We have hired a consultant to do some internal penetration testing and they claim they were able to log in and complete some restores, but I cannot verify nor deny that, so I am wondering if there is a log that shows all of the restores that were done in the last week or last month preferably.
I am hoping there is a command where I can see this that goes back further than > mccli activity show displays.
Is there is a log on the sever that would show this, where would I look for it? Or is there a log to show what a particular user has done. They have told us what userID they used.
When I try to recreate the restores using the steps they provided, I am not able to do the restores. Therefore I need to find some logs to verify or deny what they were saying to management.
Solved! Go to Solution.
That was great direction to look; however, I was not able to find any reports that start with restore, but I did find a report called Activities-Success and I was able to export that to Excel and filter on Restore and that provided what I was looking for.
Thank you for pointing me in the right direction!