How to restore online logs (retention period)on ESM 6.5?
We using ESM6.5 SP1.
We designing back up for online logs when broken files under /opt/arcsight/logger/data/logger .
We think can restore onlinelogs from copy files under /opt/arcsight/logger/data/archives but when I moved all logs under /opt/arcsight/logger/data/logger after stoped ESM service for my test, I couldn't restore from archive logs because online logs status was "online" on the Commnd Center so I couldn't 「make searchable」.
If it's this situation, I couldn't search onlinelogs by arcsight console.
I don't know why archived (copy) older than the previous day...