The only way to have event log files backuped as regular files is to
copy them to an alternate location. You define a wintask for eg 
that copy them before backup to run.
If not, eventlog files are part of system savesets and not browsable
individually. It is the same as for AD logon scripts (netlogon$), 
backuped under sysvol.

The easiest way to recover is to work with temp vmware windows image,
out of your AD domain. Recover by overwritting system saveset WITHOUT
rebooting and move the files you need. Then destroy the vmware image.

HTH

Th
 

-----Original Message-----
From: EMC NetWorker discussion [mailto:NETWORKER AT LISTSERV.TEMPLE DOT EDU] On
Behalf Of JGillTech
Sent: lundi 20 juillet 2009 6:32
To: NETWORKER AT LISTSERV.TEMPLE DOT EDU
Subject: [Networker] Windows 2008 w/ Domain Services - Backup Suggestions?

I am currently running two Global Catalog servers for my domain.  I have the
following savesets configured: 

C:\Users
C:\Windows\System32\winevt\Logs
C:\Windows\System32\LogFiles
VSS SYSTEM BOOT:\
VSS SYSTEM SERVICES:\

I hoped to simplify this by using the All save group, but was not able to
recover system event logs on an individual basis without restoring an entire
VSS save set (a component of the All saveset).  The ability to restore
system logs on an individual basis is needed... but there doesn't seem to be
a good solution.  By that I mean a solution that doesn't comprise
flexibility.  Anyone with a similiar configuration want to share their
backup strategy (save sets + rationale)?

+----------------------------------------------------------------------
|This was sent by Jonathan.Gill AT uconn DOT edu via Backup Central.
|Forward SPAM to abuse AT backupcentral DOT com.
+----------------------------------------------------------------------

To sign off this list, send email to listserv AT listserv.temple DOT edu and 
type
"signoff networker" in the body of the email. Please write to
networker-request AT listserv.temple DOT edu if you have any problems with this
list. You can access the archives at
http://listserv.temple.edu/archives/networker.html or via RSS at
http://listserv.temple.edu/cgi-bin/wa?RSS&L=NETWORKER

To sign off this list, send email to listserv AT listserv.temple DOT edu and 
type "signoff networker" in the body of the email. Please write to 
networker-request AT listserv.temple DOT edu if you have any problems with this 
list. You can access the archives at 
http://listserv.temple.edu/archives/networker.html or
via RSS at http://listserv.temple.edu/cgi-bin/wa?RSS&L=NETWORKER