Ryfujk

Older movie/show about humans on derelict alien warship which refuels by passing through a star

How long after the last departure shall the airport stay open for an emergency return?

Why did C use the -> operator instead of reusing the . operator?

Is it acceptable to use working hours to read general interest books?

What is this word supposed to be?

How important is it that $TERM is correct?

What does "function" actually mean in music?

std::unique_ptr of base class holding reference of derived class does not show warning in gcc compiler while naked pointer shows it. Why?

What was Apollo 13's "Little Jolt" after MECO?

Why didn't the Space Shuttle bounce back into space as many times as possible so as to lose a lot of kinetic energy up there?

Partitioning values in a sequence

A ​Note ​on ​N!

What *exactly* is electrical current, voltage, and resistance?

A strange hotel

Cayley's Matrix Notation

Will I lose my paid in full property

Drawing a german abacus as in the books of Adam Ries

"The cow" OR "a cow" OR "cows" in this context

How can I practically buy stocks?

"Whatever a Russian does, they end up making the Kalashnikov gun"? Are there any similar proverbs in English?

How much of a wave function must reside inside event horizon for it to be consumed by the black hole?

Island of Knights, Knaves and Spies

Could moose/elk survive in the Amazon forest?

How do I reattach a shelf to the wall when it ripped out of the wall?

Backup/export custom view automatically from Event Viewer

users unable to view security log in event viewerHow do I fix a custom Event Viewer Log that merges automatically with the Application log?100% uptime for a web applicationWindows Server 2008 what is the proper way to export or backup security event logScript to export custom view Event Viewer to .evtx PowershellSave Custom View from Event Viewer in .evtxHow to export event viewer errors to Excel in Windows Server 2012How Can I Consolidate all Event Viewer Logs from different ServersIs it possible to view events from all event logs (including “Applications and Services Logs”) simultaneously?Enabling Event Viewer auditing on individual file modifications by Handler ID

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ height:90px;width:728px;box-sizing:border-box;
}

1

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically my own whole custom view log with event id's.

windows-server-2008 eventviewer

share|improve this question

edited May 5 '14 at 10:33

user3603657

asked May 5 '14 at 10:28

user3603657user3603657

3317

bumped to the homepage by Community♦ 6 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You want to export the events that you see in your custom view, or you want to export the Custom View itself?
  
  – Mathias R. Jessen
  May 5 '14 at 10:32
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I want to export the whole Custom View itself.
  
  – user3603657
  May 5 '14 at 10:33
  

  
  
  
  

add a comment | 

1

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically my own whole custom view log with event id's.

windows-server-2008 eventviewer

share|improve this question

edited May 5 '14 at 10:33

user3603657

asked May 5 '14 at 10:28

user3603657user3603657

3317

bumped to the homepage by Community♦ 6 mins ago

This question has answers that may be good or bad; the system has marked it active so that they can be reviewed.

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  You want to export the events that you see in your custom view, or you want to export the Custom View itself?
  
  – Mathias R. Jessen
  May 5 '14 at 10:32
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I want to export the whole Custom View itself.
  
  – user3603657
  May 5 '14 at 10:33
  

  
  
  
  

add a comment | 

How can I simply export or back-up a custom view from the event viewer? I do not want to export the regular Event logs, such as: System, Application, Security etc. But I want to export automatically my own whole custom view log with event id's.

windows-server-2008 eventviewer

share|improve this question

edited May 5 '14 at 10:33

user3603657

asked May 5 '14 at 10:28

user3603657user3603657

3317

share|improve this question

edited May 5 '14 at 10:33

user3603657

asked May 5 '14 at 10:28

user3603657user3603657

3317

share|improve this question

edited May 5 '14 at 10:33

user3603657

asked May 5 '14 at 10:28

user3603657user3603657

3317

asked May 5 '14 at 10:28

user3603657user3603657

3317

asked May 5 '14 at 10:28

user3603657user3603657

3317

1 Answer
1

active

oldest

votes

0

Open up the Custom View properties, select Edit Filter and then switch to the XML tab and copy the filter.

You can now use the filter with PowerShell, like this:

[xml]$CustomView = @"

<QueryList>

  <Query Id="0" Path="Application">

    <Select Path="Application">*[System[(Level=2 or Level=3) and ( (EventID &gt;= 1000 and EventID &lt;= 2000) )]]</Select>

  </Query>

</QueryList>

"@



Get-WinEvent -FilterXML $CustomView | Export-CSV "C:LogFilesCustomView_$(Get-Date -format "yyyy-MM-DD").log"

Set up a scheduled task to run a script like the above every week

share|improve this answer

edited May 5 '14 at 10:44

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  And how can I put this in a scheduled task in the Task Scheduler? I want this custom view every week on friday in a *.evtx file if possible. Should I run a script or something with the Task Scheduler?
  
  – user3603657
  May 5 '14 at 10:37
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've put this in a .ps1 file and ran it with PowerShell but nothing happens. The PowerShell appears, but disappears within 1 second and nothing happens after that. No folder is create on C: or such. How to fix it?
  
  – user3603657
  May 5 '14 at 11:47
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you used my exact query you probably won't get any results. Run the script from within an existing powershell session to see any errors it might produce
  
  – Mathias R. Jessen
  May 5 '14 at 11:51
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I still get errors but it's dissappearing so quickly, I can't even read it. Within 1 second it's gone. Can you test your script for errors perhaps?
  
  – user3603657
  May 6 '14 at 10:04
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've managed to get it working but now it's saving as a .log file. Isn't there a way to save it as a .xml or csv to open in an Excel sheet? How to make it human readable?? Can I save it as .evtx to open in the Event Viewer?
  
  – user3603657
  May 6 '14 at 13:07
  

  
  
  
  

add a comment | 

Your Answer

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "2"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f593134%2fbackup-export-custom-view-automatically-from-event-viewer%23new-answer', 'question_page');
}
);

Post as a guest

Name

Email

Required, but never shown

0

Open up the Custom View properties, select Edit Filter and then switch to the XML tab and copy the filter.

You can now use the filter with PowerShell, like this:

[xml]$CustomView = @"

<QueryList>

  <Query Id="0" Path="Application">

    <Select Path="Application">*[System[(Level=2 or Level=3) and ( (EventID &gt;= 1000 and EventID &lt;= 2000) )]]</Select>

  </Query>

</QueryList>

"@



Get-WinEvent -FilterXML $CustomView | Export-CSV "C:LogFilesCustomView_$(Get-Date -format "yyyy-MM-DD").log"

Set up a scheduled task to run a script like the above every week

share|improve this answer

edited May 5 '14 at 10:44

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  And how can I put this in a scheduled task in the Task Scheduler? I want this custom view every week on friday in a *.evtx file if possible. Should I run a script or something with the Task Scheduler?
  
  – user3603657
  May 5 '14 at 10:37
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've put this in a .ps1 file and ran it with PowerShell but nothing happens. The PowerShell appears, but disappears within 1 second and nothing happens after that. No folder is create on C: or such. How to fix it?
  
  – user3603657
  May 5 '14 at 11:47
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you used my exact query you probably won't get any results. Run the script from within an existing powershell session to see any errors it might produce
  
  – Mathias R. Jessen
  May 5 '14 at 11:51
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I still get errors but it's dissappearing so quickly, I can't even read it. Within 1 second it's gone. Can you test your script for errors perhaps?
  
  – user3603657
  May 6 '14 at 10:04
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've managed to get it working but now it's saving as a .log file. Isn't there a way to save it as a .xml or csv to open in an Excel sheet? How to make it human readable?? Can I save it as .evtx to open in the Event Viewer?
  
  – user3603657
  May 6 '14 at 13:07
  

  
  
  
  

add a comment | 

0

Open up the Custom View properties, select Edit Filter and then switch to the XML tab and copy the filter.

You can now use the filter with PowerShell, like this:

[xml]$CustomView = @"

<QueryList>

  <Query Id="0" Path="Application">

    <Select Path="Application">*[System[(Level=2 or Level=3) and ( (EventID &gt;= 1000 and EventID &lt;= 2000) )]]</Select>

  </Query>

</QueryList>

"@



Get-WinEvent -FilterXML $CustomView | Export-CSV "C:LogFilesCustomView_$(Get-Date -format "yyyy-MM-DD").log"

Set up a scheduled task to run a script like the above every week

share|improve this answer

edited May 5 '14 at 10:44

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  And how can I put this in a scheduled task in the Task Scheduler? I want this custom view every week on friday in a *.evtx file if possible. Should I run a script or something with the Task Scheduler?
  
  – user3603657
  May 5 '14 at 10:37
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've put this in a .ps1 file and ran it with PowerShell but nothing happens. The PowerShell appears, but disappears within 1 second and nothing happens after that. No folder is create on C: or such. How to fix it?
  
  – user3603657
  May 5 '14 at 11:47
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  If you used my exact query you probably won't get any results. Run the script from within an existing powershell session to see any errors it might produce
  
  – Mathias R. Jessen
  May 5 '14 at 11:51
  
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I still get errors but it's dissappearing so quickly, I can't even read it. Within 1 second it's gone. Can you test your script for errors perhaps?
  
  – user3603657
  May 6 '14 at 10:04
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I've managed to get it working but now it's saving as a .log file. Isn't there a way to save it as a .xml or csv to open in an Excel sheet? How to make it human readable?? Can I save it as .evtx to open in the Event Viewer?
  
  – user3603657
  May 6 '14 at 13:07
  

  
  
  
  

add a comment | 

Open up the Custom View properties, select Edit Filter and then switch to the XML tab and copy the filter.

You can now use the filter with PowerShell, like this:

[xml]$CustomView = @"

<QueryList>

  <Query Id="0" Path="Application">

    <Select Path="Application">*[System[(Level=2 or Level=3) and ( (EventID &gt;= 1000 and EventID &lt;= 2000) )]]</Select>

  </Query>

</QueryList>

"@



Get-WinEvent -FilterXML $CustomView | Export-CSV "C:LogFilesCustomView_$(Get-Date -format "yyyy-MM-DD").log"

Set up a scheduled task to run a script like the above every week

share|improve this answer

edited May 5 '14 at 10:44

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189

[xml]$CustomView = @"

<QueryList>

  <Query Id="0" Path="Application">

    <Select Path="Application">*[System[(Level=2 or Level=3) and ( (EventID &gt;= 1000 and EventID &lt;= 2000) )]]</Select>

  </Query>

</QueryList>

"@



Get-WinEvent -FilterXML $CustomView | Export-CSV "C:LogFilesCustomView_$(Get-Date -format "yyyy-MM-DD").log"

share|improve this answer

edited May 5 '14 at 10:44

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189

answered May 5 '14 at 10:34

Mathias R. JessenMathias R. Jessen

22.8k35189