Hi
I am taking backup of my data base location i.e. /var/netwitness/broker.
tar -C / --exclude='/var/netwitness/broker/statdb/*' -cvJf /tmp/Broker-Data.$year.$day.$month.tar.xz /var/netwitness/broker
Please let me know if anything else also is required for full DB backup.
Mr. Snider is certainly correct on this matter. If you looking to backup any sort of configuration data though, I've provided a link to SA Docs below which articulates the method to do so.
Core Hosts Backup and Recovery - RSA Security Analytics Documentation
Otherwise, there would be little value in attempting to backup the indexes from the Brokers themselves. Let us know exactly what it is that you're trying to accomplish.
Thanks for reply Robert. Please see my new comment for the details on issue.
Hi John
I am exactly preparing a procedure for full DB backup in our enviornment for disater recovery. So I can understand with your reply that we need to take backup of db files at decoder and meta and session files at concentrator to backup the database. I am already taking config backup i.e /etc/netwitness/ng and reporting engine. Should I include more in this procedure?
So you're looking to backup the entire system including the data you've captured so far? What sort of instance are you running, Logs/Packets/Both?
If I am making the correct assumption, have you backed up your packetdp's, session db's, meta db's, etc? I'll defer to Johns knowledge and experience here but, if I am understanding you, it sounds like quite the endeavor! You must have a heck of a lot of backup storage!
May I ask WHY you are backing up those files? The broker can re-consume the indexes from the concentrators in a matter of minutes, there is no real need to back up the databases on the Broker service..