Administration Guide › Log Storage › Manually Restoring Archives to the Original Event Log Store

Manually Restoring Archives to the Original Event Log Store

You may occasionally need to restore cold database files for querying or reporting to the archive directory on a CA User Activity Reporting Module server. This may be required to investigate a security breach or for an annual or semi-annual compliance audit. The procedures you use depend on the following two factors:

• Whether you used auto-archive to back up the files you now want to restore
• Whether you are restoring the files to the original reporting server or to a different server, such as a dedicated restore point server

  If restoring to a different server, see "Restoring Archives to a New Event Log Store."

When you are restoring files to the original reporting server, use the following procedures:

1. Prepare to restore archived databases by identifying the files to restore and determining the archive directory.
2. Move the databases from external storage to the archive directory on either the remote server location you configured for auto-archive or to the original reporting server.
3. If you moved the archived files to the remote storage server configured for auto-archiving, log on to the reporting CA User Activity Reporting Module and restore the auto-archived files from the remote storage server with the restore-ca-elm.sh script.
4. If you moved the archived files to the archive directory on their original reporting CA User Activity Reporting Module server, restore the manually archived files with LMArchive utility.
5. Verify that the defrosted database can be queried by running a query with the end date set to the date of the restored database and examining the query results.

More information

Prepare to Restore Archived Databases

Move Archived Databases to an Archive Directory

Restore Auto-Archived Files

Restore Manually Archived Files

Verify Restoration