Archiving Log Messages

In the Archive tab of the Audit Logger, you can define criteria to archive specified log messages in the Audit Logger File Store. You also have the option of saving specified criteria as an Audit Logger Archive Task for future use. When TLC archives log messages, it copies the files in the Audit Logger File Store to the location specified by the Output path field in the Archive Criteria tab (see Table 82). 

To open the Archive tab:

1. In the side bar, select Events >Audit LoggerAudit Logger.
2. In the Audit Logger, select the Archive tab.

The Archive tab includes two sub-tabs:

In the Archive Criteria tab (see Table 82), you run archive operations and create Audit Logger Archive Tasks.

The Archive History tab (see Table 83) provides a history of all archive operations.

Note 

To view the Archive tab in the Audit Logger, the Audit Logger - Export permission must be assigned to your User Account (see Working with User Permissions).

To run a custom archive operation:

1. Complete the Archive Criteria tab (see Table 82).
2. Click Start. 

To create and schedule an Audit Logger Archive Task:

1. Complete the Archive Criteria tab (see Table 82).
2. Click Save. 

TLC adds the new Task to the Task hierarchy in the left pane of the Archive Criteria tab.

3. (Optional) To define a schedule for the new Task, see Working with the Task Scheduler.

To run an existing Audit Logger Archive Task:

1. In the left pane of the Archive Criteria tab, select the Task.

TLC populates the Archive Criteria tab (see Table 82) with the Task's criteria.

2. Click Start. 

To re-run an archive operation:

1. In the Archive History tab (see Table 83), double-click an archive operation.

TLC populates the Archive Criteria tab (see Table 82) with the operation's criteria.

2. Click Start. 

Tip 

Log messages in the Audit Logger cache are excluded from Audit Logger archive operations. To flush the Audit Logger cache, see Working with the Audit Logger Cache.

To restore archived log messages to the Audit Logger File Store: 

1. Open the directory specified by the Output path field in the Archive Criteria tab (see Table 82).
2. In this directory, select the top-level Location folder containing the .zip files with the archived log messages.
3. Copy the selected folder to the following directory: 

<audit_logger_file_store>\Restore\

Where <audit_logger_file_store> is the directory specified for the Audit Logger File Store when TLC Manager was installed (see Installing TLC Manager on your Primary Manager).

Once TLC detects the presence of .zip files in the Restore folder, it extracts the log messages and completes the steps described in What is the Audit Logger?. If the log messages in a .zip file are invalid and cannot be added to the Audit Logger File Store, TLC moves the file to the following directory: 

<audit_logger_file_store>\NotRestored

Table 82. Default fields in the Archive Criteria tab

Field

Description

Task name

(For Audit Logger Archive Tasks only) The name of the Task.

Task ID

(For Audit Logger Archive Tasks only) A unique ID for the Task.

Description

(For Audit Logger Archive Tasks only) A description of the Task.

Audit Logger

The Audit Logger for which log messages will be archived.

Output path

Click Browse to select the directory in which the archived files will be saved.

Note: This directory must be available to the TLC Manager of the selected Audit Logger.

Time Period

Limits the archive operation to log messages created within a specified time period.

To define a time period relative to the time of the query, complete the Archive data older than fields:

1. In the first field, enter the number of units.

2. From the drop-down, select Days or Months.

For example, if you enter Archive data older than 4 Months and the task runs on July 14 2015, TLC would archive all log messages created before March 14 2015.

Table 83. Archive History tab

Column

Description

Timestamp

The date and time when archive operation was run.

Audit Logger

The Audit Logger for which log messages were archived.

Note: The Archive History tab only presents this column if you have multiple Audit Loggers in your TLC environment.

Count

The number of log files archived.

Query

The criteria specified by the Time Period fields in the Archive Criteria tab (see Table 82).