The Windows2000 system log is divided into application logs, security logs, system logs, and DNS server logs. . Location in% systemroot% / system32 / config default size is 512K
Security% SystemRoot% / System32 / Config / SECEVENT.EVT
System% SystemRoot% / System32 / Config / SYSEVENT.EVT
Application% SystemRoot% / System / Config / APPEVENT.EVT
These log files in the registry
HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / SERVICES / EVENTLOG
System32 / config default size is 512K, you can change his size, if you don't have a log, you will report an error.
Registry HKEY_LOCAL_MACHINE / SYSTEM / CURRENTCONTROLSET / Services / eventlog corresponds to each log, and a log has a subkey. Modify
1 --- Log configuration
You can also use Microsoft's scripts to set the maximum log of up to 25m, and allow you to overwrite the log of 14 days ago.
Script uses WMI objects, WMI (Windows Management Instrument) is a system management tool under Windows provided by Microsoft
StrComputer = "."
Set objwmiservice = getObject ("WinMgmts:" _
& "{ImpersonationLevel = Impersonate, (Security)}}! //" & _
Strcomputer & "/ root / cimv2") "Get VMI objects
Set collogfiles = objwmiservice.execQuery_
("SELECT * WIN32_NTEVENTLOGFILE")
For Each Objlogfile in Collogfiles
Strlogfilename = Objlogfile.name
Set WMISWBEMOBJECT = GetObject_
("Winmgmts: {ImpersonationLevel = Impersonate}! //./ Root / CIMv2:" _
& "Win32_nteventlogfile.name = '" & strlogfilename & "" ")
WMISWBEMOBJECT.MAXFILESIZE = 2500000000
WMISWBEMOBJECT.OVERWRITEOUTDATED = 14
WMISWBEMOBJECT.PUT_
NEXT
Save the above * .vbs can be used, strComputer = "." Localhost
To execute "." To the host name (of course, you have to establish an IPC connection and have administrator privileges)
2 --- Log Query and Backup
He mentioned Dumpel.exe in the Microsoft Resourcekit toolbox, but did not find: P
You can first understand the usage!
It is estimated to operate in CMD. .
Dumpel -f filename -s // server -l log
-f filename
-S // Server remote computer log
-l log log include system, security, Application and DNS
For example, the SYSTEM log of the target server Server is used as backupsystem.log
Dumpel -s // server -l system -f backupsystem.log
You can also use WMI to implement
EXAMPLE: APPLICATION
Backuplog.vbs
StrComputer = "."
Set objwmiservice = getObject ("WinMgmts:" _
& "{ImpersonationLevel = Impersonate, (Backup)}! //" & _
Strcomputer & "/ root / cimv2") "Get VMI objects
Set collogfiles = objwmiservice.execQuery_
("SELECT * WIN32_NTEVENTLOGFILE WHERE LOGFILENAME = 'Application'") 'Gets application logs in log objects
For Each Objlogfile in Collogfiles
ErrBackuplog = Objlogfile.backupeventLog ("f: /Application.evt") 'to back up logs to f: /Application.evt
IF Errbackuplog <> 0 THEN
WScript.echo "The Application Event log could not be backed up."
Else Wscript.echo "Success Backup Log"
END IF
NEXT
Success should be prompted "Success Backup Log" or "The Application Event Log Could Not Be Backed Up"
However, the backup format is also * .evt is turned on with notepad, it is garbled, no Dumpel is convenient! (It seems that you want to see the Dongdong in Config, you still need Dumpel, hey, it's really trouble!)
3 - Log Clear
As a hacker, this is very important. Of course, I don't really involve such a problem. After all, I have only played some tricks in Lan :), I have a nonsense, and this is also written to himself. Use, don't have to die!
First point, of course, use Tool! Xiao Yi's elsave.exe I don't know if there is any included, you need to have administrator privileges, and IPC connection (this is not TMD is nonsense, you have invaded, can you have JB, haha?
Cmd
Elsave -s // ip -l application -c ("c" is something, wait for Elsave.exe to say)
In order to use WMI, there is a writing of Dongdong, MB, but first get Object Logo, using clearventlog ()
Cleanevent.vbs
StrComputer = "."
Set objwmiservice = getObject ("WinMgmts:" _
& "{ImpersonationLevel = Impersonate, (Backup)}! //" & _
STRComputer & "/ root / cimv2")
DIM MYLOGS (3) MYLOGS (1) = "Application"
MYLOGS (2) = "system"
MYLOGS (3) = "Security"
For Each Logs in Mylogs
Set collogfiles = objwmiservice.execQuery_
("SELECT * WIN32_NTEVENTLOGFILE WHERE LOGFILENAME = '" & logs & "'")
For Each Objlogfile in Collogfiles
Objlogfile.cleareventlog ()
NEXT
NEXT
In the above code, create an array, for Application, Security, if there is any other log, you can join an array.
Then use a for loop to delete each element in the array, that is, each log.
1. Use the EventLog method in the script program is to create logs very simple; look at a code below
Createlog.vbs
SET WS = WScript.createObject ("wscript.shell")
WS.LoGevent 0, "Write Log Success" creates a successful log
This code is easy to read, first get a shell object of WScript, then use the LOGEVENT method of the shell object.
Logevent Usage: Logevent EventType, "Description" [, Remote System]
EventType is the log type, you can use as follows: 0 represents successful execution, 1 Perform an error, 2 warning, 4, information, 8 successful auditing 16 troubleshooting
Therefore, in the above code, the 0 is changed to 1, 2, 4, 8, 16, and the quotation marks will be described.
The log writes by this method has a disadvantage that only the application log can only be written, and the days to the source can only be WSH, which is Windows Scripting Host, so there is not much hidden role.
2, Microsoft In order to facilitate system administrators and programmers, Microsoft has a new command line tool, EventCreate.exe, using it, and create a log easier.
Eventcreate -s server -l logname -u username -p password -so source -t evenettype -id ID-DSCRIPTION
Meaning: -s Create a log for a remote host: -U remote host user password
-l log; you can create System and Application can't create a Security log.
-so log Source, you can be any log -T log type such as Information information, Error error, Warning warning,
-d log description, can be any statement-ID autonomous log is 1-1000
For example, we have to create a system log locally, and the source is admin, the log type is a warning, described as "this is a test", the event ID is 500
You can use the following parameters
Eventcreate -l system -so administrator -t warning -d "this is a test" -ID 500
This tool cannot create a security log. As for how to create a security log, I hope everyone can find a good way!
Supplementary a method of regularly storeing logs, but still uses Dumpel.exe in Resource Kit, but also needs to use Run in WScript.Shell to perform Dumpel.exe's usage. It should be said very well, in addition to supplement a bit
Dumpel -f file -s // server -l log (find this Tool, you will know)
Specific code, because I don't know how WScript.Shell, can not fully understand, the specific code COPY is as follows
LogReport.js
Month = new array (12)
Month [1] = "January"
Month [2] = "February"
Month [3] = "March"
Month [4] = "April"
Month [5] = "May"
Month [6] = "June"
Month [7] = "July"
Month [8] = "August"
Month [9] = "September"
Month [10] = "October"
Month [11] = "November"
Month [12] = "December"
Days = new arch (7)
Days [1] = "Sunday"
Days [2] = "Monday"
Days [3] = "Tuesday"
Days [4] = "Wednesday"
Days [5] = "Thursday"
Days [6] = "Friday"
Days [7] = "Saturday"
Function hasData (ADATE)
{
Var currentday = days [adate.getday () 1]
Var currentmonth = month [adate.getmonth () 1]
Return Currentday "," CurrentMonth "," Adate.Getdate ()
}
Var Result; Result = 0
Var ws = wscript.createObject ("wscript.shell")
c = ws.expandenvironmentStrings ("% computername%")
NetDrive = "Date // Backup"
Today = new date ()
Var logday = Today.getdate ()
Var logmonth = Today.getMonth ()
LogArray = new array (2)
LogArray [0] = "system"
LogArray [1] = "Application"
LogArray [2] = "security"
For (l in logarray) {
WS.Run ("Dumpel.exe / S Server / L" LOGARRAY [L] "/ F" NetDrive "" " " " " " " " " LOGARRAY " ] ". LOG / D 1",
0, "True")
}
Forreading = 1Forappending = 8
For (l in logarray) {
VAR fs = new activ ("scripting.filesystemobject")
VAR f = fs.opentextfile (" NetDrive " C "-" LogMonth "-" logDay () "-" logArray [l] ". log", forreading, "true")
fcontents = f.readall ()
f.close ()
VAR f = fs.opentextfile (" NetDrive " C " " LogMonth "-" LogDay () " " LOGARRAY [L] "HTM", FORAPPPPpending, "True")
Fheader = "
