How to move Long-Term Archive to a new location (Netwrix Auditor 7.0 - 8.5)

This article applies to Netwrix Auditor 7.0 - 8.5 and provides instructions on how to store your Long-Term Archive to a desired location.
Email It to Me Print this Page
Question How can I move my Long-Term Archive to a desired location?
Answer If you use Netwrix Auditor 6.5 and below, refer to  How to move Audit Archive to a new location.
If you use Netwrix Auditor 9.0 and above, refer to How to move Long-Term Archive to a new location (Netwrix Auditor 9.0 and above)

Note: After upgrade from Netwrix Auditor 8.0 to 8.5, the product stores audit data contained in both Long-term Archive and Short-Term Archive to the same directory. So, you need to move your Short-term Archive prior to Long-Term Archive. Contact Netwrix technical support for instructions on how to move Short-Term Archive to a new location.

To move Long-Term Archive to another location:
  1. Navigate to the Managed Object, pick an audited system and unselect the Enable checkbox. Do this for all your Managed Objects.
  2. Open Windows Task Manager, switch to the Processes tab and wait until the following processes have completed:
Audited SystemNetwrix Auditor 8.0 and belowNetwrix Auditor 8.5 after upgradeClear install of Netwrix Auditor 8.5
Active DirectoryADCR.exe
Group Policy
File ServersNetwrix.FSA.Collector.exeNetwrix.FSA.AgentService.exe
Azure ADNetwrix.O365.AzureAdReporter.exe
Exchange OnlineNetwrix.O365.ExchangeOnlineReporter.exe
SharePoint OnlineSpaOnlineHost.exe
Oracle DatabaseNetwrix.OracleDataRetriever.exe
SQL ServerNetwrix.SQLA.Collector.exe
Windows ServerWSA.exe
Event LogEventManager.exe
Inactive Users in Active DirectoryIut.exe
Password Expiration AlertingPea.exePea.exe
User ActivityUserMonitor.exeUAVRServer.exe
    1. Stop product services. Navigate to Start --> Run and type "services.msc"; locate and stop the following services:
    • Netwrix Auditor Service for SharePoint
    • Netwrix Auditor Archive Service (Note: Stop this service only if you use clear install of Netwrix Auditor 8.5).
    • Netwrix Auditor User Activity Audit Service (Auditor User Activity Collector for Netwrix Auditor 8.5 and below)
    • Netwrix Auditor for File Servers Audit Service
    • Netwrix Auditor for Oracle Database Audit Service
    • Netwrix Auditor Logon Activity Audit Service
    • Netwrix Auditor Data Collection Service
    • Netwrix Auditor for Windows Server Audit Service
    Note: If you have Netwrix Auditor Event Log Manager enabled, you must disable his scheduled task. Navigate to Start --> All Programs --> Task Scheduler --> task Scheduler Library and locate the task with description "Starts Netwrix Auditor data collection on Event Log for <your monitoring plan name>". Disable the task.
    1. Navigate to the current Long-Term Archive location. Check the path: navigate to Settings --> Long-Term Archive.

    2. Copy audit data to a new Long-Term Archive location.
         Note: It is not recommended to store Long-Term Archive on a system disk.
    1. Modify the Long-Term Archive location settings in Netwrix Auditor Console: navigate to Settings --> Long-Term Archive and click Modify.  Specify the new path.
    2. Restart the services and tasks you have stopped.
    3. Enable audit to each Managed Object as shown on the step 1.
    Was this information helpful?