10-03-2012 10:08 AM
Windows 2003 Server
Client 7.1.03
Restored event logs from shadowcopy components to d:\restore\eventlogs - alternate location by chosing option "over write files"
Restore completed and it says it restored 4 file. However we do not see the files in the folder nor do we see the folder. So we looked at the default event logs folder and the files are there. Now the server is asking for a reboot.
Why didnt it restore to the location it said it did? see below....
11:53:12 10/3/2012: Restore Started
11:53:18 (962191.xxx) Restore job id 962191 will require 1 image.
11:53:19 (962191.xxx) Media id XXXXXX is needed for the restore.
11:53:24 (962191.001) Restoring from copy 2 of image created 9/27/2012 4:30:58 AM
11:53:28 (962191.001) INF - If Media id XXXXXX is not in a robotic library administrative interaction may be required to satisfy this mount request.
11:53:30 (962191.001) INF - Waiting for mount of media id XXXXXX on server XXXXXXXX for reading.
11:53:36 (962191.001) INF - TAR STARTED 31200
11:54:37 (962191.001) INF - Waiting for positioning of media id XXXXXX on server XXXXXX for reading.
11:55:30 (962191.001) INF - Beginning restore from server XXXXXX to client XXXXXXX.
11:55:31 (962191.001) TAR - Shadow Copy Components:\
11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\
11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\Event Logs\
11:55:34 (962191.001) WRN - System needs to be rebooted for restored object to take effect: Shadow Copy Components:\System Service\Event Logs\
11:55:34 (962191.001) TAR - Shadow Copy Components:\System Service\Event Logs\Event Logs
11:55:34 (962191.001) MNR - The object was re-directed to:
11:55:34 (962191.001) UTF - D:\Restore\Event Logs
11:55:37 (962191.001) WRN - System needs to be rebooted for restored object to take effect: Shadow Copy Components:\System Service\Event Logs\Event Logs
11:55:38 (962191.001) INF - TAR EXITING WITH STATUS = 0
11:55:38 (962191.001) INF - TAR RESTORED 4 OF 4 FILES SUCCESSFULLY
11:55:38 (962191.001) INF - TAR KEPT 0 EXISTING FILES
11:55:38 (962191.001) INF - TAR PARTIALLY RESTORED 0 FILES
11:55:38 (962191.001) INF - A REBOOT OF THE MACHINE IS REQUIRED FOR ALL FILES TO TAKE EFFECT.
11:55:38 (962191.001) Status of restore from copy 2 of image created 9/27/2012 4:30:58 AM = the requested operation was successfully completed
11:55:42 (962191.xxx) INF - Status = the requested operation was successfully completed.
10-03-2012 10:44 AM
Seems NBU behaviour was changed across versions.
I have personally used this method in version 6.x and also reommended it here:
https://www-secure.symantec.com/connect/forums/event-logs-restoration-alternate-location#comment-292...
TNs: http://www.symantec.com/docs/TECH87098
I would log a support call if I were in your shoes.
10-03-2012 11:40 AM
logged a call with Symantec. Hope i get some answer soon.