Restoring After SA Appliance Failure

[Anonymous]

In the event of an SA Appliance failure, when I RMA the box, how do I restore the appliance to its original, pre-failure state without having to rebuild the configuration from scratch?  If there is catastrophic failure, without some type of backup or regular copy, how do I recover when I get a replacement box?

Thanks, John

[Anonymous]

Check out. https://sadocs.emc.com/0_en-us/090_10.4_User_Guide/215_SysAdmin/10_BckUp_Rest

[RSAAdmin]

Hi John,

I've backed up the following directories which I decided I needed in 10.2 but also I believe are accurate on 10.3 - maybe the RSA mods will need to comment to confirm that these are all that are needed on 10.4 also?

• /etc/netwitness
• /var/lib/netwitness/uax/conf
• /var/lib/netwitness/uax/db
• /opt/rsa
• /opt/fneserver
• /home/rsasoc/rsa/soc/reporting-engine/alerts
• /home/rsasoc/rsa/soc/reporting-engine/config
• /home/rsasoc/rsa/soc/reporting-engine/keystores
• /etc/fstab
• /etc/hosts
• /etc/ntp.conf
• /etc/resolv.conf
• /etc/sysconfig/network
• /etc/sysconfig/network-scripts/ifcfg*
• /var/lib/jetty*/etc

This was based on my needs as at the time I wasn't using certain aspects of the product (such as spectrum) so don't take the above as a complete list of everything. I restored an appliance once and I don't think much if anything was missed. I had a script to compress and run on a weekly basis and then that scp'd to a fillshare.

Hope this helps.

Patrick

[RSAAdmin]

stating the obvious but I used this script on all appliances - I could have customised it to remove the directories that didn't exist on devices (ie jetty - only exists on the SA/ broker) but I didn't

if the directory doesn't exist then nothing gets backed up.