Hi Guys,

It was found that the file collector for one of our NAM servers was
turned off for a over 3 months.
This NAM file collector used to collect files from NAM log files and
then uploaded the events into an SQL data residing on another server.

The file collector in question, used to collect log events from NAM
server had been set to store events for just 10 days.
Since, now we have lost the log events for the last 3 months or 90 days
per say, we would like to get all those log events back in Sentinel
server from NAM to SQL database.

Our Resolution:
Use the backups from NAM server where cache was located and restore it,
so theoretically it should send all the events from it cache file to
Sentinel, right?
Also, we would then have to perform the restore 9 times to get the log
events for the last 90 days...

- Would this be a possible resolution in this situation?
- Does NAM and sentinel support such kind of a workaround?

Any suggestions/pointers/TID welcome!

Thank you,

ddgaikwad's Profile: https://forums.netiq.com/member.php?userid=5917
View this thread: https://forums.netiq.com/showthread.php?t=51024