IBM Support

QRadar: Cannot import configuration backups due to "invalid backup archive"

Troubleshooting


Problem

Attempting to import a configuration backup, the following error message might be displayed:
"Invalid backup archive, please make sure the file that you are trying to upload is under 512M."

Cause

The backup import facility in the User Interface (UI) has a size limit of 512 MBs. If your environment has a large configuration, the configuration backup file size can grow beyond what the UI supports. If the file you are attempting to import is larger than 512 MB, this error is displayed:
"Invalid backup archive, please make sure the file that you are trying to upload is under 512M."

warningmessage

Diagnosing The Problem

The error message that is displayed is a clear indication of the problem. You can also verify locally that the file you are attempting to import is larger than 512 MB.
image-20230306173654-1

Resolving The Problem

The file size limitation exists only on the UI. Using the following backend procedure, you can import configuration backups that are larger than 512 MB.

Procedure
  1. Open a connection to your QRadar Console by using the root account with an SCP or SFTP application.
  2. Copy the required configuration backup (with a file size larger than 512 MB) to the /store/backupHost/inbound directory.
  3. Log in to the QRadar Console UI.
  4. On the navigation menu ( Navigation menu icon ), clicking Admin > System Configuration > Backup and Recovery triggers a backup synchronization. QRadar starts processing the backup archive that was uploaded earlier.
    backupnotvisable
  5. Close the Backup and Recovery window and wait a few minutes. Now open the Backup and Recovery window again.image-20230306173853-2
    Note: If the config or data backup is not displaying, check the /store/backupHost/invalid folder. If the backup is being moved to the invalid directory, it was either not the correct version or not made with the scheduled or manual backup in the UI. 

    Results
    The intended backup archive is now listed in the Backup and Recovery window to be restored as needed.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4.0;7.5.0"}]

Document Information

Modified date:
06 March 2023

UID

swg21991697

Page Feedback