Introduction

EventCL is a Windows 2000 (and NT) application that clears the windows Event logs and can optionally backup the eventlog to a user defined file.

This backup utility has the following features:

Installation

There is no special procedure to follow. Just place the program and its associated files in the Windows directory or in a dedicated folder (directory).

EventCL has been developed and tested on W2K and NT 4.0. EventCl requires no additional runtime DLLs.

Usage

EventCL <EventLogName> [<Backupfile Name> [<MachineName>]]

Where:

Below is a table that shows all of the available options that can be specified for the <Backupfile name>:

Note adding a leading '#' removes any leading zeros from the output.

Some example uses would be:

EventCL Application myappbackup.evt
EventCL Application c:\backup\@y@m@dApplication.evt
EventCL System @A_@#jSystem.evt
EventCL System @n_@A_@#jSystem.evt
EventCL "File Replication Service" c:\backup\@n_frs_@d@m@y.evt server01.domain.com
EventCL "DNS Server" c:\backup\@n_dnss_@d@m@y.evt server01.domain.com
EventCL "Directory service" c:\backup\@n_ds_@d@m@y.evt server01.domain.com

• Q:Why does my remote Eventlog backup fail?
• A:This can fail because of a number of reasons:
  
  1) You do not have sufficent permissions
  2) You are attempting to backup the Eventlog to a local directory that does not exist on the remote drive.
  
  The rational behind the second point is as follows:
  
  When invoking a remote machine backup the NT EventLog service generates the backup file under the system account. This account does not have any network credentials - and so cannot (basically) create a remote file backup. Also when you select a file name to back the eventlog to on a remote machine the selected file is LOCAL to the REMOTE machine. So if you want to backup the remote system eventlog on {REMOTE_COMPUTER} to 'c:\mylog' the actual event log is created on the '{REMOTE_COMPUTER}\c:\mylog'.
  
  So to get around this problem EventCl takes the filename you want it backed up to and creates that on the remote machine. Once it has been created on the remote machine the file is moved to the local machine. Thus making the impression that the file was backed up to the local drive.
  
  Therefore the reason why the remote call fails is that your remote directory does not exist on the remote machine. We could have make the backup create a temporary file under the 'c:\', but that could break a number of conventions:
  
  1) Don't potentially litter the drives with event log backups
  2) Antivirus software may raise alerts as this is unexpected disk activity
  3) Auditing may be turned on for the root of 'c:\'
  4) In a failure case the file is potentially available to hackers.
  
  By using a known location the administrator can secure that directory on both the remote and local machine. In the event of the worst network failure the eventlog will be copied to the remote machine directory, the connection is broken so the file is not moved to the local machine and the log is not cleared. This will then leave the backup file in a secured directory hopefully away from hackers eyes.
  
  

• Q:Can I backup W2K specific Event logs?
• A:Yes you can. However whenever the event log name has spaces in it (i.e. "File Replication Service") you have to enclose the names in matching double quotes. It is generally considered good practice to always include double quotes around the log names
  

• Q:When a local dump is made on a local machine the option @n uses the Netbios-name of the W2k-machine instead of its Full computer name ( = DNS-name). Is there a work around?
• A:This is easily solved. You just have to place manually the remaining DNS-path after the @n-option. Example = @n.domain.com_frs_@d@m@y.evt

• Q:Can I use EventCL within a Windows 2000 forest?
• A:Yes, infact it is even easier to use within a Windows 2000 forest then within an NT4-domain, because you can schedule the task with a specific account. Note this account must have proper administrative rights within the forest to clear the eventlogs, for example an account that is a member of the enterprise admins.

• Q:EventCL just doesn't believe the specified REMOTE eventlog is a valid name?
• A:Inorder to validate the name of the log file EventCl checked the name locally. Therefore if you are running EventCL on a machine that doesnt have the specified eventlog name defined locally, then it will not accept the name. To work around this you must use a machine that has similarly defined logfiles.

While EventCL is free, for mission critical environments (government agencies, banks etc) it is useful to ensure the code you are installing does not contain any backdoors, viruses etc. We guarantee that EventCL does not have any flaws, however for those needing more than our word the source may be purchased at the following link Purchase Source Code

Premier support has now been added to EventCL. This allows customers to register EventCL on a per machine basis for premier support. This support level guarantees a response within 36 hours, with an expected turnaround less than 4 hours. Further to standard problem diagnosis with this support level you get priority treatment for product modifications while using a dedicated premier support email address for maximum expediency. Finally this support also helps us support our free product set. Naturally we are still available for non-premier support at support@Mo-Ware.com.

Premier support may be purchased at the following link Purchase Premier Support

• None at present.

• When backing up a remote event log to the local machine the 'local' directory must exist on the 'remote' machine. This behavior is a result of both the NT operating system and a design decision of Mobiusware. Therefore we can say 'This is by design'!

"Even the NT Resource KIT (2000-version also) does not have a tool that can perform the same as EventCL.exe.

NT Resource KIT has DumpEL.exe. This tool doesn't even come near EvenCL.exe. Why is EventCL.exe so good?

1. Backup and Clean option in one.
2. The logs are backuped in native format, so they can be opened by the eventviewer.
3. Very flexible in filename-creation
4. Freeware
5. ****** REMOTE OPTION ******** "

"Now I have only ONE batchfile to run at ONE location! All logfiles at our 21 servers are backed up automatically."

"I would like to compliment you on your EXCELLENT support. I have been sitting here fighting with xxxx over a down server, trying to figure out where the engineer is who is suppose to fix it. He is 4 hours late. Every time I call them, I get another excuse. I have provided customer service for over 25 years, and you have certainly gone the extra yard."

History

Web page update [December 18, 2001]

Goto Download page EventCL (35 KB)