Exporting Windows Event Viewer logs on legacy Operating Systems

Description

Sometimes for troubleshooting purposes the Windows Event Viewer logs will need to be exported.  This document will explain how to do the export.

Detailed Steps (See Installation Guide article)

The steps to do this will be slightly different between versions of Windows.

Windows XP/2003:

1. Open Event Viewer
   1. Open Windows Control Panel
   2. Go to Administrative Tools
   3. Open Event Viewer
2. On the left side of the Window, select the log you want to view (Application, System, etc.).
3. Right click on the name of the log, and select “Save Log File As…”
4. Give a meaningful name to the file, such as the PC name followed by the log type, and save with the *.evt extension.
   1. Example of a good file name would be: MyPC1_ApplicationLog.evt

Windows Vista/7/2008:

1. Open Event Viewer
   1. Open Windows Control Panel
   2. Go to Administrative Tools
   3. Open Event Viewer
2. On the left side of the Window, expand Windows Logs.
3. Select the log you want to view (Application, System, etc.).
4. Right click on the name of the log, and select “Save (All) Events As…”
5. Give a meaningful name to the file, such as the PC name followed by the log type, and save with the *.evtx extension.
   1. Example of a good file name would be: MyPC1_ApplicationLog.evtxFinal Steps – Compressing the file:

Final Steps – Compressing the file:

1. Once the export is finished, find the file on your system and then compress it by right clicking on it and going to Send To > Compressed (zipped) Folder.