SQL Query - Files being pulled from archive

[Prazak]

Hi All,

I'm running (testing) EV 7.0 FSA.

I'm looking for SQL queries that will tell me what files are being retrieved from archive.

[MichelZ]

There is no such thing AFAIK, EV does not record this information.

/Michel

[Glenn_Martin]

If you turn Audit on for the EV server in question, it does log access information such as date, user and the actual file which being recalled, this is shown in the 'info' field, it's not perfect but it does give you something.

For more on auditing see the following.

The following technote explains how to turn on Auditing

http://seer.entsupport.symantec.com/docs/285115.htm

Once you’ve enabled auditing, a separate DB will log activity and you can then run queries against the DB to find out what level of activity is occurring,
 

You will also need to think about truncating the Audit DB because it does grow and doesn’t automatically expire audit events, the following article explains this.

http://seer.entsupport.symantec.com/docs/273274.htm

[Prazak]

Glenn,

Thanks for the reply.  I had already turned on audit, but wasn't able to find the info you reported in the "info" field running the "select * from evauditview order by auditdate desc" query?  I have since upgrade to EV 2007 after reading about the FSA reports.  I'm still not getting the info I'm looking for?  Either in the audit database or from the FSA reports.  Would querying the audit database after upgrading to 2007 still be valid?  I recalled some items from archive yesterday, and don't see anything in the audit database today?  Both after a archive run and FSA reporting scan?  Thanks again for any input.