Description
This article describes how to backup and restore the event DB for FortiSIEM.
Scope
FortiSIEM.
Solution
Backup:
In order to back up the data from event DB, situate the event data stored in /data/eventdb. Since this data can become very large over time, a program such as rsync can be used to incrementally move the data to another location.
- Decide Network Location: e.g. NFS or SMB.
- Before intializing backup, stop FortiSIEM services: phtools stop all
- Check that all processes have stopped: phstatus
- Backing up the EventDB can be done with two methods:
- Using Mysqldump: mysqldump -u root -p eventdb > /path/to/backup/eventdb_backup.sql
- Using rsync: rsync -a --progress /data/eventdb /<another>/<mount>/<point>
- Check the backup: ls -lh /path/to/backup/eventdb_backup.sql
- Restart FortiSIEM: phtools start all
Restore:
In order to restore the event DB data, mount the directory where the event database was backed up.
$ sudo mkdir /media/newhd
$ sudo mount /data/eventdb /media/newhd
$ df -H
rsync -a --progress /backup/eventdb /data/eventdb
It is important to note that the event data logs are stored in a proprietary event database.
Related articles:
