Use the app-volume-backup.py script to back up and recover app
data.
About this task
A configuration backup that you do on the backup and Recovery window does
not back up your apps' data. The /opt/qradar/bin/app-volume-backup.py script
runs nightly at 2:30 AM, and backs up each installed application's /store
mounted volume. By default, data is retained for 7 days.
Use the script to do the following tasks:
- Back up data manually for installed apps.
- List all installed app data backups on the system.
- Restore data for installed apps.
- Run the retention process and set the retention period for backups.
This script is on both the QRadar®
Console and the App Host if one is
installed. The script backs up app data only if apps are on the current host.
Procedure
-
Use SSH to log in to your Console or your App Host as the root user.
-
Go to the /opt/qradar/bin/ directory.
- Use the following command to back up app
data:
./app-volume-backup.py backup
The
app-volume-backup.py script runs nightly at 2:30 AM local time to back up all
installed apps. Backup archives are stored in the /store/apps/backup folder.
You can change the backup archives location by editing the
APP_VOLUME_BACKUP_DIR variable in
/store/configservices/staging/globalconfig/nva.conf. You must deploy changes
after you edit this variable.
- To view all data backups for installed apps, enter the following
command:
./app-volume-backup.py ls
This command outputs all backup
archives that are stored in the backup archives folder.
- To restore a backup archive, enter the following
command:
./app-volume-backup.py restore -i
<backup_name>
Use the ls command to find
the name of a backup archive.
- New in
7.5.0To restore data for a
specific application instance, rather than restoring all instances, enter the following
command:
./app-volume-backup.py restore-interactive -i <backup
name>
Note: This function was added in QRadar 7.5.0 Update Package 1,
and works only with backups that were created after updating to 7.5.0 Update Package 1.
- New in 7.5.0 Update Package 6To backup data
for an individual application instance, enter the following command:
/opt/qradar/bin/app-volume-backup.py backup -u <app definition
uuid>
In a multitenant deployment, you must specify the security profile
associated with the application instance that you want to backup. For example,
/opt/qradar/bin/app-volume-backup.py backup -u <app definition
uuid> -s <security profile id>
- New in 7.5.0 Update Package 6To restore data
for an individual application instance, enter the following command:
/opt/qradar/bin/app-volume-backup.py restore -i <backup tarball>
-n -u <app definition uuid>
In a multitenant deployment, you
must specify the security profile associated with the application instance that you want to restore.
For example, /opt/qradar/bin/app-volume-backup.py restore -i <backup
tarball> -n -u <app definition uuid> -s <security
profile id>
- By default, all backup archives are retained for one week. The retention process runs
nightly at 2:30 AM local time with the backup.
- To perform retention manually, and use the default retention period, enter the following
command:
./app-volume-backup.py retention
- You can also set the retention period manually by adding -t (time -
defaults to 1) and -p (period - defaults to 0) switches.
The
-p switch accepts three values: 0 for a week, 1 for a day, and 2 for an
hour.
For example, to set the retention period for a backup to 3 weeks, enter the following
command:
./app-volume-backup.py retention -t 3 -p 0
-
If you want to change the retention time that is used by the nightly timer, add flags to the
retention command found in the following systemd service file.
/usr/lib/systemd/system/app-data-backup.service
For example, to change the retention period that is used by the nightly retention process to 5
days, locate the following line:
ExecStart=/opt/qradar/bin/app-volume-backup.py retention
Replace it with:
ExecStart=/opt/qradar/bin/app-volume-backup.py retention -t 5 -p 1
Save your changes, and run the systemctl daemon-reload command for systemd
to apply the changes.
App containers are restarted automatically after the restore is complete.