I have a script that is harvesting event logs and importing them into a SQL database. We have 15 Domain Controllers, and 2500 users - so the sheer amount of .evt files that are hanging around is huge.

When the files are copied to a central server, they are stamped like this:
Code:

SERVERNAME-20050617-131101-SECURITY.LOG
Server - YYYYDDMM - HHMMSS - Event Log


So I wrote something that converts today's date to that format, and is supposed to look for files in that folder that DO NOT contain that string, and delete them.

It looked like it worked the first time I ran it, but it could just be the lag in explorer while I was viewing the folder as it was about 13GB...Now, all the files are gone, as well as a file that was not an .evt file - none of this is what I expected to happen.

Here is my code:
Code:

$PATH = "\\hqweb1\Server Admin Group\Documentation\Server Admin Documentation\Server Event Logs\SecurityLogs"
$TODAY = Split(@DATE,"/",)
$TODAY = Join($TODAY,"",)
$Files = Dir("$PATH\*.evt")
While $Files <> "" and @ERROR = 0
	$Files = Dir()
	If not InStr($Files,$TODAY)
		Del "$PATH\$Files"
	EndIf
Loop


Maybe someone could explain it to me and possibly re-arrange it for me.

Thanks!
_________________________
-- oobnuker - .KIX hack - no really.