Solved

Restore event viewer from system state backup

Posted on 2008-06-10
5
4,953 Views
Last Modified: 2013-12-01
I need to view some auditing logs from the security section of my event viewer.  The current event log was overwritten before the day I need to review.  I'm wondering if I can pull the event viewer from last weekend's backup through Backup Exec11d to view last weeks events.  The Saturday Full backup is set to include System State (Registry, System Files, SYSVOL, etc).  

The file I need is "C:\WINDOWS\system32\config\SecEvent.Evt"

Can I pull the event viewer out of that backup?  I don't want to restore the complete registry or system files to overwrite the current system.  I only need to view the event viewer as it was on Saturday.  If this is possible, please advise.


Thanks
0
Comment
Question by:KevinITadmin
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 3

Accepted Solution

by:
patrickfromsc earned 250 total points
ID: 21754876
If that folder was set to be backed up, then that file should be available.  When you configure your restore job, specifiy for it to restore to an alternate location... like c:\temp.  Then dig down into the catalog and locate that file.  The restore should only pull that file from the media, and should restore it safely to the alternate location.

Regards,
PfSC
0
 

Author Comment

by:KevinITadmin
ID: 21754949
unfortunately I cannot select to restore to an alternate location.   Here are my options

1)  Overwrite file on disk
2)  Skip it, do not overwrite the file on disk
3)  Overwrite the file on disk only if it is older

I've attached a screenshot as well.
restore-options.JPG
0
 

Author Comment

by:KevinITadmin
ID: 21755091
Quick update, I did a manual restore rather than using the Wizard and I was able to use the file redirection to restore to an alternate location.  

The system state restored successfully but apparantly did not backup the event log files.  It lets me browse the restored files to "C:\WINDOWS\system32"  but there is no "config" folder where Windows stores the logs.  

I think that was my only hope.
0
 
LVL 3

Expert Comment

by:patrickfromsc
ID: 21755484
You are not exlicitly backing up the "C:\WINDOWS\system32" folder?  If so, you should be able to drill down to the exact file from Saturday's job and restore it.

Secondly... are you using Volume Shaow Copies?  If so, that file will be recoverable from there quite easily.  If not, let me strongly advise you to enable this feature.  It uses spare disk space, and makes restores like this trivial.  Just right-click on your drive letters under My Computer, select Properties, and enable it from the Shadow Copies tab.  You do not need a lot of free space on the drive to do this, like you might think, as it is really making copies of the hard links, not the files themselves.
0
 

Author Comment

by:KevinITadmin
ID: 21755546
I did not specifically backup the C:\windows\system32" directory.  When I restored the "system state" from saturdays backup, I browsed the contents of the restore and under a folder called "system files" was the Windows directory.   I also searched the contents of the restored system state for (*.evt) and nothing came up.  Apparently system state does not include event logs.

I've never used Volume shadow copy but I will enable it and play around with it.
0

Featured Post

Portable, direct connect server access

The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
HP H221 HBA with P2000 trouble configuring 4 87
Windows Server failure RAID 31 98
Repair SAS HDD 5 85
RAM required? 6 38
By default, Carbonite Server Backup manages your encryption key for you using Advanced Encryption Standard (AES) 128-bit encryption. If you choose to manage your private encryption key, your backups will be encrypted using AES 256-bit encryption.
Data center, now-a-days, is referred as the home of all the advanced technologies. In-fact, most of the businesses are now establishing their entire organizational structure around the IT capabilities.
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through the process of installing the necessary services and then configuring a Windows Server 2012 system as an iSCSI target. To install the necessary roles, go to Server Manager, and select Add Roles and Featu…

740 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question