Clear Event Log via WMI

Use the ClearEventlog Method.

ClearEventlog([in] string ArchiveFileName);

Clears the specified event log, and optionally saves the current copy of the logfile to a backup file. The method returns an integer value that can be interpretted as follows:
0 - Successful completion.
8 - The user does not have adequate privileges.
21 - Invalid parameter.
Other - For integer values other than those listed above, refer to Win32 error code documentation.

ArchiveFileName
String specifying the name of a file in which a current copy of the event logfile will be placed. If this file already exists, the function fails.

Note: Only Localsystem, Administrators and System Operators can clear the logs.

;This code backs up the event log then clears it.
objSWbemLocator = ObjectOpen("WbemScripting.SWbemLocator")
objSWbemService = objSWbemLocator.ConnectServer("")
objSWbemSecurity = objSWbemService.Security_
objSWbemSecurity.ImpersonationLevel = 3
objSWbemPrivs = objSWbemSecurity.Privileges
objSWbemPrivs.AddAsString("SeSecurityPrivilege")
objSWbemPrivs.AddAsString("SeBackupPrivilege")
strClass = "Win32_NTEventLogFile"

log = "Application"  ; !!!CHANGE TO FIT YOUR NEEDS !!!
;log = "Security" 	; !!!CHANGE TO FIT YOUR NEEDS !!!
;log = "System"		; !!!CHANGE TO FIT YOUR NEEDS !!!
 
query =  StrCat('SELECT * FROM ' , strClass, ' WHERE logfilename = "',log,'"')

colSWbemObjectSet = objSWbemService.ExecQuery(query)

hEnum = ObjectCollectionOpen(colSWbemObjectSet)

While @true
	objEvent = ObjectCollectionNext(hEnum)
	If objEvent == 0 Then Break
	 filename = objEvent.Caption
	 
	 ;Back up the event long
	 bakfilename = StrCat(DirWindows(1),"config\",FileRoot(filename),"_BACKUP.EVT")
	 title = StrCat("Clear the ",log," event log?")
	 prompt = StrCat("Press 'Yes' to clear the ",log," event log and save it to: ",bakfilename)
	 ret = AskYesNo(title, prompt)
	 if ret == @no then break

	 ;Clear the event long
	 ret = objEvent.ClearEventLog(bakfilename)
	 if ret == 0
	 	Message("Event Log Cleared",StrCat(log," Log Backed Up To:",@crlf,@crlf,bakfilename))
	 else
	 	Message("Event Log NOT Cleared",StrCat("Error:",@crlf,@crlf,ret))
		if ret == 183
			Message("Backup File Already Exists",StrCat("Try deleting... ",bakfilename))
		endif
	 endif
	ObjectClose(objEvent)
EndWhile

ObjectCollectionClose(hEnum)
ObjectClose(colSWbemObjectSet)
ObjectClose(objSWbemPrivs)
ObjectClose(objSWbemSecurity)
ObjectClose(objSWbemService)
ObjectClose(objSWbemLocator)

Article ID:   W16270

File Created: 2004:03:30:15:43:42

Last Updated: 2004:03:30:15:43:42

Database Search

TechHome

Clear Event Log via WMI