2.10.3 Managing distributed operation logs on site servers

In a site server configuration system, you can save the operation logs collected from agent-installed computers in distributed site servers. This prevents the disk capacity on the management server from being largely consumed or network load from increasing. Operation logs saved on site servers are called distributed operation logs.

To save operation logs on site servers, specify a site server on which operation logs are to be saved for each network segment (Server Configuration Settings). Distribute the operation logs collected from agent-installed computers to the specified site servers and then save the operation logs.

[Figure]

Important note: If a computer fails to connect to all site servers registered in the site server group, operation logs are not sent to the site servers and the management servers, and are temporarily saved on that computer. Operation logs for 1,000 hours or less can be temporarily saved on a computer. If 1,000 hours have passed, older operation logs are deleted. The temporarily saved operation logs are sent to the site server the next time the computer connects to it.

The collected operation logs are saved in databases on the site servers. In contrast to the management server, the operation log database simply grows as log data is collected on a site server. Automatic backup and automatic deletion of old operation logs are not performed. Therefore, when the hard disk capacity becomes insufficient, take appropriate actions, such as changing the backup destination, adding hard disks, or deleting unnecessary operation logs. You can also move operation log data to another site server. If a site server is close to running out of free disk space, an event is reported in the operation window.

You can view distributed operation logs in the Operation Log List (Distributed Operation Logs) view of the Security module. To view distributed operation logs, you need to filter the targets to be displayed, based on the index information of the operation logs reported from a site server to the management server. You can also view old operation logs by restoring backup operation logs to a site server. However, you cannot restore the backup operation logs that were backed up on the management server to a site server. Also, you cannot restore the backup operation logs that were backed up on a site server to the management server.

[Figure]

Important note

If the index information of operation logs and the actual data are different (for example, when operation logs are manually deleted on a site server, or when the index information file is corrupted on the management server), you cannot correctly view the operation logs saved on a site server. In that case, execute the recreatelogdb command to re-create the index information.

Note that because the site server stops while the recreatelogdb command is being executed, you cannot check the operation logs that occur while the command is being executed, until the command execution finishes. After the recreatelogdb command finishes, creation of the index information of operation logs starts when the site server starts. Because the site server is under heavy load while the index information is being created, the creation might take several days depending of the amount of the operation logs. Also, you cannot check the operation logs collected while the index information is being created until creation of the index information finishes. Consider these influences before executing the recreatelogdb command.

Important note: If distributed operation logs have not been collected, the Operation Log List (Distributed Operation Logs) view is not displayed.

Important note: You cannot view the operation logs saved on a site server and the operation logs saved on the management server at the same time. Therefore, when you use site servers, we recommend that you save operation logs only on site servers and do not save them on the management server.

Related Topics:

To Page Top