Backup process for McAfee devices

Transcription

1 Backup process for McAfee devices ESM (Standalone) Backup The backup process on the ESM is intended to create a backup of the tables on the ESM for restoring the configuration of the ESM. There are two backup types Full or incremental. They are described below. A Full backup is a backup of all database table files uncompressed to a remote storage location. This backup type can back up to a CIFS/NFS location. The storage location is mounted before the backup starts and is checked each time to ensure the backup begins. It is expected that the backup location will contain more than one backup file unless the backup location is maintained by the user. The files are copied uncompressed to the storage location for storage and subsequent restoration. For a list of the tables backed up from the ESM is listed the backup.log file is stored with backup. The path backup files will be copied to appears like this: xx.xx.xx.xx:/backupfolder/etm-xx_9.3.1_2013_12_25_215739_f/ An incremental backup is a backup of ESM configuration files compressed to a local or remote storage location. There is also an option to back up the event/flow/log data for the last 24 hours. (based off last backup time stamp) For a list of the tables backed up from the ESM, open the backup.log file is stored within the backup.zip file each time the backup is run. The backup log file contains the tables that are backed up and the records in each table that was backed up. See the output of the file below: TABLE ADGROPSM ( :12:05) (63928 record (s)) (0 deleted TABLE ADGroup ( :12:05) (336 record (s)) (0 deleted TABLE AGGXCPTN ( :12:05) (4 record (s)) (0 deleted TABLE ASSETGRP ( :12:05) (4 record (s)) (0 deleted TABLE ASSTGRRF ( :12:05) (20014 record (s)) (0 deleted TABLE ASSTVBLT ( :12:05) (2339 record (s)) (0 deleted TABLE ASSTVNDR ( :12:05) (20009 record (s)) (0 deleted TABLE ATCRTRL ( :12:05) (10 record (s)) (0 deleted TABLE ATCRTRLC ( :12:05) (160 record (s)) (0 deleted TABLE Access ( :12:05) (778 record (s)) (170 deleted TABLE Action ( :12:05) (39 record (s)) (0 deleted TABLE Asset ( :12:05) (20009 record (s)) (0 deleted TABLE BLACKLST ( :12:05) (1 record (s)) (0 deleted TABLE BLCKLFFR ( :12:05) (0 record (s)) (0 deleted TABLE CASEVNTS ( :12:05) (203 record (s)) (0 deleted TABLE CHANGELG ( :12:06) (41473 record (s)) (0 deleted TABLE CONDITIN ( :12:06) (26 record (s)) (0 deleted TABLE CaseMgt ( :12:06) (184 record (s)) (0 deleted

2 TABLE CaseOrg ( :12:06) (1 record (s)) (0 deleted TABLE Class ( :12:06) (68 record (s)) (0 deleted TABLE DEVICEFO ( :12:06) (7 record (s)) (0 deleted TABLE DTNRCHMT ( :12:06) (5 record (s)) (0 deleted TABLE DTNRCLDS ( :12:06) (3 record (s)) (0 deleted TABLE DTNRCPSD ( :12:06) (3 record (s)) (0 deleted TABLE DVCFLSJN ( :12:06) (28 record (s)) (67 deleted TABLE GRP ( :12:06) (1 record (s)) (0 deleted TABLE EMLDDRSS ( :12:06) (8 record (s)) (0 deleted TABLE Gro ( :12:06) (3 record (s)) (0 deleted TABLE ESMFLTRS ( :12:06) (0 record (s)) (0 deleted TABLE EVNTFDNG ( :12:06) (3 record (s)) (0 deleted TABLE EXTDVCTT ( :12:06) (259 record (s)) (0 deleted TABLE EXTRNLDV ( :12:06) (109 record (s)) (0 deleted TABLE GeoLoc ( :12:08) ( record (s)) (0 deleted TABLE Groups ( :12:08) (10 record (s)) (0 deleted TABLE HCFILTRS ( :12:08) (0 record (s)) (0 deleted TABLE HLTHSNGS ( :12:08) (16854 record (s)) (0 deleted TABLE Hosts ( :12:08) (489 record (s)) (0 deleted TABLE ICMPType ( :12:08) (66 record (s)) (0 deleted TABLE IPS ( :12:08) (153 record (s)) (2382 deleted TABLE IPSBlob ( :12:09) (731 record (s)) (612 deleted TABLE IPSCHANG ( :12:09) (153 record (s)) (2382 deleted TABLE IPSCheck ( :12:09) (15 record (s)) (0 deleted TABLE ITMRGHTS ( :12:09) (4 record (s)) (0 deleted TABLE LCLSTRNG ( :12:09) ( record (s)) (0 deleted TABLE LOGCATGR ( :12:09) (11 record (s)) (0 deleted TABLE MSSGTMPL ( :12:09) (11 record (s)) (0 deleted TABLE NDDVCNFC ( :12:09) (0 record (s)) (0 deleted TABLE NDDVCSSS ( :12:09) (0 record (s)) (0 deleted TABLE NDDVCVLN ( :12:09) (0 record (s)) (0 deleted TABLE NDDevice ( :12:09) (0 record (s)) (0 deleted TABLE NDEPDVCS ( :12:09) (0 record (s)) (0 deleted TABLE NDEPPRMS ( :12:09) (1 record (s)) (0 deleted TABLE NDFLDRDC ( :12:09) (0 record (s)) (0 deleted TABLE NDFolder ( :12:09) (0 record (s)) (0 deleted TABLE NDIPLoc ( :12:09) (419 record (s)) (0 deleted TABLE NDNDPHST ( :12:09) (0 record (s)) (0 deleted TABLE NDNDPNTP ( :12:09) (0 record (s)) (0 deleted TABLE NDNDPNTS ( :12:09) (0 record (s)) (0 deleted TABLE NDNDPSTR ( :12:09) (0 record (s)) (0 deleted TABLE NDNGHBRS ( :12:09) (0 record (s)) (0 deleted TABLE NDPRMLSN ( :12:09) (0 record (s)) (0 deleted TABLE NDPRMSDL ( :12:09) (1 record (s)) (0 deleted

3 TABLE NDPROCSS ( :12:09) (3 record (s)) (0 deleted TABLE NDPRTCRL ( :12:09) (0 record (s)) (0 deleted TABLE NDParams ( :12:09) (1 record (s)) (0 deleted TABLE NDSRCLTS ( :12:09) (0 record (s)) (0 deleted TABLE NOTIFCTN ( :12:09) (31 record (s)) (0 deleted TABLE NTFCTBRS ( :12:09) (123 record (s)) (53 deleted TABLE NTFCTNCH ( :12:09) (31 record (s)) (0 deleted TABLE NTFCTNCN ( :12:09) (61 record (s)) (1 deleted TABLE NTFCTNML ( :12:09) (0 record (s)) (0 deleted TABLE NTFCTNSR ( :12:09) (0 record (s)) (0 deleted TABLE NTFCTTTR ( :12:09) (326 record (s)) (0 deleted TABLE Notes ( :12:09) (0 record (s)) (0 deleted TABLE Notifica ( :12:09) (7 record (s)) (0 deleted TABLE Query ( :12:09) (1255 record (s)) (0 deleted TABLE RGHTSMNT ( :12:09) (147 record (s)) (0 deleted TABLE RMTCMMND ( :12:09) (1 record (s)) (0 deleted TABLE RMTCMTTR ( :12:09) (3 record (s)) (0 deleted TABLE RPRTCMNT ( :12:09) (2316 record (s)) (0 deleted TABLE RPRTFLDR ( :12:09) (96 record (s)) (0 deleted TABLE RULEPARA ( :12:09) (0 record (s)) (0 deleted TABLE RULEPARM ( :12:09) (404 record (s)) (3 deleted TABLE RULEUSEE ( :12:09) (50968 record (s)) ( deleted TABLE Reports ( :12:09) (900 record (s)) (0 deleted TABLE Rights ( :12:09) (27 record (s)) (0 deleted TABLE Rule ( :12:10) ( record (s)) (0 deleted TABLE RuleVA ( :12:10) (19445 record (s)) (0 deleted TABLE OS ( :12:09) (28 record (s)) (0 deleted TABLE RuleVIN ( :12:10) (16711 record (s)) (0 deleted TABLE PLUGINDT ( :12:09) (0 record (s)) (0 deleted TABLE PREPRCSS ( :12:09) (19 record (s)) (0 deleted TABLE PRPRCPTN ( :12:09) (3 record (s)) (0 deleted TABLE PRPRCSRP ( :12:09) (11 record (s)) (0 deleted TABLE Plugins ( :12:09) (0 record (s)) (0 deleted TABLE PortApps ( :12:09) (96 record (s)) (0 deleted TABLE Ports ( :12:09) (4460 record (s)) (0 deleted TABLE Profile ( :12:09) (11 record (s)) (0 deleted TABLE SENDEMAL ( :12:10) (0 record (s)) (1 deleted TABLE SENDSSLG ( :12:10) (0 record (s)) (0 deleted TABLE SLCTFLDM ( :12:10) (163 record (s)) (0 deleted TABLE SMXRef ( :12:10) (0 record (s)) (0 deleted TABLE SSSTTNGS ( :12:10) (269 record (s)) (0 deleted TABLE STRINGMP ( :12:10) ( record (s)) (0 deleted TABLE Scoring ( :12:10) (3 record (s)) (1 deleted TABLE TAGSVBTS ( :12:10) (74 record (s)) (0 deleted

4 TABLE TGPDTXTN ( :12:10) (57 record (s)) (29 deleted TABLE TGSSTGRP ( :12:10) (31 record (s)) (0 deleted TABLE TGSSTXTN ( :12:10) (64 record (s)) (0 deleted TABLE THRDPNFG ( :12:10) (1223 record (s)) (1701 deleted TABLE THRDPRTP ( :12:10) (440 record (s)) (0 deleted TABLE TPTPPPLC ( :12:10) (14 record (s)) (0 deleted TABLE TRGGRDLM ( :12:10) (2309 record (s)) (1 deleted TABLE USERLCNS ( :12:11) (17 record (s)) (0 deleted TABLE USERSTTS ( :12:11) (1 record (s)) (0 deleted TABLE USRFLTST ( :12:11) (5727 record (s)) (0 deleted TABLE USRPSDJN ( :12:11) (0 record (s)) (0 deleted TABLE USRVWXSN ( :12:11) (0 record (s)) (0 deleted TABLE User_IPS ( :12:11) (14 record (s)) (0 deleted TABLE Users ( :12:11) (32 record (s)) (0 deleted TABLE Tag ( :12:10) (917 record (s)) (0 deleted TABLE UsersPW ( :12:11) (22 record (s)) (0 deleted TABLE TagAsset ( :12:10) (20089 record (s)) (0 deleted TABLE TagRule ( :12:10) ( record (s)) (0 deleted TABLE Theme ( :12:10) (12 record (s)) (0 deleted TABLE Timezone ( :12:10) (74 record (s)) (0 deleted TABLE VAREXCEP ( :12:11) (9 record (s)) (0 deleted TABLE VIEWFLDR ( :12:11) (106 record (s)) (0 deleted TABLE VULNRBLT ( :12:11) (6293 record (s)) (0 deleted TABLE VWCMPNNT ( :12:11) (5362 record (s)) (0 deleted TABLE Triggere ( :12:10) (0 record (s)) (4 deleted TABLE UCFA2C ( :12:10) (3041 record (s)) (0 deleted TABLE Var TABLE View ( :12:11) (129 record (s)) (0 deleted ( :12:11) (893 record (s)) (0 deleted TABLE UCFC2U ( :12:10) (5432 record (s)) (0 deleted TABLE UCFN2U ( :12:10) (58 record (s)) (0 deleted TABLE UCFName ( :12:10) (3388 record (s)) (0 deleted TABLE UPDATBLB ( :12:11) (14 record (s)) (0 deleted TABLE WMIType ( :12:11) (336 record (s)) (0 deleted TABLE WTCHLSLS ( :12:47) ( record (s)) ( deleted TABLE WTCHLSTS ( :12:47) (20 record (s)) (0 deleted TABLE ZONEIPMA ( :12:47) (258 record (s)) (0 deleted TABLE USERFILD ( :12:11) (225 record (s)) (0 deleted TABLE USERFLDS ( :12:11) (228 record (s)) (0 deleted TABLE Zone ( :12:47) (257 record (s)) (0 deleted The backup occurs live so the ESM is not restarted as the backup proceeds. The files are stored into the folder /data_hd /usr/local/ess/dbbackupwork/ where they are tarred up and compressed in a.zip file. The final file is stored in /data_hd/usr/local/ess/dbbackup/ for presentation in the File Maintenance UI

5 in the SIEM GUI. The best way to follow the backup process is by watching the message box in the ESM GUI. It will look something like this: A remote backup type can back up to a CIFS/NFS location. The storage location is mounted before the backup starts and is checked each time to ensure the backup begins. It is expected that the backup location will contain more than one backup file unless the backup location is maintained by the user. The backup files are copied compressed to the storage location for storage and subsequent restoration. For remote folders the path name will look like this: xx.xx.xx.xx:/backupfolder/etm-xx_9.3.1_2013_12_25_021738_i.zip The restore process is used to restore the ESM configuration and data back to the ESM. It works in an opposite manner from the back up process. The file selected from the File Maintenance UI in the SIEM GUI is copied to the /data_hd/usr/local/ess/dbrestore folder. The ESM must be shut down to restore the DB tables correctly. After that process is stopped the.zip file is untarred up and placed in the /data_hd /usr/local/ess/dbbackupwork/ folder to be copied to the correct folders on the ESM. After that the ESM is restarted to recognize the new configuration placed on it. The best way to follow the process is by logging onto the console of the ESM and look at the /var/log/messages file. It will look something like this: Dec 20 02:22:25 McAfee [55337]: RestoreDB - started Dec 20 02:22:25 McAfee [55337]: Opened database - /db2/usr/local/ess/data/ngcp.dfl - system number - 1 Dec 20 02:22:26 McAfee [55337]: RestoreDB - extracting file: - /db1/usr/local/ess/dbrestore/etm- X4_9.3.1_2013_12_19_220919_I.zip

6 Dec 20 02:22:26 McAfee [55337]: Opened database - /db1/usr/local/ess/dbrestore/ngcpold.dfl - system number - 2 Dec 20 02:23:42 McAfee [55337]: RestoreDB - restoring file: - /db1/usr/local/ess/dbrestore/etmxx_9.3.1_2013_12_20_220919_i.zip Dec 20 02:23:42 McAfee [55337]: RestoreDB - restoring on primary.. Dec 20 02:25:48 McAfee [55337]: RestoreDB - restore system tables complete Dec 20 02:25:57 McAfee [55337]: RestoreDB - finished ESM( Redundant) A redundant ESM is limited on the functionality it can perform compared to a primary (standalone) ESM but it will get all settings that a standalone ESM is given to ensure it comes up fully configured when placed in primary mode. An error is given to indicate the backup capability is turned off. The redundant will still have access restore backups that are available on the remote backup folders. ELM The backup process on the ELM is intended to create a backup of the Management DB tables on the ELM for restoring the configuration of the ELM and the log file indexes currently on the ELM. The folders created by the backup and the backup files put there are described below.

7 Remote backup mount point: xx.xx.xx.xx:/backupfolder/ The files/folders created are: NitroGuard/ alloc.conf backupelm.conf customfields.conf das.conf elmer_file_timeout.conf ffg_fws.conf ffg_web.conf fips.conf freetds-gsql.conf globals.conf mgtdbloc.conf network.conf nitrosnmp.conf storage.conf thirdparty.conf vathirdparty.conf buildstamp mgtdb/ NitroError.Log ds2rg.data elm.cfd

8 elm.cfg elm.cpy elm.dfl elm.old elmmsg.txt rg/ rg.data rg2sh.data sh.data sr.data A log file indexes backup is a backup of all database table files (also called the Management DB) uncompressed to a remote storage location. This backup type can back up to a CIFS/NFS location. The storage location is mounted before the backup starts and is checked each time to ensure the backup begins. It is expected that the backup location will contain more than one backup file unless the backup location is maintained by the user. The data index files are copied uncompressed to the storage location for storage and subsequent restoration. For a list of the tables backed up from the ELM is listed above. A configuration backup is a backup of ELM configuration files uncompressed to a remote storage location. These files contain paths and configuration data for the processes that run on the ELM. Some of the configuration is use in the ELM GUI but most is configuration used by the runtime components of the ELM. For a list of the configuration files backed up from the ELM see above. When a backup is started the ELM Properties dialog will show the backup in progress. (see below)

9 A backup will usually complete in 5 10 minutes unless there are connection issues or speed issues copying files to the remote share. You can also follow the process is by logging onto the console of the ELM and look at the /var/log/messages file. It will look something like this: Dec 25 06:33:56 McAfee backupelm[21996]: Starting elm backup.. Dec 25 06:36:15 McAfee backupelm[22016]: Elm backup completed The restore process is used to restore the ELM configuration and log file indexes back to the ELM. It works in an opposite manner from the back up process. The Restore Backup button in the ELM Bakup and restore GUI is pressed and the ELM backup is copied to the /data_hd/usr/local/elm/ folder.

10 The ELM must be shut down to restore the DB tables correctly. After that process is stopped the ELM configuration files are copied to the correct folders on the ELM. After copying is finished the ELM is restarted to recognize the new configuration placed on it. The best way to follow the process is by logging onto the console of the ELM and look at the /var/log/messages file. It will look something like this: Dec 25 06:55:40 McAfee elmd[22713]: Stopping (Parent pid) = Dec 25 06:55:40 McAfee elmd[22713]: Flushing Database /usr/local/elm/mgtdb/elm.dfl Dec 25 06:55:40 McAfee elmd[22713]: Flushing Database /usr/local/elm/mgtdb/rg/rg_1/elmlf_1.dfl Dec 25 06:55:40 McAfee elmd[22713]: Flushing Database /usr/local/elm/mgtdb/rg/rg_2/elmlf_2.dfl Dec 25 06:55:41 McAfee elmd[22713]: Flushing Database /usr/local/elm/mgtdb/rg/rg_3/elmlf_3.dfl Dec 25 06:55:41 McAfee elmd[22713]: Flushing Database completed! Dec 25 06:56:37 McAfee SetStorageConf[3478]: Starting to mount Dec 25 06:56:37 McAfee SetStorageConf[3478]: mount returned [1] for Dec 25 06:56:37 McAfee SetStorageConf[3478]: Verifying NFS224 Dec 25 06:56:37 McAfee SetStorageConf[3478]: Verifying local The ELM restore will finish and you will see an OK in the ELM properties dialog.

11 Receiver (Standalone) There are no specific backup capabilities on the Receiver. The Receiver has a 25 partition design that stores the event/flow data long enough for the ESM to retrieve it off of the device. As long as the ESM is current pulling data over to the ESM the Receiver data is available and can be backed up on the ESM. Receiver (HA) HA Receivers employ a backup mechanism called a redundant device. (like the redundant ESM is to the primary ESM) The data shared between HA receivers keeps a back up active to allow for fail over of the Receiver device. As above, there are no specific backup capabilities on the Receiver. The Receiver has a 25 partition design that stores the event/flow data long enough for the ESM to retrieve it off of the device. As long as the ESM is current pulling data over to the ESM the Receiver data is available and can be backed up on the ESM. ACE There are no specific backup capabilities on the ACE. The ACE has a 25 partition design that stores the event/flow data long enough for the ESM to retrieve it off of the device. As long as the ESM is current pulling data over to the ESM the Receiver data is available and can be backed up on the ESM.