupSecurity_" &
Data & ".log", ForAppending, True)
objTextFile.WriteBlankLines(3)
objTextFile.WriteLine("CategoryString: " & objItem.CategoryString)
objTextFile.WriteLine("ComputerName: " & objItem.ComputerName)
objTextFile.WriteLine("Data: " & objItem.Data)
objTextFile.WriteLine("EventCode: " & objItem.EventCode)
objTextFile.WriteLine("EventIdentifier: " & objItem.EventIdentifier)
objTextFile.WriteLine("EventType: " & objItem.EventType)
objTextFile.WriteLine("InsertionStrings: " &
objItem.InsertionStrings)
objTextFile.WriteLine("Logfile: " & objItem.Logfile)
objTextFile.WriteLine("Message: " & objItem.Message)
objTextFile.WriteLine("RecordNumber: " & objItem.RecordNumber)
objTextFile.WriteLine("SourceName: " & objItem.SourceName)
objTextFile.WriteLine("TimeGenerated: " & objItem.TimeGenerated)
objTextFile.WriteLine("TimeWritten: " & objItem.TimeWritten)
objTextFile.WriteLine("Type: " & objItem.Type)
objTextFile.WriteLine("User: " & objItem.User)
objTextFile.Close
Next
Set objWMIService = GetObject("winmgmts:{(Backup,Security)}")
Set colItems = objWMIService.ExecQuery("select * from Win32_NTEventLogFile
where LogfileName='Security'")
For Each objItem in colItems
RetVal = objItem.ClearEventlog()
next
Set fso = CreateObject("Scripting.FileSystemObject")
Set MyFolder = fso.GetFolder(FolderSave&"\")
Set Files = MyFolder.Files
If Files.Count <> 0 Then
For Each File In Files
Set MyFile = fso.GetFile(File)
ShowFileInfo = MyFile.DateLastModified
MyShowFileInfo = Split(ShowFileInfo , " ", -1, 1)
ShowFileInfo = MyShowFileInfo(0)
DiffADate = DateDiff("d", dateNow, ShowFileInfo)
If DiffADate <= 0 then
' Wscript.echo "DELETE THE FILE:"_
' & vbCrLf & _
' "FILE NAME: " & MyFile _
' & vbCrLf & _
' "CREATED THE: " & ShowFileInfo _
' & vbCrLf
Call DeleteMyFile(MyFile)
' Else
' wscript.echo "KEEP THE FILE:" _
' & vbCrLf & _
' "FILE NAME: " & MyFile _
' & vbCrLf & _
' "CREATED THE: " & ShowFileInfo _
' & vbCrLf
End If
Next
End If
End Sub
'=======================================
===================================
' Function Name : "DeleteMyFile"
' Parameters :
' Comment :
'=======================================
===================================
Sub DeleteMyFile(MyFile)
FSO.DeleteFile(MyFile)
' Wscript.echo "DELETE THE FILE:"_
' & vbCrLf & _
' "FILE NAME: " & MyFile _
' & vbCrLf & _
' "CREATED THE: " & ShowFileInfo _
' & vbCrLf
End Sub
'=======================================
===================================
' Function Name : "CheckSizeEventLog"
' Parameters :
' Comment :
'=======================================
===================================
Sub CheckSizeEventLog
On Error Resume Next
SizeThr = 79
strComputer = "."
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_NTEventlogFile
where Logfile='Security'")
For Each objItem in colItems
' Wscript.Echo "FileSize: " & objItem.FileSize
' Wscript.Echo "LogfileName: " & objItem.LogfileName
SetMB = FormatNumber((objItem.FileSize / 1024) / 1024)
If SetMB > SizeThr Then
' wscript.echo "Size from EventLog " & objItem.LogfileName & " is to
High, actually " _
' & "it is: " & SetMB & " MB the threshold is 80 MB"
' Else
' wscript.echo "Size from EventLog " & objItem.LogfileName & " it is:
" & SetMB & " MB"
Recover = "CMD /C cscript //NOLOGO c:\Scripts\BackupEventLogAndClear.vbs
BackUpIt"
Set oShell = WScript.CreateObject("WSCript.shell")
oShell.Run(Recover)
End If
Next
End Sub
'=======================================
===================================
' Function Name : "ErrorAndOut"
' Parameters :
' Comment :
'=======================================
===================================
Sub ErrorAndOut(msg)
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objTextFile = objFSO.OpenTextFile(FolderSave & "\ErrorBackupEventLog_ "
& Data & ".log", ForAppending, True)
objTextFile.WriteLine(msg)
objTextFile.Close
Wscript.echo "There is something wrong"
Wscript.quit
End Sub
****************************************
************************************
**
Thxs in advance
|