备份和清除大型事件日志

 

描述

如果事件日志文件的大小大于 20 MB，就将其备份和清除。

脚本代码
strComputer = "."
Set objWMIService = GetObject("winmgmts:" _
   & "{ impersonationLevel=impersonate, (Backup, Security) }!\\" _
       & strComputer & "\root\cimv2")
Set colLogFiles = objWMIService.ExecQuery _
   ("Select * from Win32_NTEventLogFile")
For each objLogfile in colLogFiles
   If objLogFile.FileSize > 100000 Then
      strBackupLog = objLogFile.BackupEventLog _
          ("c:\scripts\" & objLogFile.LogFileName & ".evt")
      objLogFile.ClearEventLog()
   End If
Next