For my environment, NT event logs are not critical to operations, so I
can't ever envision restoring one.  All of my NT clients will continue to
operate just fine with a blank or new event log.  If one was deleted
unintentionally or maliciously, I wouldn't necessarily need to restore it
to the original client just as long as I could view the data, if necessary.
For a few clients where I wish to keep some event history or the
information in them is deemed critical enough to be saved, I use DUMPEL.EXE
from the NT resource kit to dump the event logs to a flat file, scheduled
with a script.

If I ever lose a client or the event logs, I just start out with new empty
logs.  If I ever need to view old information from that client's logs, I
can view the file from the DUMPEL command, or restore that file from TSM if
it was deleted.  I exclude the event logs from normal backup, but I do
backup the files that were dumped with the DUMPEL command.

Just a different perspective, I guess.


===========================================
    John Monahan
    Network Administrator
    Liberty Diversified Industries
    (763) 536-6677
===========================================




                    Toni Banire
                    <Toni_T_Banire@S        To:     ADSM-L AT VM.MARIST DOT EDU
                    BPHRD.COM>              cc:
                    Sent by: "ADSM:         Subject:     eventlogs again
                    Dist Stor
                    Manager"
                    <[email protected]
                    T.EDU>


                    09/12/00 08:11
                    AM
                    Please respond
                    to "ADSM: Dist
                    Stor Manager"





I sent this out a couple of days ado, I haven't had a response to it yet.

      I have found out that one can't restore an open eventlog unless you
use
      the eventb command. I am trying to set this up for a few hundred NT
      clients.
      I thought maybe I could add the command to the options file for each
      client but that didn't work, I also tried scheduling it by linking it
to a
      mgt class with all the clients in it. I put eventback entire in the
      options field on the GUI. no joy.

      Does anyone out there do this already, or can anyone shed light on
how
      best to go about this


So here it is again


TIA


Toni