Quantcast
Channel: THWACK: Message List - Security Event Manager (SEM) - Formerly Log & Event Manager
Viewing all articles
Browse latest Browse all 5385

Re: import Solarwind LEM Logs

$
0
0

Sandeep,

 

First, you'll need to work with Support to get LEM logs restored for review, research and reporting.  It requires root access to the LEM appliance, and restoring logs (as of May 30) isn't something an end-user can do.

 

Second, when you restore logs, they will replace what is currently on the LEM appliance, which could lead to data loss.  Ideally, you'd spin up a second LEM instance for reviewing restored logs.  Fortunately, this new instance doesn't require any licensing, and should be able to work with the minimum machine specs as it won't be receiving or normalizing new data.  That means it should be cheap-as-free to spin up a LEM VM to work as a data warehouse.

 

Third, LEM log backups are version specific.  The VM you spin up to restore the logs needs to be the same version that created the log archives in the first place.  You should be able to find links to past versions in your customer portal.

 

Hope that helps!


Viewing all articles
Browse latest Browse all 5385

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>