Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Event Logs Restoration at alternate Location

Created: 31 Aug 2009 • Updated: 21 May 2010 | 2 comments
Twinkle Sapra's picture
This issue has been solved. See solution.

I want to restore the Event logs files (C:\WINDOWS\system32\config\SysEvent.Evt ) to alternate location.

I tried to find out this file from restore tab, no luck.

After that, i checked Shadow Copy Component --> System Service ---> Event Logs . I started the restore, restore completed successfully but not Event Logs are present at alternate location.

 /usr/openv/netbackup/logs/user_ops logs

07:56:20 (1577092.001) TAR - Shadow Copy Components:\
07:56:20 (1577092.001) MNR - The following file was skipped:
07:56:20 (1577092.001) UTF - Shadow Copy Components:\
07:56:20 (1577092.001) INF - Waiting for positioning of media id ****** on server ******** for reading.
07:56:32 (1577092.001) INF - Continuing restore from server ******** to client ******.
07:56:34 (1577092.001) TAR - Shadow Copy Components:\System Service\
07:56:34 (1577092.001) MNR - The following file was skipped:
07:56:34 (1577092.001) UTF - Shadow Copy Components:\System Service\
07:56:34 (1577092.001) TAR - Shadow Copy Components:\System Service\Event Logs\
07:56:34 (1577092.001) MNR - The object was re-directed to:
07:56:34 (1577092.001) UTF - d:\LogsRestored\********\
07:56:34 (1577092.001) MNR - The following file was skipped:
07:56:34 (1577092.001) UTF - Shadow Copy Components:\System Service\Event Logs\
07:56:34 (1577092.001) TAR - Shadow Copy Components:\System Service\Event Logs\Event Logs
07:56:34 (1577092.001) MNR - The object was re-directed to:
07:56:34 (1577092.001) UTF - d:\LogsRestored\********\
07:56:34 (1577092.001) MNR - The following file was skipped:
07:56:34 (1577092.001) UTF - Shadow Copy Components:\System Service\Event Logs\Event Logs
07:56:36 (1577092.001) (1577092.001) INF - TAR EXITING WITH STATUS = 0
07:56:36 (1577092.001) (1577092.001) INF - TAR RESTORED 0 OF 4 FILES SUCCESSFULLY
07:56:36 (1577092.001) (1577092.001) INF - TAR KEPT 4 EXISTING FILES
07:56:36 (1577092.001) (1577092.001) INF - TAR PARTIALLY RESTORED 0 FILES

I am doubt full now, is it possible to restore EventViewer logs at alternate location ? Please help

Comments 2 CommentsJump to latest comment

Marianne's picture

See this TechNote:
http://seer.entsupport.symantec.com/docs/290134.htm

Supporting Storage Foundation and VCS on Unix and Windows as well as NetBackup on Unix and Windows
Handy NBU Links

SOLUTION
Twinkle Sapra's picture

!!!!!!!!!!!!!!!!!!!!!!!!!!!  Restoration Completed Successfully !!!!!!!!!!!!!!!!!!!!!!!