The event data restoration feature enables you to restore old or deleted event data. You can also restore the data from other systems. You can select and restore the event partitions in the Change Guardian web interface. You can also control when these restored event partitions expire.
Change Guardian server restarts the services and restores the database after any successful backup and restore.
NOTE:The event data restoration feature is a licensed feature. This feature is not available with the free or trial licenses.
To enable event data for restoration, you must copy the event data directories that you want to restore to one of the following locations:
For primary storage, you can copy the event data directories to /var/opt/novell/change_guardian/data/eventdata/events/.
For secondary storage, you can copy the event data directories to /var/opt/novell/sentinel/data/archive_remote/<sentinel_server_UUID>/eventdata_archive.
To determine the Change Guardian server UUID, perform a search in the web interface. In the Search results, click All for any local event.
Log in to the Change Guardian web interface as a user in the administrator role.
Click Storage > Configuration.
The event data restoration section does not initially display any data.
Click Find Data to search and display all event data partitions available for restoration.
The Data Restoration table chronologically lists all the event data that can be restored. The table displays the date of the event data, the name of event directory, and the location. The Location column indicates whether the event directory was found in the primary storage directory of Change Guardian or in the configured secondary storage directory.
Continue with Restoring Event Data Where UID and GID are not the Same on the Source and the Destination Server to restore the event data.
Select the check box in the Restore column next to the partition that you want to restore.
The Restore Data button is enabled when the Data Restoration section is populated with the restorable data.
Click Restore Data to restore the selected partitions.
The selected events are moved to the Restored Data section. It might take approximately 30 seconds for the Restored Data section to reflect the restored event partitions.
(Optional) Click Refresh to search for more restorable data.
To configure the restored event data to expire according to data retention policy, continue with Restoring Data.
There may be a scenario where the secondary storage data of the novell user ID (UID) and the group ID (GID) are not the same on both the source (server that has the secondary storage data) and destination (server where the secondary storage data is being restored). In such a scenario, you need to unsquash and squash the squash file system.
To unsquash and squash the file system:
Copy the partition that you want to restore on the Change Guardian server where you want to restore the data at the following location:
/var/opt/novell/sentinel/data/archive_remote/<sentinel_server_UUID>/eventdata_archive/<partition_ID>
Log in to the Change Guardian server where you want to restore the data, as the root user.
Change to the directory where you copied the partition that you want to restore:
cd /var/opt/novell/sentinel/data/archive_remote/<sentinel_server_UUID>/eventdata_archive/<partition_ID>
Unsquash the index.sqfs file:
unsquashfs index.sqfs
The index.sqfs file is unsquashed and the squashfs-root folder is created.
Assign permission for novell user and novell group to the <partition_ID> folder:
chown -R novell:novell <partition_ID>
Remove the index:
rm -r index.sqfs
Switch to novell user:
su novell
Squash the squashfs-root folder:
mksquashfs squashfs-root/ index.sqfs
Restore the partitions. For more information, see Restoring Event Data Where UID and GID are not the Same on the Source and the Destination Server
.
The restored partitions do not expire by default, according to any data retention policy checks. To enable the restored partitions to return to the normal state and also to allow them to expire according to the data retention policy, select Set to Expire for data that you want to expire according to the data retention policy, then click Apply.
The restored partitions that are set to expire are removed from the Restored Data table and returned to normal processing.
It might take about 30 seconds for the Restored Data table to reflect the changes.