Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Restoring Event Logs

Created: 03 Oct 2012 | 2 comments

Windows 2003 Server

Client 7.1.03

Restored event logs from shadowcopy components to d:\restore\eventlogs - alternate location by chosing option "over write files"

Restore completed and it says it restored 4 file. However we do not see the files in the folder nor do we see the folder. So we looked at the default event logs folder and the files are there. Now the server is asking for a reboot.

 

Why didnt it restore to the location it said it did? see below....

 

 

 

11:53:12 10/3/2012: Restore Started

 

11:53:18 (962191.xxx) Restore job id 962191 will require 1 image.

11:53:19 (962191.xxx) Media id XXXXXX is needed for the restore.

 

11:53:24 (962191.001) Restoring from copy 2 of image created 9/27/2012 4:30:58 AM

11:53:28 (962191.001) INF - If Media id XXXXXX is not in a robotic library administrative interaction may be required to satisfy this mount request.

11:53:30 (962191.001) INF - Waiting for mount of media id XXXXXX on server XXXXXXXX for reading.

11:53:36 (962191.001) INF - TAR STARTED 31200

11:54:37 (962191.001) INF - Waiting for positioning of media id XXXXXX on server XXXXXX for reading.

11:55:30 (962191.001) INF - Beginning restore from server XXXXXX to client XXXXXXX.

11:55:31 (962191.001) TAR - Shadow Copy Components:\

11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\

11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\Event Logs\

11:55:34 (962191.001) WRN - System needs to be rebooted for restored object to take effect: Shadow Copy Components:\System Service\Event Logs\

11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\Event Logs\Event Logs

11:55:34 (962191.001) MNR - The object was re-directed to:

11:55:34 (962191.001) UTF - D:\Restore\Event Logs

11:55:37 (962191.001) WRN - System needs to be rebooted for restored object to take effect: Shadow Copy Components:\System Service\Event Logs\Event Logs

11:55:38 (962191.001) INF - TAR EXITING WITH STATUS = 0

11:55:38 (962191.001) INF - TAR RESTORED 4 OF 4 FILES SUCCESSFULLY

11:55:38 (962191.001) INF - TAR KEPT 0 EXISTING FILES

11:55:38 (962191.001) INF - TAR PARTIALLY RESTORED 0 FILES

11:55:38 (962191.001) INF - A REBOOT OF THE MACHINE IS REQUIRED FOR ALL FILES TO TAKE EFFECT.

11:55:38 (962191.001) Status of restore from copy 2 of image created 9/27/2012 4:30:58 AM = the requested operation was successfully completed

 

11:55:42 (962191.xxx) INF - Status = the requested operation was successfully completed.

Comments 2 CommentsJump to latest comment

Marianne's picture

Seems NBU behaviour was changed across versions.
I have personally used this method in version 6.x and also reommended it here: 
https://www-secure.symantec.com/connect/forums/event-logs-restoration-alternate-location#comment-2925871

TNs: http://www.symantec.com/docs/TECH87098

I would log a support call if I were in your shoes.

Supporting Storage Foundation and VCS on Unix and Windows as well as NetBackup on Unix and Windows
Handy NBU Links

BTLOMS's picture

logged a call with Symantec. Hope i get some answer soon.