How to backup/export an event log to an evtx file with PowerShell

First of all, you must locate the event log you want to export among all others.
For this, you can use the Get-WmiObject cmdlet to list them all. Additionally, you can narrow down your list with the Where-Object cmdlet.

Get-WmiObject -Class Win32_NTEventlogFile | Where-Object LogfileName -Match 'system'

Then you can assign your file to a variable and use the BackupEventlog method.
For example, if I want to export or backup the System event log.

$log = Get-WmiObject -Class Win32_NTEventlogFile | Where-Object LogfileName -EQ 'system'
$log.BackupEventlog('e:\temp\system.evtx')

Oneliner bonus

But as I just explained on StackOverflow you can also perform the whole operation as a oneliner and you will get the same result.

(Get-WmiObject -Class Win32_NTEventlogFile | Where-Object LogfileName -EQ 'System').BackupEventlog('E:\Temp\System.evtx')

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s