事件日志保存在以当前日期为名的文件夹下

 

wevtutil epl setup c:\setup.evtx

 

============================================

#定义事件日志保存位置,每天的事件日志保存在以当前日期为名的文件夹下
$eventlog_folders = "c:\eventlogs"
If (!(Test-Path $eventlog_folders))
{new-item -type directory -path $eventlog_folders|Out-Null}
$dt = get-date -uformat "%Y%m%d"
If (!(Test-Path ($eventlog_folders+"\"+$dt)))
{new-item -type directory -path ($eventlog_folders+"\"+$dt)|Out-Null}
$Eventlogs = Get-WmiObject -Class Win32_NTEventLogFile
Foreach ($log in $Eventlogs)
{
$eventlogname = $eventlog_folders + "\" + $dt + "\" + $log.filename + ".evtx"

$log.PSBase.Scope.Options.EnablePrivileges = $true ##为用户授权，03下不加这句话会报“访问遭到拒绝”

$log.BackupEventlog($eventlogname)|Out-Null
}