cancel
Showing results for 
Search instead for 
Did you mean: 

Restoring Event Logs

BTLOMS
Level 5

Windows 2003 Server

Client 7.1.03

Restored event logs from shadowcopy components to d:\restore\eventlogs - alternate location by chosing option "over write files"

Restore completed and it says it restored 4 file. However we do not see the files in the folder nor do we see the folder. So we looked at the default event logs folder and the files are there. Now the server is asking for a reboot.

 

Why didnt it restore to the location it said it did? see below....

 

 

 

11:53:12 10/3/2012: Restore Started

 

11:53:18 (962191.xxx) Restore job id 962191 will require 1 image.

11:53:19 (962191.xxx) Media id XXXXXX is needed for the restore.

 

11:53:24 (962191.001) Restoring from copy 2 of image created 9/27/2012 4:30:58 AM

11:53:28 (962191.001) INF - If Media id XXXXXX is not in a robotic library administrative interaction may be required to satisfy this mount request.

11:53:30 (962191.001) INF - Waiting for mount of media id XXXXXX on server XXXXXXXX for reading.

11:53:36 (962191.001) INF - TAR STARTED 31200

11:54:37 (962191.001) INF - Waiting for positioning of media id XXXXXX on server XXXXXX for reading.

11:55:30 (962191.001) INF - Beginning restore from server XXXXXX to client XXXXXXX.

11:55:31 (962191.001) TAR - Shadow Copy Components:\

11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\

11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\Event Logs\

11:55:34 (962191.001) WRN - System needs to be rebooted for restored object to take effect: Shadow Copy Components:\System Service\Event Logs\

11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\Event Logs\Event Logs

11:55:34 (962191.001) MNR - The object was re-directed to:

11:55:34 (962191.001) UTF - D:\Restore\Event Logs

11:55:37 (962191.001) WRN - System needs to be rebooted for restored object to take effect: Shadow Copy Components:\System Service\Event Logs\Event Logs

11:55:38 (962191.001) INF - TAR EXITING WITH STATUS = 0

11:55:38 (962191.001) INF - TAR RESTORED 4 OF 4 FILES SUCCESSFULLY

11:55:38 (962191.001) INF - TAR KEPT 0 EXISTING FILES

11:55:38 (962191.001) INF - TAR PARTIALLY RESTORED 0 FILES

11:55:38 (962191.001) INF - A REBOOT OF THE MACHINE IS REQUIRED FOR ALL FILES TO TAKE EFFECT.

11:55:38 (962191.001) Status of restore from copy 2 of image created 9/27/2012 4:30:58 AM = the requested operation was successfully completed

 

11:55:42 (962191.xxx) INF - Status = the requested operation was successfully completed.

2 REPLIES 2

Marianne
Level 6
Partner    VIP    Accredited Certified

Seems NBU behaviour was changed across versions.
I have personally used this method in version 6.x and also reommended it here: 
https://www-secure.symantec.com/connect/forums/event-logs-restoration-alternate-location#comment-292...

TNs: http://www.symantec.com/docs/TECH87098

I would log a support call if I were in your shoes.

BTLOMS
Level 5

logged a call with Symantec. Hope i get some answer soon.