Open topic with navigation

Archiving Events

To save events for a particular day, you need to add an Event Archive. The table in the Event Archives page shows the current archives and their status.

An archive storage location must be established on the Logger before you can archive its events. This is a one-time configuration. To establish an archive storage location, see Archive Storage Settings.

Guidelines for Archiving Events

• Be sure to run configuration backups as well as event archives regularly, and to store them in a remote location. In the event of catastrophic failure, you will need to restore the most recent configuration backup and event archive. For information on configuration backups, see Configuration Backup and Restore.
• If you need to archive a large number of events (in the order of tens of GB), Micro Focus recommends that you archive during the off-peak hours to prevent impacting the performance of your Logger.

• Events are archived based on the receipt time only.

• Multiple archiving operations such as loading, unloading, archiving, and deletion of archives can occur simultaneously. Therefore, you can initiate the loading of an existing archive, while an archive operation is in progress.

  Tip: Only one manual archive job can run at a time. However, a scheduled archiving operation can run in parallel with a manual job.

• You cannot re-archive the events that have already been archived. If you try to do so, the Logger reports an error.
• Do not move the archived files from their archive location. The archives that have been moved from the originally archived location cannot be loaded on to the Logger. If you need to delete the archives, use the Logger user interface to do so.
• If an archive job fails, you need to initiate it manually. To do so, delete the failed archive and archive it manually. To be notified of a failed archive, configure an alert for this audit event: Event Archive Failed. For more information about this event, see Logger Audit Events. For more information about configuring alerts, see Saved Searches.

• If a Logger Appliance goes down while an archive operation is in progress, you need to re-initiate the archive operation for only the storage groups that were not archived when the operation failed. The status of such storage groups is marked “Failed” in the Status column on the Event Archives page.

  For example, you archive the event data of 12/1/16, which consists of events from four storage groups “Default”, “Internal”, “Short-Term”, and “Long-Term”. The appliance goes down after the events from the “Default” and “Internal” groups have been successfully archived, and the events from “Short-Term” are being archived. The status of the “Short-Term” storage group on the Event Archives page will display “Failed”, while the status of the “Default” and “Internal” groups will display “Archived”. (The status of the “Long-Term” storage group will not be displayed.) In this case, you need to manually re-initiate the archive for the “Short-Term” and “Long-Term” storage groups.

  Note: In the above example, the status of the “Long-Term” storage group is not displayed on the Event Archives page after the failure occurs because archival of this group was never initiated during that archive operation.

  If an archive operation fails, make sure you determine the storage groups that could not be archived and re-initiate the archival for all of those groups manually.

• You can cancel an in-progress archive operation that was manually initiated at any time using the Cancel link that displays on top of the Event Archives page.

To add an Event Archive:

1. Open the Configuration > Storage menu and then click Event Archives.

2. Click Add in the Event Archives page.

3. Enter a meaningful name in the Name field for the new Event Archive and specify the Start and End dates in the format m/dd/yy, where m is month number, dd is the day of the month (with a leading zero if necessary), and yy is the two-digit year number.

   When the Start and End dates are different, one archive file per storage group, for each specified day is created. For example, if you specify the following Start and End dates:

   Start Date: 8/12/19
   End Date: 8/13/19

   Note: If a day's events have already been archived, you will not be able to archive them again. If you try to archive the same day's events twice, Logger will display a message with the already archived day or dates. If you are archiving a range of dates and some of them have been archived, the archive process will complete, skipping any days already archived, and a message will display the already archived dates.

   And, if you configure both storage groups—Internal Event Storage Group and Default Storage Group, four archive files will be created as a result of this archive operation—two files per storage group for the specified two days.

   The Event Archives table (under the Event Archives page) lists the archives by an alias in this format: <archive_name> [<yyyy-m-dd>] [<storage_group_name>].

4. Select the names of storage groups that need to be included in the archive.

5. Click Save to start archiving events, or Cancel to quit.

   Note: You can cancel an in-progress archive operation at any time using the Cancel link that displays on top of the Event Archives page.

To remove an Event Archive:

1. Open the Configuration > Storage menu and then click Event Archives.
2. Select the event archives that you want to delete by clicking the checkbox in the left side.
3. Click Remove from the top of the screen to delete the selected archives.
4. Confirm the deletion by clicking OK, or click Cancel to retain the Event Archive.

To sanitize an Event Archive:

Logger performs a sanitize process to find and fix inconsistencies in your stored data.

1. From the Configuration > Storage menu, click Event Archives.
2. Select the event archives that you want to sanitize by clicking the checkbox on the left side of each row.
3. Click sanitize from the top of the screen. This button will be enabled only when the archive is unloaded.
4. Confirm the action by clicking OK, or click Cancel to dismiss the request.

The sanitize process can take several minutes depending on the size of the archive. For instance, a 26 GB archive with 2 non-consistent metadata can take up to 10 minutes to sanitize. Check the sanitize status for more information:

• None: This is the default value for new archives created or during upgrades.
• Pending: Process has been interrupted or not started.
• Done: Process is successfully completed.
• Failed: Process has failed.

Once the process is completed, Logger displays the logger_archive_sanitization.log which allows you to review the deleted chunks, CSV generated, data files and metadata analyzed, and beginning and end time of execution.