Anyone has experience to backup and restore ESM 6.5c?

[analog1]

We are trying to migrate to 6.5c but hit a big hurdle. It seems to me there is no documented procedure to perform full/incremental backups on ESM 6.5c, especially the CORR engine and its online event storage.

In 5.2 you can just backup the ESM binaries, and use Oracle rman utility to perform the full/incremental backups without any downtime. How do we do that with 6.5c? Anyone doing this today? How do you backup and restore? I opened a case with ArcSight but would like to see how you do that in real world. Many thanks

[nicholas.hsiao@1]

Currently, if you need to perform full backup, that will need to have downtime for ESM.

But you could minimize the downtime via storage snapshot technology.  Say, to shutdown ESM server for a while only and then trigger storage to backup /opt partition.

If you wanna backup MySQL and others, there is also some procedure there. But it won't be in official support.

In ESM 6.8c, arc sight offer HA feature... the data in primary site could be sync. to secondary (cluster) ESM.  And you could consider backup from the 2nd ESM and keep primary ESM running always.

Nicholas

[reswob4]

Here's a link to an indepth discussion: https://protect724.hp.com/message/33746#33746

and here's a link to how we're doing it at my location: https://protect724.hp.com/message/42051#42051

[analog1]

thank you Craig. The discussion is really good. But surprisingly or unsurprisingly, ArcSight still yet to have any official document on this.

[analog1]

thank you for your insight.