Administration Guide › Log Storage › About Log Storage
About Log Storage
You can manage two aspects of log storage through CA Enterprise Log Manager:
- Backing up the databases of log files in the archive directory of each reporting server to an archive directory you create on a remote storage server. The remote storage server is an interim location for holding archived databases until they can be moved off-site.
- Restoring the databases of log files from the archive directory on a remote storage server to the original reporting server or a CA Enterprise Log Manager you have dedicated as a restore point server. Once restored, you can examine the contents with queries and reports.
You can manage backups of event log databases in one of two ways:
- (Preferred) Configure CA Enterprise Log Manager to use auto-archive to move warm databases from a CA Enterprise Log Manager reporting server to a remote storage server on a scheduled basis. The auto-archiving process notifies the reporting server that the databases have been backed up.
Note: See "About Auto Archive" in the CA Enterprise Log Manager Implementation Guide.
- Back up the databases on the CA Enterprise Log Manager server manually and copy them to an on-site storage location. Use LMArchive utility to notify the CA Enterprise Log Manager server to mark these databases as backed up.
Moving backed up files to an off-site location is a task you perform outside of CA Enterprise Log Manager, as is the move back to the network, when needed for restoration.
You can query the archive catalog to identify database files to restore. You can restore databases on an as needed basis in one of two ways:
- You can restore them to the original reporting server with either of the following methods:
- If you configure non-interactive authentication between the remote storage server and the original reporting server, run the restore-ca-elm.sh script to restore the archived databases to the original reporting server.
Once the files are restored, query and report on them for the length of time in days configured for the life of warm files.
- If you backed up the archive databases manually, copy the files back to the same archive directory and then notify this CA Enterprise Log Manager of the restoration. You use an option of the LMArchive command-line utility to inform CA Enterprise Log Manager that the databases are restored.
Once the files are restored, query and report on them for the length of time in hours configured for the life of defrosted files.
- You can restore archived databases to a restore point server dedicated to examining restored event logs, with either of the following methods.
- If you configure non-interactive authentication from the remote storage server to the CA Enterprise Log Manager restore point, you can run the restore-ca-elm.sh script to restore archived databases to the restore point.
- If you have not configured non-interactive authentication, manually copy the archive databases from the remote storage server to the archive directory of the restore point server. Then, notify this CA Enterprise Log Manager of the restoration with a Recatalog from the Archive Catalog Query in the Log Collection Explorer.
This notification results in the rebuilding of the catalog, which makes the database files available for querying and reporting. This availability is contingent on the age in days configured for warm files before deletion being set to a value that exceeds the age of the restored files. Therefore, it is important that the maximum age for warm files is set appropriately on any dedicated restore point.
More information:
Log Storage
About Auto Archive
Example: Auto-Archiving Across Three Servers
Configuring Non-Interactive Authentication for Restore
Restore Auto-Archived Files
Manually Backing Up Archived Databases
Configure Max Archive Days for Restored Archives
Manually Restoring Archives to the Original Event Log Store
Manually Restoring Archives to a New Event Log Store
Restore–Script for Restoring Archived Databases
LMArchive–Backup/Restore Tracking
