New Ranks & Badges For The Community!
Notice something different? The ranks and associated badges have gone "Star Fleet". See what they all mean HERE
Highlighted
Cadet 1st Class
Cadet 1st Class
431 views

Question about event backup.

Hello everyone,

Is there a way to export/import events from a arcsigth express (same model, same version)? and how can we do that?

Labels (2)
0 Likes
4 Replies
Highlighted
Absent Member.
Absent Member.

you can use Packages to take backup of resources(eg:- reports, data monitors, rule, channels) e.t.c and save as .arb file.

0 Likes
Highlighted
Fleet Admiral
Fleet Admiral

Official guide here:

But as Deepak comments - if you are interested in the content (such as users, roles, rules, reports, filters etc), you can just use a package and add what you need. If you need to backup the system and the events themselves you will need the guide above for this.

One word of caution though - if you turn on archiving AND you keep those files somewhere else (such as on a separate filesystem or server), you have YESTERDAYS log data! That means you can turn on archiving and have yesterdays logs saved for you automatically. Its a running process and effectively is a daily backup of the logs. If you have archives and the system configuration (see the guide above), you can easily recover the system and use the archives for access to the log data. Its not quite the same as a daily backup (hence the reason why its called an archive), but it does work and is very simple.

0 Likes
Highlighted
Cadet 1st Class
Cadet 1st Class

Hello Deepak

Thanks for your answer, I did exactly what you suggest about the arcsigth resources, but my questions was about the actual logs that the express is receiving / pulling.

0 Likes
Highlighted
Cadet 1st Class
Cadet 1st Class

Thanks Paul,

So is it possible then to have the logs in the "new" express (exact model and versions), i beleive support says that the metadata is not compatible.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.