Submit a ticketCall us

AnnouncementsAre You “Flying Blind?”

When it comes to your complex IT infrastructure, you want to ensure you have a good grasp of what’s going on to avoid any fire drills that result from guesswork. Read our white paper to learn how proactively monitoring your IT environment can help your organization while giving you peace of mind.

Get your free white paper.

Home > Success Center > Log & Event Manager (LEM) > LEM - Knowledgebase Articles > Configure and restore backups on LEM Appliance v5.6 and earlier

Configure and restore backups on LEM Appliance v5.6 and earlier

Updated October 10, 2018


Configure LEM appliance to run scheduled backups according to your requirements and preferences.
The Following are definitions and recommendations for the primary LEM backup options:
The procedure for scheduling these backups is the same for each. 

It is not possible to merge backup data with live data at this time. Use these backups for data retention and disaster recovery only.

Definitions and Recommendations

  • archiveconfig

Schedule or run this backup to back up the normalized alert database on your LEM appliance. Since it backs up everything on the database, this backup file grows as your database grows. If you have a separate LEM appliance dedicated to this database, schedule or run this backup on the dedicated database appliance.

Recommended schedule: Run monthly
File Name: TriGeoAlertDBArchive

  • backupconfig

Schedule or run this backup to back up all of the settings on your LEM appliance. These settings include all user-defined groups, rules, and users. This backup does not back up any alert or log data.

Recommended schedule: Run weekly
File Name: TriGeoBackup

  • logbackupconfig

Schedule or run this backup to back up the original syslog data on your LEM appliance. This backup is optional since archiveconfig backs up the corresponding alert data.

Recommended schedule: Run monthly, if used
File Name: TriGeoLogBackup

  • logmarchiveconfig

Schedule or run logmarchiveconfig to back up data cores once they rotate. Data cores deleted from the database remain archived in the share folder.

Schedule: Runs automatically every 15 minutes (by manager)
File Name: TriGeoLogMArchive

  • logmbackupconfig 

Mirrors data cores contained on appliance. Archives data cores added to share. In this case, when data cores are deleted from database, so are the archived data cores on the share.

Schedule: Runs automatically every 15 minutes and once a day at midnight (by manager)
File Name: TriGeoLogMBackup


The procedure is the same for scheduling and running each of the LEM appliance backups.

To schedule or run a backup on your LEM appliance:

# Option Description
1 daily Perform daily full backup at 6:25AM
2 weekly Perform weekly full backup Sunday at 6:47AM
3 monthly Perform monthly full backup the first of the month at 6:52AM
4 never Unschedule any configured backup
5 once Run a one-time backup
6 exit Exit configuration
  1. Connect to your LEM virtual appliance using either the vSphere "console" view, or an SSH client like PuTTY.
  2. If you are using an SSH client, log in to your LEM virtual appliance using your CMC credentials.
  3. At the cmc> prompt, enter manager.
  4. At the cmc::cmm prompt, enter the name of the backup you want to schedule or run. Choose from one of the files listed above.
  5. Press Enter to start the backup script.
  6. Review the current backup settings, and then enter the number that corresponds to the option you want to choose.

  7. Enter y to confirm your selection.
  8. Enter and confirm the file location, user account, and password information you want your LEM appliance to use for the scheduled backups.
    • Enter the file location in UNC format. For example, enter \\server\share. If your LEM appliance cannot resolve hostnames, use the server's IP address instead.
    • We recommend you provide a service account for the LEM appliance to use to run backups. Otherwise, you will have to update your backup settings every time the user's password changes.
    • The user you provide in this procedure must have write permissions to the share used for the backups.
  9. Specify whether you want the backup script to append the date after the filename for each backup file. If you enter n, new backup files overwrite any existing backup file with the same name. Otherwise, the script creates a new file for every backup, appending the date to the filename in YYYYMMDD format.
  10. If you want to run the backup immediately, enter y when asked. We recommend that you only run archiveconfig and logbackupconfig during off-peak hours, as they can be very resource intensive.

Each time the backups run, your LEM manager displays an alert similar to the following in the default SolarWinds Alerts filter.

Alert Name: InternalInfo
EventInfo: ManagerMonitor Info: Backup Done with backup. InsertionIP: gman Manager: gman DetectionIP: InsertionTime: 10:11:26 Mon Jan 30 2012 DetectionTime: 10:11:25 Mon Jan 30 2012 Severity: 2 ToolAlias: Manager Monitor InferenceRule: ProviderSID: ManagerMonitor Manager Backup Info ExtraneousInfo: DUMP: Date of this level 0 dump: Mon Jan 30 09:30:32 2012

To restore raw data on your LEM appliance:

  1. Log in to your LEM virtual appliance using your CMC credentials.
  2. At the cmc> prompt, enter ndepth to navigate to the nDepth menu.
  3. At the cmc>ndepth>prompt, enter stop to stop solr.
  4. Navigate to the share where solr cores are backed up and unpack cores on the share location. Each core needs its own directory. For example, a core100 directory should contain a data directory,, and
  5. Log into the appliance using root access.
  6. Copy unpacked cores (core100, core101, and so on) to /var/rawdata/cores/datacores/.
  7. Change owner/group of copied files: chown trigeo.trigeo /var/rawdata/cores/datacores/*.
  8. Change permissions of copied files: chmod 775 /var/rawdata/cores/datacores/*.
  9. At the cmc>ndepth>prompt, enter start to start solr


Last modified