In the following code, for some reason the copy-item event doesn't copy any of the event logs saved on a server. The script is designed to make a copy of a server's event logs to a particular folder on that server and then those are copied to a central server in the server's subdirectory. Another odd behavior with the copy-item is that I only want the files to copy to the destination but it also copies the folder structure from the source. Thank you, Kurt **********************************************************************************
exit
Import-Module
ActiveDirectory
$LogsArchive
="\\server1\Utilities_f\event_log_save"
Function
Get-Servers
{
$DomainControllers= @(
"domain1.local"
"domain2.local"
)
$servers= @()
foreach ($dcin$DomainControllers) {
$servers+=Get-ADComputer-LDAPFilter"(&(objectcategory=computer)(OperatingSystem=*server*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(!(name=*w2k8*)))"-Server$dc|select Name }
#$servers = $servers | sort Name
$servers="server2" #testing
return$servers }
#end Get-Servers
Function
Test-ComputerConnection
{
ForEach ($Computerin$Computers) {
$Result=Get-WmiObject-Class win32_pingstatus -Filter"address='$computer'"
If ($Result.Statuscode -eq 0) {
if ($computer.length -ge 1) {
Write-Host"+ Processing $Computer"
Get-BackUpFolder
} }
#end if
else { "Skipping $computer .. not accessible" } }
#end Foreach
}
#end Test-ComputerConnection
Function
Get-BackUpFolder
{
$LocalPath="c$\ird_system\event_logs"
$Folder="\\{0}\$LocalPath"-f$computer#"{1}_{0:MMddyymm}" -f [DateTime]::now, $computer
New-Item"$LogsArchive\$computer"-type Directory -force|out-Null
If (!(Test-Path"$Folder")) {
New-Item"$Folder"-type Directory -force|out-Null }
#end if
else
{
Get-ChildItem$Folder-Include"*.ev*"-Recurse|Remove-Item }
Backup-EventLogs($Folder) }
#end Get-BackUpFolder
Function
Backup-EventLogs
{
$Eventlogs=Get-WmiObject-Class Win32_NTEventLogFile -ComputerName$computer
Foreach ($login$EventLogs) {
$path="$Folder\{0}_{2:yyyyMMMMdd}-{1}.evt"-f$Computer, $log.LogFileName,[DateTime]::now
$ErrBackup= ($log.BackupEventLog($path)).ReturnValue
if ($clear) {
if ($ErrBackup-eq 0) {
$errClear= ($log.ClearEventLog()).ReturnValue }
#end if
else
{
"Unable to clear event log because backup failed"
"Backup Error was "+$ErrBackup }
#end else
}
#end if clear
}
#end foreach log
Copy-EventLogsToArchive$Folder$computer }
#end Backup-EventLogs
Function
Copy-EventLogsToArchive($path, $computer) {
$path=$path+"\$computer_*.*"
Copy-Item-path"$path"-dest"$LogsArchive\$computer"-force-Recurse }
# end Copy-EventLogsToArchive
# *** Entry Point To Script ***
$computers = Get-Servers
Test-ComputerConnection
