Add UI Controls to Check, Cancel, and Reset Stuck Audit Log Backup Processes

Products Endpoint Protector Ideas
,
1

What is a one sentence summary of your feature request?

Please add an option in the EPP administrator web console UI to check, cancel, and reset a stuck audit log backup process.

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

We are experiencing an issue on both EPP Server 5.9.4.2 and the latest 2.6.0.2 version where the audit log backup process does not complete and remains in a permanent in-progress loop.

Based on our checks so far, this issue does not appear to follow any clear pattern related to the amount of accumulated audit logs or any specific rule or configuration.

When this audit log backup loop occurs, there is currently no way for the customer to recover from it through the product UI.

The only available action is backend database intervention through a remote session with a Netwrix engineer.

This is a major operational problem for customers in Korea, especially for financial and securities companies that run EPP servers in isolated environments.

In those environments, remote backend support is often not possible, so the customer is left with only very heavy recovery options such as restoring a VM snapshot or rebuilding the VM.

From the customer perspective, this is considered a critical incident because backup-related issues that cannot be handled from the UI create high operational risk and recovery burden.

For this reason, we strongly need an administrator UI feature that allows us to check the current status of the audit log backup process and cancel or reset it when it is stuck.

This issue has been handled with support under ticket #00472359, but there is no practical way to resolve it except through feature enhancement.

That is why we are submitting this feature request.

How do you currently solve the challenges you have by not having this feature?

Currently, when this issue happens, we have to ask Netwrix support to access the backend database and perform a manual recovery action through a remote session.

However, for customers in closed financial or securities environments, this remote action cannot be used.

In those cases, the only remaining options are restoring a previous VM snapshot or rebuilding the EPP server.

These are not realistic or acceptable operational workarounds for a backup process issue, and they create major service and maintenance burden for the customer.

2

Hi Sung,

Thanks for taking the time to lay this out so clearly. This does not come across as a cosmetic UI request. When an audit log backup gets stuck and the only recovery path is backend database intervention, that becomes an operational risk, especially for customers running Endpoint Protector in isolated environments where remote access is not an option.

The request to let administrators check the current state of the backup job and cancel or reset it from the web console is a reasonable one. Today, the documented backup flow focuses on starting a backup, monitoring its status, and then downloading or restoring it, but not on recovering a stuck process directly from the UI.

We’ve captured your request and will review it with the team. As part of that review, we also want to look at the underlying cause of the backup process entering this state, since ideally this scenario should not require manual backend recovery in the first place.

I can’t promise a timeline today, but this is something we will keep in view as we evaluate improvements in this area.

Best,
Mihai

1 Like
3

Thank you for your thoughtful response and for recognizing the operational impact of this issue.

We appreciate that both the feature request and the underlying cause will be reviewed by the team.

We agree that this situation should ideally be recoverable without manual backend intervention.

Thank you again for considering this request.

We look forward to a positive outcome.

4

Hello,

Could you please share an update on the current status of this feature request?
We would like to understand how it is currently being discussed internally and whether there is any plan to include it in a future release patch.

Thank you.