This article explains the procedure and steps in taking the App data backup and steps for restoring the App data backup.
Note: A configuration backup that you do on the backup and Recovery window does not back up your apps' data. The /opt/qradar/bin/app-volume-backup.py script runs nightly at 2:30 AM, and backs up each installed application's /store mounted volume. By default, data is retained for 7 days.
Please find the below steps:
Step 1: Use SSH to log in to your Console or your App Host as the root user.
Step 2: Go to the /opt/qradar/bin/ directory
Step 3: Use the following command to backup the data. ./app-volume-backup.py backup The app-volume-backup.py script runs nightly at 2:30 AM local time to back up all installed apps. Backup archives are stored in the /store/apps/backup folder. You can change the backup archives location by editing the APP_VOLUME_BACKUP_DIR variable in /store/configservices/staging/globalconfig/nva.conf. You must deploy changes after you edit this variable.
Step 4: To view all data backups for installed apps, enter the following command: ./app-volume-backup.py ls This command outputs all backup archives that are stored in the backup archives folder.
Step 5: To restore a backup archive, enter the following command: ./app-volume-backup.py restore -i <backup_name>
Step 6: Use the following command to restart each app container: docker restart <container_id> If you don't know the container ID, use the following commands to find it: psql -U qradar -c 'select id, name from installed_application' The command returns the app ID. Insert the app ID into the following command to find the container ID: docker ps -a --format "{{.ID}},{{.Image}}" | grep 'qapp/<app_id>:' | cut -d , -f1
2024-10-01 : Article Created
2024-10-21: Minor formatting changes and made public