How can i export my event logs to a folder (csv or txt) on every start up automatically?

Question

I was looking for either a batch file, powerscript (not really good with yet)or any way to have my event logs exported to txt or csv on every start up? Im using windows 7 pro if that helps

Meed

Answer 1

This will output last 20 system event logs in eventlog.txt.Not sure what exactly you need from eventlog - it's a big place...

WEVTUtil query-events System /count:20 /rd:true /format:text > eventlog.txt

You can change System to Application,Security or Setup - not sure what exactly you need.

more info: http://ss64.com/nt/wevtutil.html

check also this: http://ss64.com/nt/psloglist.html

You can save this (or similar) command to bat file and schedule it on start-up

Rebroadcast

That worked now 1 more question (maybe) would I switch out "system" for the security and application events? Or can I have all 3 in the same script? I am pretty new to this – Meed

I need the crash logs to export. That's probably what I should have said from the beginning. Also is there a symbol or number I could use if I needed all and not just 20? – Meed

@user310473 - according to the command help you can have only one of the events roots (System,Application,...) But you can create a batch with 3 lines to export all then.And you can search trough the created files with FIND or FINDSTR command – Rebroadcast

ok that worked great, but when I change "system" to "security" or "applications" the text file is blank, but in my event viewer it shows information. I also cant seem to figure out how to export the crash logs part. thanks for your help! – Meed

Any idea how to export to CSV? /format:Text produces a bunch of lines per event. However, the gui of EventVwr allows to save to csv. Note: Couldn't find a suitable documented csv option. TIA. – Chesson

@SergeWautier - the only supported formats are XML and Text. Probably you can use the XML format and transform it to CSV with some other tool? – Rebroadcast

Answer 2

WEVTUtil query-events System /count:20 /rd:true /format:text > exported_file_name.csv /q:"Event[System[(EventID=1074)]]"

Then gpedit.msc - windows settings - scripts and add to start up. Thanks @npockmaka for getting this started

Meed