Solved

Event log back up / Retrieval from ArcSight Logger appliance

Posted on 2013-12-03
4
1,506 Views
Last Modified: 2013-12-09
I would like to know if it's possible to retrieve event logs from an old ArcSight Logger?   I read that by default, the ArcSight Logger does not back up any content but will back up 'All non-event data' and 'Report content' which includes:

• System Information
• Logs
• Global Settings
• User and Group Information
• All Configuration Settings
• Existing Filters and Saved Searches
• Logger Monitor settings
The following Reports content:
• Queries, Reports, Parameters,
Parameter Value Groups, Dashboard
• Templates

I am looking to extract this information if possible to prepare for an upcoming inspection.  Any information would greatly appreciated.

Cheers,
Larry
0
Comment
Question by:holby
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 29

Accepted Solution

by:
fibo earned 500 total points
ID: 39696311
Not sure I understand: are you looking for the place where these logs would be?
- usually /var/log is a good place to start
- you can also hunt at /etc/logrotate.d which handles nicely some logs (but be careful here!)

As usual
locate *.log
is your best friend (but do not forget
updatedb
)
0
 

Author Comment

by:holby
ID: 39696378
Yes I am looking for the location on the logger where these event logs are stored by default.  We moved away from ArcSight because it was a very convoluted product and extremely difficult to learn unless you were an expert using Unix.  We have since moved to a McAfee Nitro Security appliance and this product is much nicer and is less cumbersome.  Just need to be able to extract the event logs off the logger in case we need to present them for our upcoming inspection.
0
 
LVL 29

Expert Comment

by:fibo
ID: 39697645
What gives locate *.log?
0
 
LVL 29

Expert Comment

by:fibo
ID: 39706700
B-) Glad I could help. Thx for the grade and points
Bernard
0

Featured Post

[Live Webinar] The Cloud Skills Gap

As Cloud technologies come of age, business leaders grapple with the impact it has on their team's skills and the gap associated with the use of a cloud platform.

Join experts from 451 Research and Concerto Cloud Services on July 27th where we will examine fact and fiction.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When it comes to protecting Oracle Database servers and systems, there are a ton of myths out there. Here are the most common.
Recently, Microsoft released a best-practice guide for securing Active Directory. It's a whopping 300+ pages long. Those of us tasked with securing our company’s databases and systems would, ideally, have time to devote to learning the ins and outs…
Learn how to get help with Linux/Unix bash shell commands. Use help to read help documents for built in bash shell commands.: Use man to interface with the online reference manuals for shell commands.: Use man to search man pages for unknown command…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question