The log files processed by EventLog Analyzer are archived periodically for internal, forensic, and compliance audits. The interval, log type, storage location, and retention period can be configured as per your requirement. The archive file can be encrypted and time-stamped to make it secure and tamper-proof.
The Archived Logs page lists the Devices, Format, the time frame, size of the file, Integrity, and Status. The integrity column in the table indicates whether the archived logs are intact or have been tampered with. To view the required files, click on the check box in the page. To view files of a certain time range, click on the calendar icon on the top right corner of the page and set the desired time period.
In addition, the files can also be filtered based on the size and the status of data by clicking on the Select icon next to Size and Status respectively.
How to load archived files?
- Check the status of the archived file. If it is Not Loaded, click the Load Archive button to load the file to the database and search the logs.
- Once the status of the file changes to Loaded, click on the corresponding View button.
Note: To drop a file, select the file and click on the Unload Archive button.
If the status of the file says "Data partially available" and if you proceed to load the archive, there could be a duplication of the data.
How to delete archived files?
- Select the archived file(s) by selecting the respective check box(es).
- Delete the archived file(s) using the Delete link.
The integrity column in the table indicates whether the archived logs are intact or have been tampered with. In case a file has been deleted or tampered with, an email notification will be sent immediately and the message "Archive file is tampered" will be displayed on the screen.
Configure the archive interval, retention period, option to encrypt, time-stamp of the archive files, location to save the archive files and location to save the index files in this screen.
Note: The Archive and Database storage are asynchronus operations. These operations are unrelated.
Ensure that archiving is enabled. By default it is enabled. Deselect the check box to disable archiving.
The logs are written to flat files at the specified time period. Choose the required time interval. The default value is 8 hours.
The flat files are compressed (20:1 ratio) and zip files are created at the specified time period. Choose the required time interval. The default value is 1 day.
- Logs can be archived in two formats; Raw Logs with Parsed Fields and Raw Logs. "Raw Logs with Parsed Fields" will be stored with the metadata and "Raw Logs" will be stored without metadata. The storage space for Raw Logs will be lesser but only basic reports can be generated.
To secure the archive files, enable encryption of the files. By default, it will be disabled.
Enter the log retention period for the loaded archive files. The default period is 7 days
Enter the storage location for the archived files in the Archive Location box. Click on "Verify Location". If the storage location entered is valid, it will then be saved.
Save the settings and close the window. For instant archiving, click the Zip now button.
To change the log data's index location:
- Stop EventLog Analyzer server or service.
- Navigate to /ES/config and locate elasticsearch.yml file.
- Edit the file's property path.data parameter to include the new index location and save the file.
- Start EventLog Analyzer server or service.
If you want to move your existing indexes, please copy the files from the existing location to the destined location of your choice. By default, the indexes will be in /ES/data location.
Note: If you wish to set a dynamic key for encrypting the archive files, follow these steps:
1. Go to the archive location. By default, files are archived at <EventLog Analyzer Home>\archive. Create a file EncryptedKey.enc.
2. Open the file using a text editor and enter the dynamic key as text. The key should be exactly 16 characters in length.
3. Restart the EventLog Analyzer service.
If you wish to import the files archived using the above dynamic key in another installation of EventLog Analyzer, follow these steps first:
1. Paste the EncryptedKey.enc file in the installed product archive location.
2. Restart the product.
3. Import the required archive files.