2.10.2 Managing operation logs on the management server in a single-server configuration system
If operation logs are not stored on a site server in a single-server configuration system, the operation logs collected on a computer managed online are stored in a database on the management server. You can view the operation logs collected on the management server in the Operation Logs view of the Security module.
![[Figure]](GRAPHICS/ZU070019.GIF)
- Important note
-
If a computer fails to connect to the management server, operation logs are not reported to the management server and are temporarily saved on the computer. Operation logs for 1,000 hours or less can be temporarily saved on a computer. If 1,000 hours have passed, older operation logs are deleted. The temporarily saved operation logs are reported to the management server the next time the computer connects to the management server.
Operation logs collected on the management server are saved in the database for about one month. The operation logs that are older than about one-month-old are automatically deleted from the database.
Note that if automatic backup of operation logs has been configured in Setup, operation logs are automatically backed up every day. You can view the backup operation logs by temporarily restoring them from the backup folder to the database. After deleting the restored operation logs, you can restore the operation logs for a different time period to the database. This enables you to view past operation logs. However, the operation logs backed up on the management server cannot be restored to a site server. Also, the operation logs backed up on a site server cannot be restored to the management server.
- Important note
-
In a multi-server configuration system, operation logs cannot be collected on the management server.
- Important note
-
If operation logs have not been collected on the management server, the Operation Logs view is not displayed.
- Tip
-
We recommend that you use high-capacity drives, such as RAID or NAS, for storing backup files because large amounts of data may be stored in the backup folder over a long period of time.
Related Topics:
- Organization of this subsection
(1) Backing up and restoring operation logs on the management server in a single-server configuration system
You can collect history information about user operations as operation logs and save it in the database so that you can investigate problems, such as information leakage, later.
![[Figure]](GRAPHICS/ZU070025.GIF)
Operation logs are collected once an hour from agent-installed computers. The collected operation logs are stored in the operation log database. You can view the operation logs stored in the database in the Operation Logs view of the Security module.
If automatic backup of operation logs is configured, operation logs are automatically backed up from the operation log database to the backup folder for operation logs. Automatic backup is performed once a day.
If the size of the operation logs exceeds the size of the operation log database, new logs automatically overwrite the older logs. To view the past operation logs that were deleted from the operation log database, restore the automatically backed-up operation logs to the database for restoration. Then, you will be able to view the past operation logs in the Operation Logs view. You can clear the data in the database for restoration if you no longer need to view the data.
If you use Database Manager to back up databases, the database for management data and the operation log database are backed up.
- Tip
-
If you back up databases when automatic backup of operation logs is enabled, only the operation logs that have not been automatically backed up in the operation log database are backed up. If you back up databases when automatic backup of operation logs is disabled, operation logs in the operation log database are not backed up.
If you restore the operation log database while the backup operation logs are stored in the backup folder for operation logs, only the operation logs for the latest seven days are stored in the operation log database.
- Important note
-
When automatic backup of operation logs is performed, if the backup destination drive does not have sufficient free space, the operation logs are not backed up. In that case, if new operation logs are stored in the operation log database, old operation logs might be deleted before they are backed up. Therefore, we recommend that you secure sufficient free space on the backup destination drive.
- Important note
-
When the management server has been configured in Setup so that operation logs are not collected, even if you enable collection of operation logs in a security policy, the operation logs collected from a computer are not saved.
- Important note
-
If the operation date and time of the operation logs collected from a computer is earlier than the display period of operation logs (the time period for which Online is displayed in the Operation Log List view), the collected operation logs are not saved.
- Tip
-
If operation logs cannot be sent from an agent-installed computer to the management server, the operation logs can be temporarily saved on the agent-installed computer. Operation logs for 1,000 hours or less can be temporarily saved on a computer.
(2) Automatic backup of operation logs on the management server in a single-server configuration system
The operation logs collected from computers are stored in a database on the management server. You can view the operation logs for about one month. If you want to view older operation logs, you must restore the backup operation logs. If you configure the settings so that operation logs are automatically backed up, operation logs (until the day before) are backed up every day. Therefore, you can check the past operation logs as needed.
You can set automatic backup of operation logs in Setup.
- Tip
-
You can use Database Manager to back up all databases of JP1/IT Desktop Management including the operation log database.
Data to be backed up
Operation log data that satisfies the conditions below is backed up. Backup is performed at 4:00 every day.
-
Operation logs whose creation date is the day before the automatic backup is performed or older
-
Operation logs that have not been backed up
- Important note
-
Because operation logs are managed in UTC, the times of operation logs to be automatically backed up are converted to UTC times. Therefore, depending on the time at which operation logs of the previous day were collected, some operation logs might not be included in the backup data for the previous day.
Operation logs are compressed in a ZIP file, and stored as backup data in the Operations log backup folder specified during the Setup. The following table shows the format of the stored data.
|
Type |
File name |
Description |
|---|---|---|
|
DATA files |
|
Operation log data for each day. YYYYMMDD is the date of the backup (YYYY: Year, MM: Month, DD: Day). If a file of the same name already exists, the file is overwritten. |
|
OTHER file |
OPR_OTHER.zip |
Backup data for operation logs. If there is an existing OTHER file, it is overwritten. Note that when you perform manual backup, you should create the same file in both the operations log backup folder and the backup folder for the database. |
Size of the backup data
The following conditions are used as guides to explain how to calculate the sizes of operation log data and backup data below:
-
Number of managed computers: 100 machines
-
Number of occurrences of operation logs per day: 2,000 logs/machine
-
Data size of an operation log: 500 bytes
-
Compression ratio of a ZIP file: 10%
Note: All the above conditions are set as guides.
- Size of operation log data
-
Size of operation log data per machine: 2,000 (logs) x 500 (bytes) = about 1 (MB)
Size of operation log data for 100 machines: 1 (MB) x 100 (machines) = 100 (MB)
Size of operation log data for 100 machines for one month (20 business days): 100 (MB) x 20 (days) = about 2 (GB)
- Size of backup data
-
Size of backup data per machine: 1 (MB) x 10% = about 100 (KB)
Size of backup data for 100 machines: 100 (KB) x 100 (machines) = about 10 (MB)
Size of backup data for 100 machines for one month (20 business days): 10 (MB) x 20 (days) = 200 (MB)
Thus, you can calculate the sizes of operation log data and backup data. Secure the free space for the database and for the backup-destination drive, considering the number of managed computers and the collection period of operation logs.
Mail notification about free space shortage
You can configure the settings so that a mail notification is sent when the free space on the backup destination is insufficient. The following are the triggers for mail notification:
- Automatic backup fails
-
If automatic backup fails due to a shortage of backup-destination drive capacity, a Critical error event is displayed in the Events module. In this case, a mail notification is automatically sent if mail notification of such events has been set.
- Periodic monitoring detects free space shortage
-
Information about the free space of the backup-destination drive is collected once a day. If free space is insufficient, an error event is displayed in the Events module. In this case, a mail notification is automatically sent if mail notification of such events has been set.
(3) Restoring operation logs to the management server
When you want to investigate operation logs that are not displayed in the operation log list managed on the management server, you can restore operation logs that were automatically backed up, and then track the logs or check the details in the logs. You can restore operation logs by specifying a time period that includes the operation log you want to investigate.
Note that if the total size of the operation logs you restore exceeds the maximum size of the operation log database, the excess logs are not be restored.
- Tip
-
If you restore the database by using Database Manager or a command, the operation logs for the past seven days from the restoration execution date are restored to the operation log database. If you want to display the operation logs for another period, you need to restore the operation logs from the backup files.