IBM Support

Backup files on IBM Security QRadar appliances 11xx, 12xx, 13xx, 15xx

Question & Answer


Why are there no backup files on QRadar 11xx, 12xx, 13xx, and 15xx appliances?


When looking for backup data files, you might not find any under /store/backup directories on Flow Collectors and Flow Processors.

QRadar generates two types of backup files, data and configuration(config). The configuration backup files are generated only on the console appliance and they contain all deployment configuration required for a backup restore. This file is only generated on the console system (i.e. 31xx appliance) when configured on the Admin > Backup and Recovery menu.

The data backup files are generated on managed hosts that process events, including the console itself. Data backups are incremental containing data for the last 24 hours.

However, QFlow and Event Collectors do not perform any backups because they do not store any data or events. All events and flows received by appliances of the type 11xx, 12xx 13xx, and 15xx is sent to their respective processor, 17xx , 18xx or 31xx, and stored there where they can be backed up.


There is nothing wrong with not finding any backup files on appliances of the type 11xx, 12xx, 13xx and 15xx.

QFlows and 15xx are the only appliance that can be rebuilt without data or configuration concerns. There is no data backup for these appliances.

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018