Logger Restores Invalidated After Logger Updates
For the love of whatever you hold dear, please tell me that this is incorrect.....
Sorry, I found KM1270257(Restoring Logger Configuration Backup to Another Logger Unit), which addresses my question but leads to another question.
If restores require the same Logger version; what happens to my older backups after I upgrade the Logger version?
The older backups will be of no use because we suggest you take a backup with the new version
How can I take a backup of the archives I have already off-loaded to tape and are no longer stored on the Logger itself?
He followed up with a call (with upper level support/engineering in the bgd) to say we’re SOL, unless we down rev the Logger, which will almost assuredly destroy the appliance.
As I said before, I hope this is incorerct.
What I'd really like to do is restore our Logger appliance event archive to a temporary software Logger. This way we can spin it up when needed, mess with the revs if needed, and not mess with a production system.
Any help would be appreciated,
Re: Logger Restores Invalidated After Logger Updates
Seems correct ... its the same for CORRE as I understand it.
If you want to upgrade the archives you need to attach all of them (using restorearchives), then upgrade. For express this is a problem as you only have 200GB of space.
Here is blurb from the express upgrade guide
Important! After upgrading to ArcSight Express 4.0, the archives that were created in ArcSight Express 3.0 cannot be restored. If you are performing a disaster recovery and you would like to restore the archives that were created in ArcSight Express 3.0, you need to do so before you begin the upgrade. You can do so using the restorearchives command. Restoring ArcSight Express 3.0 archives in an ArcSight Express 4.0 environment is not supported.