Log Backup Template

The Log Backup Template enables you to backup and archive native Event Log Files (.evtx files). This Template is typically used by ISSMs that are required to implement JSIG compliance.

Tutorials

How it works:

There are two methods which Event Log Files can be backed up:

• Microsoft's WMI in tandem with Windows Shares
• Corner Bowl's Server Manager Agent

WMI is Microsoft's premier technology for remote management often plagued with errors and security hurtles, however, in tandem with Windows Shares, Event Log Files can be backed up out-of-the-box. When using WMI to backup Event Log Files, the Event Log Files are first backed up to the remote machine then, using Windows Shares, downloaded to the final target destination. This format requires both WMI and Windows Shares be enabled an operational. If WMI is enabled and operational but Windows Shares are not, the The File Exists error is thrown.

The Corner Bowl Server Manager Agent resolves these issues by providing reliable Event Log File Backups with enhancements such as compressing files prior to being uploaded. The downside to using the agent is that is must be installed on each managed server.

Using WMI

Server Manager comes pre-installed with a Event Log Backup template that downloads then compresses the Application, Security and System Event Logs. You have the option of extending this template or creating your own.

How to Configure WMI-Based Event Log File Backups

• From the Explorer View, expand Templates | Sample Templates | Log Consolidation then right click on Event Log Backup and select Template Properties.
• The Template Properties view contains 5 tabs.
  • General
  • Logs
  • Options
  • Agent Template
  • Actions

The Options Tab

• Use the Backup check box to enable the backup.

• Use the Filename text box to specify the location to save the Event Log Files. The filename can include variables tags such as, {HOST}, {LOG}, {DATE}, {TIME}, {YEAR}, {MONTH}, {DAY} and so on. Click the Variable button to select from a list of available variables.

• Use the Compress check box to compress the file to ZIP format.
• Use the Encrypt check box to encrypt the file. Use the Passwordtext box to specify the password. If zipping the file, the file is zipped and encrypted using 7-ZIP format, otherwise, the file is encrypted using a Rijndael. To open a Rijndael encrypted file select File | Open from the Management Console.
• Use the Digitally sign check box to specify a certificate to sign the file with. Use the Certificate text box to specify the digital signature. Use the Password text box to specify the digital signature's password.
• Use the Delete files check box to automatically delete old Event Log File backups then specify the maximum number of days to retain.
• Use the Clear check box to clear the Event Log File once backed up or if not backing up, to clear the Event Log File.
• Use the Auto-archive controls when clearing logs to automatically backup and clear Event Log files when their size exceeds the configured threshold.
  Note

  The file size is scanned once a minute.

Using the Agent

Server Manager comes pre-installed with an Agent-Based Event Log Backup template that requests managed servers to compress and upload their Application, Security and System Event Log Files on a daily basis. You have the option of extending this template or creating your own.

How to Configure Agent-Based Event Log Backup

For more information see: Agent Server

Related Topics

File Collection and Retention Template

Agent Server

Log Management Templates