Troubleshooting
Problem
An attempt to restore a backup from an old appliance to new appliance failed with the following error: "Unable to restore backup archive".
Symptom
Symptom /store/backup/backup.nightly.Qradar_3.26_07_2015.config.1437978744.tgz does not exist. Failed to extract backup.
Jul 28 09:00:12::ffff:10.x.x.x [hostcontext.hostcontext] [BackupServices_restore] com.q1labs.hostcontext.backup.BackupRecoveryEngine: [ERROR] [NOT:0000003000][10.10./- -] [-/- -]Unable to execute restore request
Jul 28 09:00:12::ffff:10.x.x.x.x[hostcontext.hostcontext] [BackupServices_restore] com.q1labs.configservices.hostcontext.exception.RestoreException: Unable to restore backup archive
Jul 28 09:53:15 ::ffff:10.x.x.x [hostcontext.hostcontext] [Thread-860] ComponentOutput: [ERROR] [NOT:0000003000][10.x.x.x/- -] [-/- -]ErrorStream backup_extract: Tue Jul 28 09:53:15 EDT 2015 [backup.sh] ERROR: /store/backup/backup.nightly.Qradar_3.26_07_2015.config.1437973398744.tgz does not exist
Jul 28 09:53:15 ::ffff:10.x.x.x [hostcontext.hostcontext] [Thread-860] ComponentOutput: [ERROR] [NOT:0000003000][10.x.x.x/- -] [-/- -]ErrorStream backup_extract: Tue Jul 28 09:53:15 EDT 2015 [backup.sh] ERROR: Failed to extract backup
Cause
This may be caused if the host name on the old appliance was different than the one on the new appliance. In this case, the old appliance's host name was Qradar (capital Q), but the host name on the new appliance was qradar (lower case q). This caused the backup to be named with upper case Q which is failing to restore due to file name mismatch.
Environment
QRadar 7.2.5
Diagnosing The Problem
Verify that the host name from the old appliance matches the host name from the new appliance and that the backup file name matches these host names accordingly.
Resolving The Problem
Accordingly, rename the backup file, so that the Old Backup host name matches the New Backup host name. Copy the backup into the backup inbound folder. Alternatively, if the backup is on a Windows system, go to the QRadar web user interface. Then, perform the following Admin Tab > Backup and Recovery > Upload Archive. Restore again using the newly named Backup.
Where do you find more information?
Was this topic helpful?
Document Information
Modified date:
16 June 2018
UID
swg21963260