Copying Data From Tape Back Into Sentinel Log Manager - Novell SENTINEL LOG MANAGER 1.0.0.5 - ADMINISTRATION GUIDE 03-31-2010 Administration Manual

have a
.log
a extension. After being compressed, they are moved to archive storage and are no longer
.zip
present in the local storage.
The directory hierarchy in which the raw data files are placed is organized by the event source and
the date of the raw data. You can use this hierarchy to periodically copy a batch of raw data files to
tape. For more information on raw data directory hierarchy, see
Structure," on page
You should wait until raw data files have been compressed and moved to archive storage before
copying them to tape. Make sure that they are not in the process of being compressed or copied
when you copy them to tape (if there is still a
file is still being created). At the same time, the raw data files must be copied before the Sentinel
Log Manager Raw Data Retention Policy expires so that you avoid losing the data.
Copying Event Data to Tape
Event data partitions are created every 24 hours, but they are not closed for roughly 48 hours (in
case some data arrives late). Event data is stored in the
subdirectory names prefixed with the year, month, and day when the partition was created
(yyyymmdd). For example, the path to a complete event data partitions, relative to the installation
directory, is
use this hierarchy to know when a partition is closed and subdirectories whose date is at least 48
hours old should be in the closed state.
For more information on event data directory hierarchy, see
Structure," on page
You should wait until event data partitions have been copied to archive storage before copying them
to tape. Before you copy, make sure that the directory is not currently being copied from local
storage. To do this, see if there is a local storage directory partition of the same name. If the
corresponding local storage directory partition is not present, the archive directory partition is not
being copied. If the corresponding local storage directory partition is still present, make sure that all
of the files in the local storage directory partition are also in the archive directory partition and that
they are all of the same size. If they are all present and of the same size, it is highly likely that they
are not currently being copied.

3.7.6 Copying Data from Tape Back Into Sentinel Log Manager

This section discusses how to restore data that was deleted from Sentinel Log Manager due to the
data retention time elapsed, but backed up to tape.
NOTE: Current version of Sentinel Log Manager does not fully support restoring deleted data
partitions. As a result, you will find that after restoring the partition and updating the database to
reactivate the partition, Sentinel Log Manager will reapply the retention policy to it the next time it
runs the policy check tasks. The policy check tasks are executed on the following intervals:
For Raw Data: Every 1 hour policy check starts when the Sentinel Log Manager starts. This is
configurable by setting the
server.xml
data files, so increasing this value will also increase the size of the raw data file. Due to the
presence of two different time range, raw data files in your system may cause confusing
behavior.
44 Sentinel Log Manager 1.0.0.4 Administration Guide
extension. Sometime after they are closed, they will be compressed and will then have
22.
data/eventdata/20090101_408E7E50-C02E-4325-B7C5-2B9FE4853476
25.
RawDataConsumer.fileSpanMinutes
file. However, the same property is used to determine the time range of the raw
Table 3-1, "Raw Data Directory
file of the same name, it is likely that the
.log
data/eventdata
Table 3-3, "Event Data Directory
.zip
directory with
. You can
property in the
config/