Logs and backups: what to preserve before changing an IT system
After an IT project failure or dispute, the system is often immediately updated, reinstalled or cleared. This may be necessary to keep the business running, but also changes…
After an IT project failure or dispute, the system is often immediately updated, reinstalled or cleared. This may be necessary to keep the business running, but also changes traces of the event. Before intervention, agree on which data must be preserved and how copies will be linked to a specific system state.
First define the time window
Record when the problem was discovered, which users and components were affected, what happened beforehand and which actions have already been taken. Specify the time zone and any known clock differences between systems. Timestamps from different logs cannot automatically be treated as one precise timeline.
What may be needed
- Application, system and relevant infrastructure logs.
- Backups, stating how they were created and what they contain.
- Configurations, component versions and deployment history.
- Information about tasks, changes, tickets and observed errors.
- Documents establishing access rights and the boundaries of the authorized examination.
Preservation without promising complete immutability
A running system continues to create and overwrite data. Record the method and time of acquisition, operator, source and known limitations. A checksum helps verify that a particular file remains unchanged thereafter, but does not automatically prove the reliability of all information within it.
What counts as a backup
A file archive, virtual machine snapshot and consistent database backup may differ in contents and suitability for restoration. An archive extension does not guarantee that the file contains the required tables, logs and settings. Contents and consistency are checked with regard to the technology, without running an unknown copy in production.
Do not attempt to reproduce a destructive failure on the only copy of the data. Prepare a separate examination environment and agree on permitted actions, protecting the production environment within the necessary constraints.
Access credentials and personal information
Do not include passwords, tokens or private keys in an ordinary email describing the problem. Discuss export contents and secure transfer separately. When reducing the data volume, retain sufficient context and explain which information has been removed.
Connecting logs to the question
An absent entry may result from logging settings, rotation or an incomplete export. It does not always prove that an event did not occur. The opinion must describe sources, limitations and the reasoning behind comparisons. A good inventory of copies and changes distinguishes established actions from assumptions about system behavior.
Resources on the subject
Tell us
about your task.
Describe the situation and attach the materials. After reviewing your request, we will agree on the examination format, questions, timeframe and cost.