Log Backup Template

The Log Backup Template enables you to backup native Event Log Files (.evtx files) and, for backwards compatibility, text log files such as CSV and W3C logs.

If you are creating a new template to backup text log files, use the File Collection and Retention Template instead of this template.

How it works:

There are two methods which Event Log Files can be backed up:

• Microsoft's WMI in tandem with Windows Shares
• Corner Bowl's Server Manager Agent

WMI is Microsoft's premier technology for remote management often plagued with errors and security hurtles, however, in tandem with Windows Shares, Event Log Files can be backed up out-of-the-box. When using WMI to backup Event Log Files, the Event Log Files are first backed up to the remote machine then, using Windows Shares, downloaded to the final target destination. This format requires both WMI and Windows Shares be enabled an operational. If WMI is enabled and operational but Windows Shares are not, the The File Exists error is thrown.

The Corner Bowl Server Manager Agent resolves these issues by providing reliable Event Log File Backups with enhancements such as compressing files prior to being uploaded. The downside to using the agent is that is must be installed on each managed server.

Using WMI

Server Manager comes pre-installed with a Event Log Backup template that downloads then compresses the Application, Security and System Event Logs. You have the option of extending this template or creating your own.

How to Configure WMI-Based Event Log File Backups

• From the Explorer View, expand Templates | Sample Templates | Log Consolidation then right click on Event Log Backup and select Template Properties.
• The Template Properties view contains 5 tabs.
  • General
  • Logs
  • Options
  • Agent Template
  • Actions

By default, this template downloads files once a day and evenly distributes each download over the day among the assigned hosts. For example, if you assign 24 hosts to this template the software will download logs form a single and different server every hour. After 24 hours the first server will be downloaded again.

The Options Tab

• Use the Backup check box to enable the backup.

  If leave this option de-selected but select the Clear check box, the Event Log File will be cleared rather than backed up.

• Use the Filename text box to specify the location to save the Event Log Files. The filename can include variables tags such as, {HOST}, {LOG}, {DATE}, {TIME}, {YEAR}, {MONTH}, {DAY} and so on. Click the Variable button to select from a list of available variables.

  Do not specify the filename extension. The extension is determined by the selected options.

• Use the Compress check box to compress the file to ZIP format.
• Use the Encrypt check box to encrypt the file. Use the Password text box to specify the password. If zipping the file, the file is zipped and encrypted using 7-ZIP format, otherwise, the file is encrypted using a Rijndael. To open a Rijndael encrypted file select File | Open from the Management Console.
• Use the Digitally sign check box to specify a certificate to sign the file with. Use the Certificate text box to specify the digital signature. Use the Password text box to specify the digital signature's password.
• Use the Delete files check box to automatically delete old Event Log File backups then specify the maximum number of days to retain.
• Use the Clear check box to clear the Event Log File once backed up or if not backing up, to clear the Event Log File.

Using the Agent

Server Manager comes pre-installed with an Agent-Based Event Log Backup template that requests managed servers to compress and upload their Application, Security and System Event Log Files on a daily basis. You have the option of extending this template or creating your own.

How to Configure Agent-Based Event Log Backup

For more information see: Agent Server

Related Topics

File Collection and Retention Template

Agent Server

Log Management Templates