|Tasks||Every time a change is made to the event source configuration, a backup file of the configuration is created here: /etc/netwitness/ng/NwLogCollector.cfg.x|
To restore from the backup perform the following steps:
If you are unsure of any of the steps above or experience any issues, contact RSA Support and quote this article number for further assistance.
- Stop the Log Collector service.
- Navigate to the /etc/netwitness/ng directory.
- Create a backup of the NwLogcollector.cfg file as well as the Nwlogcollector.cfg.x file that will be restored.
- Check the contents of the file to be restored and make sure the deleted event source is available.
- Move the NwLogcollector.cfg file to another directory (e.g. /root) and rename Nwlogcollector.cfg.x to be Nwlogcollector.cfg instead.
- Start the Log Collector service again.