Backing Up and Restoring for Google Cloud Deployments

To backup or restore configuration data for capabilities deployed on-premises, use the following procedures:

 

Backing Up Configuration Data

You can back up the configuration data for the deployed capabilities and ArcSight Platform components.

  1. Log in to the Google Cloud Filestore console.

  2. Select the Filestore instance that contains the ArcSight Suite Data.

  3. Select the Backups tab and create a backup.

  4. Fill in the information required and click on Create.

Currently the option to schedule backups is only available for Basic HDD and Basic SSD tier Filestore instances using Cloud Scheduler and Cloud Functions as specified by the Scheduling backups guide.

Restoring Configuration Data

This procedure will restore all the ArcSight site data using a temporary filestore.

  1. Log in to the Google Cloud Filestore Backup console.

  2. Select the back up that you want to restore.

  3. Click on Restore. Of the 3 options presented, select New Instance, fill in the required information and click on Restore.

  4. Once the restore procedure has finished, establish an SSH connection to the bastion and execute the following commands:

    Install rsync
    # dnf install -y rsync
  5. The temporary Filestore must be mounted. To verify that this is possible, mount it to a temporary folder following these instructions:

    # sudo mkdir -p /tmp/restore
    # sudo mount -o rw,intr <temporary_filestore_ip-address>:/<file-share> /tmp/restore

    Where the <temporary_filestore_ip-address> value comes from the temporary Filestore created in Step 3.

  6. Validate that the Filestore has been mounted with:

    # df -h --type=nfs
  7. The output on the bastion would show the existing Filestore and the temporary Filestore, for example:

    # 1.1.1.1:/arcsight_suite 1007G  3.1G  953G   1% /mnt/filestore/arcsight_suite
    # 2.2.2.2:/restore      1007G  3.0G  953G   1% /tmp/restore

When restoring data stores, retain the original directory structure and the pod-level sub-directory structure:

/<NFS_server mount path>/arcsight-volume  
Ensure to replace the <NFS_server mount path> variable, with a specific value, before you run the command.
  1. Ensure that you have a valid data store backup.

  2. Navigate to the following location where the restore script resides:

    cd <INSTALLER_LOCATION>/gcp-scripts
    Ensure to replace the <INSTALLER_LOCATION> variable, with a specific value, before you run the command.
  3. To view the restore script options, execute the following command:

    ./nfs-arcsight-volume-restore.sh -h

    Use the following parameters:

    -o | --older-backup
    Available pod backups. This parameter is optional.
    -r | --restore-dir
    Available nfs backups. This parameter is optional.
    -s | --source
    Source mount path of the NFS backup location. This can be either an external or local NFS server mount path. This parameter is mandatory.
    -d | --destination
    Destination path without the 'arcsight-volume' where the NFS backup is to be restored. . This parameter is mandatory.

    -h | --help

    Displays the command options.
  4. (Conditional) If you restore from your own managed backup system, execute the restore script as follows:

    1. Parameter -s to specify a source mount path one level above arcsight-volume

    2. Parameter -r to list available sub directories therein that includes arcsight-volume

    3. Select the index value for arcsight-volume to proceed with restore.

  5. (Conditional) To restore to the latest  backup, execute the following command:

    ./nfs-arcsight-volume-restore.sh  <NFS_server:mount_path>

    For example:

    ./nfs-arcsight-volume-restore.sh -s 2.2.2.2:/restore/arcsight/ -d 1.1.1.1:/arcsight_suite/arcsight/
    For -o or -r as parameters, backup index values are made available to choose from upon command execution. Also, ensure to replace the <NFS_server:mount_path> variable, with a specific value, before you run the command.
  6. To complete the restore process, follow the onscreen instructions.

  7. (Conditional) If Transformation Hub is deployed, complete the following steps:

    1. Mount and navigate to the NFS backup location.

    2. Navigate to the Transformation Hub directory.

      For example:

      /<nfs mount location>/<time stamped backup directory>/transformationhub/config/
    3. Ensure that the arcsight-volume is mounted, then navigate to /transformationhub/config/.

    4. (Conditional) If the file arcsight-env-override.properties exists in the backup location (Step 8b), copy it to the arcsight-volume directory (Step 8c), and then remove any file properties that do not apply to the restored environment.

  8. To get the names of pods to restart, execute the following command:

    for pod in $(kubectl get pods --no-headers -n $( kubectl get namespaces | awk '/arcsight/ {print $1}')|awk '// {print $1}'); do echo -n "${pod} "; done
    Compare the output with the impacted pods listed in this table to know pods names.
  1. To restart pods listed in this table, execute the following command:

    kubectl delete pods -n $( kubectl get namespaces | grep arcsight | cut -d ' ' -f1) <space separated impacted pod names>
    
    Ensure to replace the <space separated pod names> variable, with specific values, before you run the command.

    For example:

    kubectl delete pods -n $( kubectl get namespaces | grep arcsight | cut -d ' ' -f1) fusion-user-management-56497c76bb-mdmmz fusion-dashboard-web-app-7b864467d5-d2c8v fusion-metadata-rethinkdb-5c69c77756-hxxzg
  2. Ensure that all Pods display a running status:
    kubectl get pods --all-namespaces
  3. To verify restored data stores, log in to the associated application.

  4. Delete the temporary Filestore.