Page 1 of 1 1
Topic Options
#19609 - 2002-04-05 09:33 PM i must be missing something simple...help
wrcwrx Offline
Fresh Scripter

Registered: 2002-03-12
Posts: 9
Loc: San Francisco, CA
i appreciate if anyone can help me with this.
this is what i am trying to do:

the scripts goes to a remote server and backs up the event logs to an evt file.
code:
 backupeventlog('\\server1\Application', '\\server1\evtlogs\app.evt')
backupeventlog('\\server2\Application', '\\server2\evtlogs\app.evt')

i am getting a Access Denied error on the NT servers but the script runs without problem on W2k servers.

we have a NT network (NT4.0 SP6a PDC and BDC) with a mix of Nt4(Sp6a) & W2k(sp2) member servers

the script executes on a W2k server, using kix 4.02, logged in with my user account, Domain Admin access.

\\sever\evtlog share is given Everyone access.

i tried running the script on a NT server(backing up a remote servers Event Log) but the results are the same.

am i missing something simple? i feel like i am but just can't point at it. any help is appreciates.

Thanks
Felix

[ 05 April 2002, 21:34: Message edited by: wrcwrx ]

Top
#19610 - 2002-04-05 11:39 PM Re: i must be missing something simple...help
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
Are you sure it works on Win2K? It doesn't work on mine. I just had to test it 'cause I was always under the impression the API could only backup to the local disk and not a UNC.

See Event Log
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#19611 - 2002-04-06 12:47 AM Re: i must be missing something simple...help
BrianTX Offline
Korg Regular

Registered: 2002-04-01
Posts: 895
Did you try it on just one NT server or multiple servers? Also, are you running it locally on the NT machine or remotely?...

According to Microsoft:
"The backup file CANNOT be written to a remote server because this function is implemented by a service running in the LocalSystem account, which does not have credentials on the remote machine. However it is possible to write the file to a remote machine using a null session."

The BackupEventlog function comes from the win32 api in the advapi32.dll. I found this info on MSDN. I'm not really sure if there is a good way to get around it.

Brian

Top
#19612 - 2002-04-06 02:37 AM Re: i must be missing something simple...help
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
I tried it from two different Win2k machines remoting to both an NT4 and a Win2k server. No go with UNC only local path.
I believe you may need to do it as a two step process. Backup to a local (C:) path and then move them out using the C$ share.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#19613 - 2002-04-06 03:45 AM Re: i must be missing something simple...help
wrcwrx Offline
Fresh Scripter

Registered: 2002-03-12
Posts: 9
Loc: San Francisco, CA
heres the code guys, feel free to take it apart. [Smile] you might want to know that i am a newbie at scripting [Big Grin]

servers.txt reference a list of server names
i.e.
server1
server2
server3
and so forth...

code:
  
$date = split(@date,"/")

$appname = $date[0] + $date[1] + $date[2] + "app.evt"
$secname = $date[0] + $date[1] + $date[2] + "sec.evt"
$sysname = $date[0] + $date[1] + $date[2] + "sys.evt"

open(1, "c:\scripts\servers.txt",2) ;change this txt file when adding servers

$server = readline(1)
while @error = 0
if $server
gosub "EventLog"
endif

$server = readline(1)

loop

exit

:EventLog
backupeventlog('\\' + $server + '\Application', '\\' + $server + '\evtlogs$\' + $appname)
? "app " @serror
backupeventlog('\\' + $server + '\Security', '\\' + $server + '\evtlogs$\' + $secname)
? "sec " @serror
backupeventlog('\\' + $server + '\System', '\\' + $server + '\evtlogs$\' + $sysname)
? "sys " @serror

and here is what it looks on the cmd prompt
app Access is denied.5
sec Access is denied.5
sys Access is denied.5
app Access is denied.5
sec Access is denied.5
sys Access is denied.5
app Access is denied.5
sec Access is denied.5
sys Access is denied.0
app The operation completed successfully.0
sec The operation completed successfully.0
sys The operation completed successfully.0
app The operation completed successfully.0
sec The operation completed successfully.0
sys The operation completed successfully.0
app The operation completed successfully.0
sec The operation completed successfully.0
sys The operation completed successfully.

Please advise.

Top
#19614 - 2002-04-06 04:39 AM Re: i must be missing something simple...help
Les Offline
KiX Master
*****

Registered: 2001-06-11
Posts: 12734
Loc: fortfrances.on.ca
First off... I didn't realize you were backing up to the same box that the logs are on. I saw the UNC and assumed you just 'sterilized' the names and that it was backing up to a central repository.
I notice between your first and last post that the share name is different. In the first it's a visible share, while in the last it's hidden.
One small point. When using a $ in quotes always double them up as:
backupeventlog('\\' + $server + '\Application', '\\' + $server + '\evtlogs$$\' + $appname)

I suggest you try it with a local path with drive letter instead of UNC.
_________________________
Give a man a fish and he will be back for more. Slap him with a fish and he will go away forever.

Top
#19615 - 2002-04-09 01:44 AM Re: i must be missing something simple...help
wrcwrx Offline
Fresh Scripter

Registered: 2002-03-12
Posts: 9
Loc: San Francisco, CA
just as the title says i was missing something simple.

using the local path worked!

Thank You for all your help!!
Cheers

Top
Page 1 of 1 1


Moderator:  Jochen, Allen, Radimus, Glenn Barnas, ShaneEP, Ruud van Velsen, Arend_, Mart 
Hop to:
Shout Box

Who's Online
0 registered and 937 anonymous users online.
Newest Members
Viginette, ManuvdWielNL, Sir_Barrington, batdk82, StuTheCoder
17888 Registered Users

Generated in 0.054 seconds in which 0.024 seconds were spent on a total of 12 queries. Zlib compression enabled.

Search the board with:
superb Board Search
or try with google:
Google
Web kixtart.org