Backup / Restore¶
Backup: Alert data (Cold Storage)¶
Alert data is rotated and compressed in json and log format every 24 hours. AEO indexes the json data in console, and this data is the primary focus for backups.
Step 1: Backup/Transfer archive data
Copy /var/ossec/logs/alerts/<YYYY>/<Mon>/ to the backup location.
Example (rsync over ssh):rsync -av -e ssh root@aeo:/var/ossec/logs/alerts/2020/* /mnt/backup
Restore: Alert data (Cold Storage)¶
Step 1: Transfer cold storage to hot storage
Copy backup data to /var/ossec/logs/alerts/<YYYY>/<Mon>/
Example (rsync over ssh):rsync -av -e ssh /mnt/backup/ root@aeo:/var/ossec/logs/alerts/2020/
Step 2: Re-index restored data
On the AEO hub run:systemctl stop awpd /var/awp/bin/awp_indexgen systemctl start awpd
Index generation can take several minutes per file.