syg_hira's tech memo

windows server関連のTipsのおぼえがき

export event log on remote machine with wevtutil

when wevtutil 'remote' option is specifies, is a local path on remote machine. not UNC...It's tricky.

example

Remote Machine:RServer

wevtutil export-log "System" "D:\Log\Exported\Sys.evtx" /Remote:LServer

The file will exported as \\RServer\D$\Log\Exported\Sys.evtx