P a g e 1. User s Guide Log Archiver v2.1 Standard Edition. Copyright 2012 ISYS Inside-System. All rights reserved.

Transcription

1 EN L OG ARCHI VERv2. 1 Us er sgui de ST ANDARDEDI TI ON

2 P a g e 1 User s Guide Log Archiver v2.1 Standard Edition Copyright 2012 ISYS Inside-System. All rights reserved. The information in this user guide is provided as is. Under no circumstances, including negligence, shall ISYS Inside-System be liable for any incidental, special, direct, indirect or consequential damages arising out of or relating to use of the information provided in this guide with or without the software described in the guide. No part of this work covered by the copyright herein may be reproduced, transmitted, stored, or used in any form or by any means graphic, electronic, or mechanical, including but not limited to photocopying, recording, scanning, digitizing, taping, Web distribution, information networks, or information storage and retrieval systems without the prior written permission from ISYS Inside- System. Trade Marks Microsoft, Windows XP, Windows Vista, Windows 7, SQL Server, System Management Server, System Center Configuration Manager and System Center Operation Manager are all trademarks of Microsoft Corporation in the United States and other countries.

3 P a g e 2 Table of Contents 1- Introduction What is new in Log Archiver v Versions... 5 Administration console... 5 Compatibility... 5 Archiving thresholds Log Archiver v2 main features... 6 Version Feature Pack Installing Log Archiver System requirements... 8 Log Archiver... 8 Supported configurations... 8 Ports and firewall... 8 Installation accounts and permissions Installing Log Archiver... 9 Interactive installation... 9 Silent installation Licensing Log Archiver How to obtain an activating key Activating Log Archiver components Add or remove Log Archiver components Unnstalling Log Archiver Interactive deinstallation Silent deinstallation Security Administration console General description Log Archiver service state Check Log Archiver service Start Log Archiver service... 20

4 P a g e 3 Stop Log Archiver service Configuring Log Archiver Components Enable and disable tracing Enable and disable archiving Stop and start components Site settings Configure log file size Enable and disable thresholds Free Space threshold Quota Size threshold File Number threshold Component settings Configure log file size File Number threshold Archive Management Filters and search Extracting archives Support and troubleshooting Event Log Windows event log Log files Limitations Known issues Support... 33

5 P a g e 4 Chapter 1 : Introduction

6 P a g e 5 1- Introduction Log Archiver is a backuping solution for System Management Server (SMS) and System Center Configuration Manager (SCCM) log files. SMS and SCCM log files are particularly verbose, thus generating a great quantity of log files. In addition, log files of the main components, such as distribution or site replication, have a very limited tracing timespan, making the maintenance of these components very delicate. Log Archiver automatically archives all log files produced by any kind of sites, central, primary or secondary, with a 95% compression ratio. Log Archiver is able to manage all SMS or SCCM services and threads generating log files. Log Archiver the ideal backuping solution for large infrastructures, where log files have a very limited lifespan, but also for small to medium-sized businesses where SMS and SCCM infrastructures are not the daily priority of IT administrators What is new in Log Archiver v2 Versions Log Archiver is now available into 2 versions, to best fit to your IT organisation: Standard Edition: Standalone version, with a single site connection, is the ideal backuping solution for small to medium-sized infrastructures. Professional Edition: Multi-site connection with an integrated discovery feature for a centralized administration. This version is the ideal backuping solution for medium-sized to large infrastructures. Both versions (Standard or Professional) use the same archiving algorithms. Both versions can cohabit within the same infrastructure. Administration console Log Archiver now provides an administration console, coming with the following improvements: Automatic site discovery (Professional Edition only) Automatic threads and services discovery Centralized management (Professional Edition only) Easy configuration Easy log file management Compatibility Log Archiver supports all System Management Server and System Center Configuration Manager editions and sites: Supports System Management Server 2003, System Center Configuration Manager 2007 and System Center 2012 Configuration Manager Supports central and primary sites Supports secondary sites (Professional Edition only)

7 P a g e 6 Archiving thresholds Log Archiver also includes archiving threshold improvements for a better disk space management Log Archiver v2 main features Log Archiver v2.0 (Standard Edition) provides the following features: Version 2.0 Log Archiver Service: Once installed and started on a SMS or SCCM site server, Log Archiver service automatically archives log files. Log Archiver administration console: Provides an easier and efficient user interface to configure and manage archives. Automatic components discovery: Log Archiver automatically identifies all the SMS and SCCM services and threads providing log files. Start / stop components: Log Archiver console enables administrators to start and stop SMS and SCCM threads. Enable / disable tracing: Log Archiver console offers an easy and quick access to enable and disable SMS / SCCM tracing. Enable / disable archiving: Log Archiver enables administrators to start and stop archiving. Compression: Log Archiver automatically archives and compresses SMS ou SCCM log files. Archiving thresholds: Log Archiver provides 3 kinds of thresholds (Free Space, Quota Size and File Number) to manage the disk space used without additional administration. Thresholds configuration can be performed at site level or at component level. Archives management: Log Archiver console offers an efficient interface to manage, find and extract log files. Log Archiver event monitoring: To check that Log Archiver is working correctly (configuration modifications, new archives, threshold activations ) Feature Pack 2.1 Log file size: Log Archiver console provides a centralized user interface to modify the size of the log file for one or all components of a SMS/SCCM site. Remote Log Archiver database: With the Feature Pack 2.1, it is possible to install the Log Archiver database on a remote SQL server. Remote SMS/SCCM components: Remote SMS/SCCM components are supported. It is possible to archive the log files from remote SMS/SCCM site systems. Windows Event log: Log Archiver events are now forwarded to the windows event log. It is now easier to monitor Log Archiver activity.

8 P a g e 7 Chapter 2 : Installing Log Archiver

9 P a g e 8 2- Installing Log Archiver Log Archiver is composed of 2 different components, which cannot be installed separately: the Log Archiver service and the Log Archiver console. These components can be installed on either 32-bit or 64-bit systems. This chapter describes the minimum system requirements and provides guidelines to install and uninstall Log Archiver components System requirements Log Archiver Supported Operating Systems (x86 et x64) Windows Server 2003 SP2 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Software Requirements Framework.Net 4.0 Database Requirements SQL Server 2005 SQL Server 2008 SQL Server 2008 R2 SQL Server 2012 SQL Express 2005 SQL Express 2008 SQL Express 2008 R2 SQL Express 2012 System Management Server / System Center Configuration Manager System Management Server 2003 System Center Configuration Manager 2007 System Center 2012 Configuration Manager Supported configurations Log Archiver Components Workstation Remote Server SMS/SCCM Site Server Service and console Database Archiving directory Ports and firewall To use the Log Archiver database from a distant server or workstation, some network communication ports need to be opened.

10 P a g e 9 Log Archiver service / console Log Archiver SQL server Description UDP TCP SQL over TCP * *Specified during setup only (cannot be changed after) Installation accounts and permissions To install Log Archiver onto a computer, you will need an account with local administration privileges for that computer. This account should also be SysAdmin of SQL server where the Log Archiver database will be installed Installing Log Archiver The Log Archiver installer enables administrators to install every Log Archiver components on either 32-bit or 64-bit systems. In this version, installing Log Archiver service onto a domain controller is not supported. Interactive installation To quickly install Log Archiver, use the Log Archiver Installation Wizard. Run LogArchiverSetup_std.exe Click Next. Read carefully the license agreement. Click I accept the terms in the License Agreement. Click Next. Choose the components to install: Service and console Licence Activator

11 P a g e 10 Choose the installation folder. The default installation directory is: C:\Program Files\ISYS - Inside System\Log Archiver Standard\ for 32-bits systems C:\Program Files (x86)\isys - Inside System\Log Archiver - Standard\ for 64-bits systems Click Next. If you choose to install Log Archiver service, the installer will ask for SQL settings: Database Name Server: SQL server and instance. Use. syntax for a local server. For SQL Express edition, use server name \ SQLEXPRESS syntax Port: SQL port (default port : 1433) Group Name: name of the domain group authorized (read and right permissions) to access to Log Archiver database Click Next. Click Next to install.

12 P a g e 11 Click Finish. Log Archiver is installed with a 30-days license key to offer an easy evaluation of the product. If you purchase a license key, use License Activator to activate your product ( 2.3 Licensing Log Archiver). Silent installation You can install Log Archiver without interaction, using the quiet mode commands. This chapter describes the available commands. For silent installation, it is necessary to run the DOS command as local administrator (UAC). To install all Log Archiver components (console, service and License Activator): C:\ LogArchiverSetup_std.exe ADDLOCAL=ALL DATABASENAME=<Log Archiver database name> SQLSERVERNAME=<server>\<instance> SQLSERVERPORT=<SQL port> SQLADGROUP=<domain\group> /qb To install only the Log Archiver service and console: C:\ LogArchiverSetup_std.exe ADDLOCAL=LogArchiverService DATABASENAME=<Log Archiver database name> SQLSERVERNAME=<server>\<instance> SQLSERVERPORT=<SQL port> SQLADGROUP=<domain\group> /qb To install only License Activator : C:\ LogArchiverSetup_std.exe ADDLOCAL=LicenseActivator /qb Options Values Description APPDIR <directory> Installation path ADDLOCAL ALL LogArchiverService LicenseActivator Install all components Install Log Archiver service and console Install License Activator DATABASENAME <database name> SQL database name SQLSERVERNAME <Server>\<Instance> SQL server and instance SQLADGROUP <Domain\Group> Group authorized to access Log Archiver database SQLSERVERPORT <SQL Port> SQL port (default=1433)

13 P a g e Licensing Log Archiver Log Archiver is installed with a default 30-days trial license key to offer an easy evaluation of the product. To activate Log Archiver : Step 1: Obtain an activation key using License Activator. This step requires an internet connection from any workstation or server. Step 2: Validate your product with License Validator. This step does not require an internet connection but need to be performed on the machine where the Log Archiver component is installed. How to obtain an activating key If you purchase a license key, use License Activator to obtain an activation key corresponding to your Log Archiver version. Each Log Archiver component needs its proper activation key. To obtain an activation key: run License Activator. Select Product: choose LogArchiverStandard to activate Log Archiver. License Key: enter the license key purchased from ISYS Inside-System support. Machine Name: specify the machine name where the Log Archiver component is installed. Click Activate. An internet connection is then open to the ISYS Inside-System licensing server, returning the activation key. Machine Key: Activation key. FIGURE 2.1 LICENSE ACTIVATOR License Activator program should be run as local administrator (UAC). License Activator can be run from any server or workstation with an internet connection. Activating Log Archiver components Use License Validator to activate a Log Archiver component. To activate Log Archiver console: From the Log Archiver installation directory, run Isys.LicenseValidator.exe program. Product: Choose LogArchiverStandard Machine Key: Enter activation key Click Validate Command line activation : FIGURE 2.2 LICENSE VALIDATOR

14 P a g e 13 Use Isys.LicenseValidator.exe LogArchiverStandard "<activation key>" command to activate Log Archiver 2.4- Add or remove Log Archiver components To add new Log Archiver components or remove existing Log Archiver components: Run the Log Archiver Installation Wizard. Click Next, and select Add or Remove Features. Click Next. Choose the components you want to add or remove. Click Next. Click Install to add or remove components.

15 P a g e 14 Click Finish Unnstalling Log Archiver You can uninstall Log Archiver from the Add Or Remove Programs in the Windows Control Panel or use the Log Archiver Installation Wizard. Uninstalling Log Archiver from the Windows Control Panel will not remove the Log Archiver database. Archives are not removed after uninstallation. Interactive deinstallation Run Log Archiver Installation Wizard. Click Next and select Remove.

16 P a g e 15 Choose: Yes, I want to delete database to remove Log Archiver database No, don t delete database to keep Log Archiver database Click Next. Click Next. Click Remove.

17 P a g e 16 Click Finish. Silent deinstallation Log Archiver can be uninstalled silently, using the following options: For silent deinstallation, it is necessary to run the DOS command as local administrator (UAC). To remove all Log Archiver components (console, service and License Activator): C:\ LogArchiverSetup_std.exe REMOVE=ALL SQLSERVERNAME=<server>\<instance> SQLSERVERPORT=<SQL port> DELETEDATABASE=1 /qb To remove only License Activator: C:\ LogArchiverSetup_std.exe REMOVE=LicenseActivator /qb Options Values Description REMOVE ALL LogArchiverService LicenseActivator Uninstall all Log Archiver components Uninstall Log Archiver service and console Uninstall License Activator DATABASENAME <Database name> SQL database name SQLSERVERNAME <Server>\<Instance> SQL Server and instance names SQLSERVERPORT <SQL port> SQL port (default=1433) DELETEDATABASE =0 or =1 Remove (=0) or not (=1) the SQL database. By default, the database is not removed Security Log Archiver is a product designed for IT administrators with the required skills to administrate SMS/SCCM servers. In addition to manage log files, the Log Archiver console allows to configure existing native features of SMS/SCCM servers (enabling logging, starting services and threads ). Log Archiver users should then have the required permissions to perform these operations. All the required permissions are listed below:

18 P a g e 17 Groups Member of Administrators local group of any managed SMS/SCCM servers Member of SMS Admins local group of any managed SMS/SCCM servers Member of the domain group authorized to access the Log Archiver database (specified at setup) SMS/SCCM Permissions Site Read Log Archiver service runs with the Local System account on the SMS/SCCM server. The service should have access to the Log Archiver database and also have access to the archive path. When at least one of these features is installed on a remote machine, the machine account of the server where Log Archiver service is installed should have the following permissions: Groups Member of the domain group authorized to access the Log Archiver database (specified at setup)

19 P a g e 18 Chapter 3 : Administration console

20 P a g e Administration console Log Archiver console allows administrators to manage all the SMS and SCCM sites in the same hierarchy in an efficient and centralized way. Log Archiver console provides a multi-sites connection interface. Managing archives is easy with the new Log Archiver console General description FIGURE 3.1 LOG ARCHIVER ADMINISTRATION CONSOLE State Panel: The upper right panel shows the Log Archiver service state on the selected server. Detailed panel: The central window is the main administration and configuration window. It is composed of 4 tabs: Archives: This tab displays the log files archived by Log Archiver. Filtering options are available (component, date) to quickly find files. You can extract archives to Zip file. Components: This tab displays all the discovered SMS / SCCM services and threads. You can start and stop services and threads, enable / disable tracing, enable / disable archiving. You can also configure the File Number threshold for each component. Settings: This tab allows administrators to configure thresholds at site level. Site settings are applicable for all the discovered components of the selected site.

21 P a g e 20 Server logs: This tab displays the Log Archiver events used to monitor Log Archiver activity Log Archiver service state The upper right panel gives an immediate state of the Log Archiver service on the selected server. Log Archiver service is in charge of archiving log files, configuring components and activating thresholds. FIGURE 3.2 LOG ARCHIVER SERVICE STATE After setup, check that Log Archiver service is started. Check Log Archiver service To check Log Archiver service state from the console: Use the upper right panel to check the service Use the refresh buton if necessary Start Log Archiver service To start the Log Archiver service from the console: Check the service on the upper right panel If the service is stopped, click the button to start the service Stop Log Archiver service To stop the Log Archiver service from the console: Check the service on the upper right panel If the service is started, click the button to stop the service

22 P a g e 21 Chapter 4 : Configuring Log Archiver

23 P a g e Configuring Log Archiver Log Archiver automatically identifies the components (services and threads) producing log files. Every SMS and SCCM sites are supported (central, primary and secondary). FIGURE 4.1 COMPONENTS TAB Log Archiver is also abble to identify and archive the log files of remote SMS/SCCM roles. After installing a new SMS/SCCM role, it is necessary to restart the Log Archiver service to trigger a new discovery of the components installed on that site Components The Components tab provides information about the SMS or SCCM threads and services, including the native SMS/SCCM features such as tracing.

24 P a g e 23 FIGURE 4.2 COMPONENT PROPERTIES Trace: Enable / disable tracing for the selected SMS/SCCM component. Archive: Enable / disable archiving for the selected SMS/SCCM component. Once enabled, Log Archiver automatically saves and compresses the log files of that component. Server: server hosting the component (the component can be installed on a remote site system) Name: name of the component. ) Status: status of the component (stopped or started). Type: thread or service. Source Log: SMS/SCCM log file path. Enable and disable tracing This is a native feature of the SMS/SCCM component. To enable or disable tracing, check or uncheck the check box of the component, in the Trace column To enable or disable tracing for all components, check or uncheck Enable and disable archiving To enable or disable tracing, check or uncheck the check box of the component, in the Archive column To enable or disable tracing for all components, check or uncheck Stop and start components This is a native feature of the SMS/SCCM component. To start a SMS or SCCM component, select the component in the upper list of the detailed panel and click the button

25 P a g e 24 To stop a SMS or SCCM component, select the component in the upper list of the detailed panel and click the button 4.2- Site settings Log Archiver can be configured to automatically manage the disk space used and the number of log files archived per component. For an easy administration, this configuration can be applied to all the components of the site, but it is also possible to configure each component separately if necessary (see chapter 4.3 Component setting). 3 thresholds are available: Free Space: Site threshold triggered when the free disk space reaches the specified lower limit. Quota Size: Site threshold triggered when the total disk space used by the archives reaches the specified upper limit. File Number: Site or component threshold triggered when the number of files archived for a component reaches the specified limit. FIGURE 4.3 THRESHOLD CONFIGURATION

26 P a g e 25 Configure log file size With Log Archiver console, it is possible to modify the size of the log files of SMS/SCCM components in a centralized way. On the Settings tab you can modify the size for all the components of the site. (see also 4.3 Component settings). Enter the size of the log file (Mb) and click Apply. It is not recommended to set a null size. This will not disable logging. To disable logging, uncheck the Trace checkbox. Enable and disable thresholds Click On to enable the threshold. Click Off to disable it Click Save to apply the modifications The configuration made on the Settings tab is applied to all components of the site (see also chapter 4.3 Component settings). IMPORTANT: Unsaved modifications are not applied. Several thresholds can be triggered at the same time. To get back to the default configuration (all thresholds disabled), click on Clear button. Free Space threshold Set the Size (in Mb or in %). For the Free Space threshold, the Size parameter correspond to the minimum free disk space kept available on the disk. If the delete oldest archive check box is not ticked, the service will stop archiving log files. Else, the oldest log files will be removed. Log Archiver will only remove the oldest files of the concerned component. Quota Size threshold Set the Size (in Mb or in %). For the Quota Size threshold, the Size parameter correspond to the maximum disk space that can be used by Log Archiver to store archives. If the delete oldest archive check box is not ticked, the service will stop archiving log files. Else, the oldest log files will be removed. Log Archiver will only remove the oldest files of the concerned component. File Number threshold The File Number threshold is a component setting. Once configured and enabled at site level, it is applicable to all the components of this site. When enabled on a specific component, this configuration has priority over the site setting. To apply this threshold to a single component, go to the Components tab (see chapter 4.3 Component settings). Set the Number of files parameter, corresponding to the maximum number of files that can be archived for a component.

27 P a g e 26 Set the number of files to remove (Number of files to delete) when the threshold is triggered. If the delete oldest archive check box is not ticked, the service will stop archiving log files. Else, the oldest log files will be removed. Log Archiver will only remove the files of the concerned component Component settings FIGURE 4.4 COMPONENT CONFIGURATION Configure log file size With Log Archiver console, it is possible to modify the size of the log file of a single SMS/SCCM components. On the Components tab you can modify the size of only one components of the site. Enter the size of the log file (Mb) and click Apply. It is not recommended to set a null size. This will not disable logging. To disable logging, uncheck the Trace checkbox. File Number threshold The File Number threshold is a component setting. When enabled on the Settings tab, it is applicable to all the components of the site (see chapter 4.2 Site settings). You can bypass this configuration and configure this threshold for a single component. To apply this setting to a specific component: Tick the don t apply the site configuration check box Click On to enable the threshold. Click Off to disable it Click Save to apply the modifications IMPORTANT: Unsaved modifications are not applied. To get back to the default configuration (all thresholds disabled), click on Clear button.

28 P a g e 27 Chapter 5 : Archive Management

29 P a g e Archive Management Once configured, Log Archiver requires no additional administration workload: log files are automatically archived with a 95% compression-rate and Log Archiver can automatically manage the disk space used. The Archives tab indicates: The number of archives The disk space used by Log Archiver The list of files FIGURE 5.1 ARCHIVES MANAGEMENT For each archive, the following properties are displayed: Name: Name of the archive Created: Date of creation of the SMS/SCCM log file Last Save: Date of archiving of the SMS/SCCM log file Size: Size of the archive after compression Component: Name of the SMS/SCCM service or thread Path: Folder where the archive is stored

30 P a g e Filters and search Archives are compressed and stored (with.zch extension) in the Log_Archiver_Archives shared directory. This share is created during setup of the Log Archiver service. To help administrators find the archives, log files are named with the following format: <site code>_< netbios name of the server>_<log file name>_<date>_<index>.zch In addition, the Log Archiver console provides filters: Component filter: On the left side, you can choose to display or hide components. Tick the Components check box to display or hide all the components. Date filter: Select a starting and ending date with the upper slider. You can also pick the dates with the buttons Extracting archives To extract archive files (.zip), just select the files and click on Extract Archives. Then select the destination folder where the zip file (containing the archives) will be exported and organized in the following tree structure: <site code> < netbios name of the server> <name of the SMS/SCCM component>

31 P a g e 30 Chapter 6 : Support and troubleshooting

32 P a g e Support and troubleshooting 6.1- Event Log The Server logs tab enables administrators to monitor Log Archiver activity. This page displays messages when: Log Archiver service starts or stops Log Archiver configuration is changed New log files are archived Archiving thresholds are activated Unexpected error occurs FIGURE 6.1 LOG ARCHIVER EVENT LOG You can filter the messages per criticity level (info, warning, error or fatal). You can also remove oldest messages with Delete all logs until feature. Click date and click Delete. to choose a Removed data are definitively lost.

33 P a g e Windows event log Events triggered by Log Archiver are now forwarded to the Windows event log. It is now easier to monitor Log Archiver activity. It is also possible to use an external solution (Microsoft System Center Operation Manager for example) to manage this monitoring. Log Source Description Windows Logs SCCMLogArchiver Information about starting and stopping Log Archiver service Applications and Services Logs Log Archiver Service Events triggered by Log Archiver service 6.3- Log files To help troubleshooting in case of problems, log files are available. They provide detailed tracing of the activity of each Log Archiver component. Log files can be found in: <installation directory>\log Archiver Console\logs.txt for the console <Installation directory>\log Archiver Service\Log\log.txt for the service. Old log files are available in <installation directory>\log Archiver Service\Log\Archives\. You should send these files when you contact ISYS Inside-System support Limitations In that version, some configurations are not supported, and will be available in the next versions or Features Packs: Installing Log Archiver service on a domain controller is not supported. But Log Archiver console can be installed on a domain controller. Installing Log Archiver database on a remote server is not supported. Using a network share as archive path is not supported. Known issues The following table describes the known issues and some guidelines to identify the solution. If the problem persists, refer to chapter 6.5. Error Error Message Solution Error when starting the Log Archiver console UAC problem. Run the console as administrator Error when connecting to a site server Check that the server is connected to the network. Also check the required firewall rules and communication ports.

34 P a g e 33 Only Components tab is displayed. Log Archiver service is correctly installed Check Log Archiver service is started. If the service is correctly started, check the required firewall rules and communication ports. Extracted zip file does not contain any archive Check that the user account has the required permissions to access to the archive path 6.5- Support If you have troubles in using Log Archiver software, you should first read carefully this guide, and check that the system meets the requirements described at chapter 2.1. Also check that the account meets the minimum required permissions described at chapter 4.3. Check finally that the last Log Archiver updates and fixes are installed. If you still have technical problems, please contact ISYS Inside-System support team who will help you to find the root cause of your problem. To contact ISYS Inside-System support: Go to your client web portal at or, Send an to support@inside-system.com To help determine the solution quickly, please attached the following information to your request: Version number Client ID Detailed description of the problem Log Archiver console log file (see 7.2) Log Archiver service log file (see 7.2) To contact the ISYS Inside-System sales departement, please send a mail to the following address or postal address: contact@inside-system.com 197, Rue Pierre Cazeneuve Toulouse France

35 www. i ns i des y s t em. c om