How do you restore a FSM Audit log from a backup tape?
2 years ago
Originally Published: 2008-10-02
Article Number
000066740
Applies To
RSA File Security Manager (FSM)
RSA File Security Manager 2.1.10
Microsoft Windows Server 2003
Issue
How do you restore a FSM Audit log from a backup tape?
Customer trying to retrieve an audit event, that occurred in May, from the Adapter Manager Audit log.  However, the:
  • Adapter Manager Audit Log only displays events dated on or after July 7 and
  • first entry in the log is "Clear event log successful".

The above two bullet items suggest that earlier events were cleared from the log.  Would like to restore a backup copy of the log from the May timeframe and use the backup copy to display the desired audit event.

The scope of issue is limited to just the "Adapter Manager audit log" (e.g., audit history of Security Officer activity, etc.).  The scope does not include the "Adapters".
Resolution
For restoring from tape backup follow below steps:

1.       Create new folder ?BackupAudit? in C:\Program Files\RSA Adapter Manager Common\DataFiles\

2.       From the tape backup, restore VDSFEventLog xml file to BackupAudit folder. This VDSFEventLog xml file can be located in ?C:\Program Files\RSA Adapter Manager Common\DataFiles\? in the backup.

3.       Logon as Admin

4.       Click on Audit option

5.       Right-click on console log node in Adapter Manager Audit window

6.       Select ?open log? option

7.       Select restored VDSFEventLog xml file from BackupAudit folder.  

8.       Now a new node (Backup Event Viewer) will be added under Event Viewer. Under this new node Console Log events and File Log events are displayed.

 Note: If Adapter Manager Audit window is closed then the new node is removed. If user needs to view again the old audit, he has to repeat process from step 5.