An error occurred while Event Viewer was saving a log file in .evtx format from SERVER to PATH.
\nEvents from the remote computer cannot be saved into .evtx format files on the local computer. If you want to save the events to the local computer, select a different file format. To save the events in .evtx format, save them onto the remote computer.<\/p><\/blockquote>\n
Why this happens? Windows Event Log Service (eventlog), which is responsible for all main event log functionality is running under LocalService account. LocalService presents anonymous credentials on the network, so it has no permissions to backup event log anywhere, but computer on which the service is running. The same limitation has wevtutil.exe command. It works with local event logs only.<\/p>\n
What about Event Log Explorer? We designed Event Log Explorer to backup remote event logs as easy as local ones. When backing up a remote logs, it saves the log into a shared folder on a remove computer and then moves it into the target folder.<\/p>\n
Just click right mouse button a log you wish to backup in the tree and select Save log as<\/em>. Event Log Explorer will do the rest.<\/p>\n Note that you must have administrative permissions on the server Serv1 or you won’t be able to access files from ADMIN$ resource.<\/p>\n Of course, you can backup event logs manually, but our user asked us to automate process. Event Log Explorer comes with ELBACK utility which can be located in the application folder (default location is “C:\\Program Files (x86)\\Event Log Explorer\\elback.exe”). This utility developed exactly for batch backup of event logs. Detailed information about this utility available in Event Log Explorer help<\/a>.<\/p>\n Here is our command line to backup Application and System logs from a local PC and Serv1:<\/p>\n Remove \/clear<\/em> option if you don’t want to empty log automatically after backup.<\/p>\n Run this command to test it. If it works correctly, you will see 4 new files in D:\\Backup folder that looks like Serv1-System-2016-05-18-10-56-056.evt.<\/p>\n Now we can automate the process. I will use Windows Scheduler. In article Exporting event logs with Windows PowerShell<\/a> I described how to create Windows Scheduler task with PowerShell. Here I will just use Windows UI for this.<\/p>\n Click Windows Start button, then All Programs->Accessories->System Tools->Task Scheduler Now you can find your task in the list. Important note: if you decide to backup a local Security event log, you will probably need to elevate permissions to access the security log. To do so, click right mouse button on Logs backup task in Windows Scheduler and select Properties. In the Properties dialog enable checkbox “Run with highest privileges”.<\/p>\n Don’t forget to the task before going production.<\/p>\n Recently we received a question from our customer who asked about regular backing up of system and application event logs. He wanted to backup only local logs, but let’s extend the task for remote logs as well. So our task is to backup System and Application event logs from a local computer and remote machine (SERV1) into a folder two times a week. Let’s try\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":240,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[7],"tags":[58,53],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/237"}],"collection":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/comments?post=237"}],"version-history":[{"count":4,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/237\/revisions"}],"predecessor-version":[{"id":244,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/237\/revisions\/244"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media\/240"}],"wp:attachment":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media?parent=237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/categories?post=237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/tags?post=237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}![\"event](\"http:\/\/eventlogxp.com\/blog\/wp-content\/uploads\/2016\/05\/elex-backup.png\")
<\/a><\/p>\nelback.exe D:\\backup Application System \\\\Serv1\\Application \\\\Serv1\\System \/clear<\/pre>\n
\nSelect Task Scheduler Library in the tree.
\nCreate Basic Task from the menu.
\nGive any name to the task, e.g. “Logs backup”.
\nClick Next.
\nOn Task Trigger page select Weekly.
\nClick Next.
\nSpecify when you want to run the task.
\nClick Next.
\nSelect “Start a program”
\nclick Next.
\nIn Program\/Script line type
\n“C:\\Program Files (x86)\\Event Log Explorer\\elback.exe”<\/em>
\nIn Add arguments type
\nD:\\backup Application System \\\\Serv1\\Application \\\\Serv1\\System \/clear
\n<\/em>Click Next
\nClick Finish.<\/p><\/blockquote>\n
\nClick right mouse button on the task and select Run to test it.
\nCheck “D:\\Backup” folder if new evtx files appear.<\/p>\n<\/a><\/p>\n<\/a><\/a><\/a><\/a><\/a><\/a>","protected":false},"excerpt":{"rendered":"