Guest luvnolan Posted June 2, 2008 Posted June 2, 2008 I need to search the security event log from a month ago but the log has been long over-written on the server. Assuming I have a full backup (including what backup exec calls "system state" is there a way to restore the log files without restoring the entire server (it is a domain controller).
Guest Meinolf Weber Posted June 2, 2008 Posted June 2, 2008 Re: Event Logs Hello luvnolan, Event logs are not included in the sytem state backup. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > I need to search the security event log from a month ago but the log > has been long over-written on the server. Assuming I have a full > backup (including what backup exec calls "system state" is there a way > to restore the log files without restoring the entire server (it is a > domain controller). >
Guest Anthony [MVP] Posted June 2, 2008 Posted June 2, 2008 Re: Event Logs You can restore the files in windows\system32\config to another location on the server and try reading them, Anthony, http://www.airdesk.co.uk "luvnolan" <luvnolan@discussions.microsoft.com> wrote in message news:7E3FE17A-8F03-4928-B91B-2E697A20F3EF@microsoft.com... >I need to search the security event log from a month ago but the log has >been > long over-written on the server. Assuming I have a full backup (including > what backup exec calls "system state" is there a way to restore the log > files > without restoring the entire server (it is a domain controller). >
Guest luvnolan Posted June 2, 2008 Posted June 2, 2008 Re: Event Logs Sorry, I forgot to mention in my initial question that the .evt files in the config folder are not on the tape because they are in use and therefore cannot be backed up in the traditional "file backup" method which is why I'm hoping one of the system state or sysvol backups captures the logs (but I'm beginning to think I'm just out of luck!) Thanks for trying to help. "Anthony [MVP]" wrote: > You can restore the files in windows\system32\config to another location on > the server and try reading them, > Anthony, > http://www.airdesk.co.uk > > > "luvnolan" <luvnolan@discussions.microsoft.com> wrote in message > news:7E3FE17A-8F03-4928-B91B-2E697A20F3EF@microsoft.com... > >I need to search the security event log from a month ago but the log has > >been > > long over-written on the server. Assuming I have a full backup (including > > what backup exec calls "system state" is there a way to restore the log > > files > > without restoring the entire server (it is a domain controller). > > > > >
Recommended Posts