Highlighted
christian.amaya1 Contributor.
Contributor.
312 views

Question about event backup.

Hello everyone,

Is there a way to export/import events from a arcsigth express (same model, same version)? and how can we do that?

Labels (3)
0 Likes
4 Replies
deepakroy1841 Absent Member.
Absent Member.

Re: Question about event backup.

you can use Packages to take backup of resources(eg:- reports, data monitors, rule, channels) e.t.c and save as .arb file.

0 Likes
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Question about event backup.

Official guide here:

But as Deepak comments - if you are interested in the content (such as users, roles, rules, reports, filters etc), you can just use a package and add what you need. If you need to backup the system and the events themselves you will need the guide above for this.

One word of caution though - if you turn on archiving AND you keep those files somewhere else (such as on a separate filesystem or server), you have YESTERDAYS log data! That means you can turn on archiving and have yesterdays logs saved for you automatically. Its a running process and effectively is a daily backup of the logs. If you have archives and the system configuration (see the guide above), you can easily recover the system and use the archives for access to the log data. Its not quite the same as a daily backup (hence the reason why its called an archive), but it does work and is very simple.

0 Likes
christian.amaya1 Contributor.
Contributor.

Re: Question about event backup.

Hello Deepak

Thanks for your answer, I did exactly what you suggest about the arcsigth resources, but my questions was about the actual logs that the express is receiving / pulling.

0 Likes
christian.amaya1 Contributor.
Contributor.

Re: Question about event backup.

Thanks Paul,

So is it possible then to have the logs in the "new" express (exact model and versions), i beleive support says that the metadata is not compatible.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.