Event Logs

  • Thread starter Thread starter luvnolan
  • Start date Start date
L

luvnolan

I need to search the security event log from a month ago but the log has been
long over-written on the server. Assuming I have a full backup (including
what backup exec calls "system state" is there a way to restore the log files
without restoring the entire server (it is a domain controller).
 
Hello luvnolan,

Event logs are not included in the sytem state backup.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> I need to search the security event log from a month ago but the log
> has been long over-written on the server. Assuming I have a full
> backup (including what backup exec calls "system state" is there a way
> to restore the log files without restoring the entire server (it is a
> domain controller).
>
 
You can restore the files in windows\system32\config to another location on
the server and try reading them,
Anthony,
http://www.airdesk.co.uk


"luvnolan" <luvnolan@discussions.microsoft.com> wrote in message
news:7E3FE17A-8F03-4928-B91B-2E697A20F3EF@microsoft.com...
>I need to search the security event log from a month ago but the log has
>been
> long over-written on the server. Assuming I have a full backup (including
> what backup exec calls "system state" is there a way to restore the log
> files
> without restoring the entire server (it is a domain controller).
>
 
Sorry, I forgot to mention in my initial question that the .evt files in the
config folder are not on the tape because they are in use and therefore
cannot be backed up in the traditional "file backup" method which is why I'm
hoping one of the system state or sysvol backups captures the logs (but I'm
beginning to think I'm just out of luck!)

Thanks for trying to help.

"Anthony [MVP]" wrote:

> You can restore the files in windows\system32\config to another location on
> the server and try reading them,
> Anthony,
> http://www.airdesk.co.uk
>
>
> "luvnolan" <luvnolan@discussions.microsoft.com> wrote in message
> news:7E3FE17A-8F03-4928-B91B-2E697A20F3EF@microsoft.com...
> >I need to search the security event log from a month ago but the log has
> >been
> > long over-written on the server. Assuming I have a full backup (including
> > what backup exec calls "system state" is there a way to restore the log
> > files
> > without restoring the entire server (it is a domain controller).
> >
>
>
>
 
Back
Top