How to use Event Logging, including a list of Event Codes
The RBackup Endpoint and Server can write to the Windows event logs. You can use this feature for remote monitoring using MSP software.
Event Logging for the Endpoint Software
Event Logging can be turned ON and OFF by a registry key and a control in the RBackup Customize Endpoint Installer utility. The Endpoint will log events in the Application Log. The Event Logging Source name will be the Product Name or Application Name (as customized in the rcap.ini file). By default event logging is ON.
HKEY_LOCAL_MACHINE\SOFTWARE\Quantum Tech, Inc.\Remote Backup\Settings:
“WriteEventLogs” – REG_SZ
Set the value to “True” or “False”
* This key can be edited in the Customize Endpoint Installer (Section: More Advanced Options)
For the RBackup Endpoint software, event logging can be turned on or off in the Customize Endpoint Installer utility, and after you make new Endpoint installers logging will be on or off for new Endpoints after installation.
For existing clients you can use the backup.reg file to set registry settings for software that has already been installed.
Backup Start event will record the following details:
Backup complete event will record the following details:
Each event log has a unique event ID for SPs to look up more information about the specific event reported.
5000 – Backup Endpoint (Backup Engine: rbclient.exe) starting.
5001 – Backup Endpoint (Backup Engine: rbclient.exe) exiting.
5002 – Backup Started
5003 – Backup Completed
5004 – Backup Canceled
5005 – Backup Paused
5006 – Backup Resumed
5007 - Backup Window Exceeded. Stopping Backup Session.
5008 - Attempt Window Expired. Stopping Backup Session.
5009 – Backup Stopped. Free space threshold exceeded.
531 – Backup Canceled. Account Suspended on backup server. (Error 531)
530 – Backup Canceled. Login Failure. (Error 530)
5010 – Fatalrror encountered in Backup Engine (rbClient.exe). Refer to event log description and sessionlog/backuplog for more details.
6000 – Backup Endpoint (Tray Application: rbackup.exe) starting.
6001 – Backup Endpoint (Tray Application: rbackup.exe) exiting.
6003 – Missed Backup
6004 – Failed Backup
Event Logging for the Server Software
Event logging for the Server software is controlled by registry key “WriteEventLogs” under the Settings branch. To enable check the option ‘Turn ON Event Logging’ in the RBS Manager: Properties (or via Web Manager if installed). This requires a restart of the RBS Server.
The following events will be logged for the server (rbs.exe).
7000 – RBS Server starting
7001 – RBS Server shutting down
7002 – Server started. (Logs Listening Port, local IP, public IP, current audit log and root folder)
7003 – ‘RBS Server’ Service events (Start, paused, stopped, resumed events)
7004 – Server Informational Log (See Log details for description)
7009 – Failed Login from client (Logs username/password)
7010 – Fatal error encountered in RBS Server. Refer to event log description and audit log for more details.
10048 – Port already in use. Server cannot start.