Skip to content
  • There are no suggestions because the search field is empty.

What are the right commands to backup and restore ESA alert data in RSA NetWitness

Issue

In regards to ESA backup & restore, what are the right commands for both using mongorestore?
There is a online manual for this as follows but it doesn't tell us the right command.
------------------------------------------------------------------------------------
https://sadocs.emc.com/0_en-us/090_10.4_User_Guide/215_SysAdmin/BackupRest/ESABupRecov
In Security Analytics 10.4, ESA alert data is stored in the co-located Mongo instance (database name: esa). For details on backup and restore, refer to mongodump and mongorestore.
-------------------------------------------------------------------------------------


Resolution

Please follow the steps below to backup and restore ESA DB.

To backup the database:

1. Stop the ESA service.
service rsa-esa stop

2. Backup the database
Option1: Backup alert db only
mongodump -vvvv -d esa -c alert -u esa -p esa -o /root/alert-db 
Option:2: Backup the entire database
mongodump -vvvv -d esa -u admin -p --authenticationDatabase admin -o /root/alert-db

3. Start the ESA service.
service rsa-esa start


To restore the database:

1. Stop the ESA service.
service rsa-esa stop

2. Restore the database
mongorestore -vvvv -d esa -u esa -p esa --noLoader /root/alert-db/esa 

3. Start the ESA service.
service rsa-esa start

Product Details

RSA Product Set: Security Analytics
RSA Product/Service Type: ESA
RSA Version/Condition: 10.4.x, 10.5.x, 10.6.x
Platform: CentOS
Platform (Other): MongoDB
O/S Version: EL6

Approval Reviewer Queue

ASOC Approval Group