Restoring an aggregator that is not centrally managed

Follow these steps to restore an aggregator that is not centrally managed.

About this task

Alternatively, to restore data backup, consider aggregating data again from collectors, depending on the number of collectors and the retention period requirements on the collectors and aggregator.

Procedure

  1. Use an ISO that is appropriate for your appliance.
    For example, to restore a collector, use a collector ISO; for an aggregator, use an aggregator ISO.
  2. Apply the license.
  3. Make sure that your newly built appliance is at an equal or later version than the source appliance from which the backup was taken. If the appliance is at an earlier version, then apply the required GPU, bundle, and sniffer patches to bring the appliance to the same patch level as it was when the last backup was taken.
    For example, if the source appliance is a version 11.4 Guardium system that was patched with bundle 11.0p450 and sniffer patch 11.0p4020 and the new appliance was built from ISO 11.3, choose one of the following options:
    • Install 11.4 GPU. Then, apply appliance bundle version 11.0p450 or later and sniffer patch version 11.0p4020 or later.

      Or,

    • Install GPU version 11.5 or later.
  4. Use the restore backup CLI command to restore the data and configuration backups.
    For more information, see Before you restore your Guardium system.
  5. If needed, restore the archive files for any missing days.

What to do next

When restoring data from an aggregator to a new system with a different hostname, the new system shows collectors from the source aggregator, and the collectors on the new system. After completing the restore:
  1. On each of the old collectors define a data export to the new aggregator and click Save.
  2. Clear the Export checkbox in the data export (that you just defined) and click Save.