EDR: How To Backup Unified View

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

How to generate a backup of Unified View configuration and data

Environment

EDR Unified View:  6.1.3 and higher

Resolution

1. Stop Unified View

service cb-unifiedview stop

2. Create a backup directory (using /data/backup here, but can be any directory) and change to that directory

mkdir /data/backup
cd /data/backup

3. Backup the configuration files by running these commands

tar -P --selinux -cvf cbhosts.tar /etc/hosts
tar -P --selinux -cvf cbyum.tar /etc/yum.repos.d
tar -P --selinux -cvf cbiptables.tar /etc/sysconfig/iptables (CentOS 6/RH 6 only)
tar -P --selinux -cvf cbfirewalld.tar /etc/firewalld (CentOS 7/RH 7 only)
tar -P --selinux -cvf cbconfig.tar /etc/cb/
tar -P --selinux -cvf cbrsyslog.tar /etc/rsyslog.conf
tar -P --selinux -cvf cbrsyslogd.tar /etc/rsyslog.d/
tar -P --selinux -cvf cblogrotate.tar /etc/logrotate.d/cb-logrotate.conf

4. Perform a backup of the Postgres Database

pg_dump -C -Fp -f psqldump_config.sql cb -p 5002
pg_dumpall -p 5002 --roles-only -f psqlroles.sql

5. Copy the backup location off to a remote location
6. Start Unified View

service cb-unifiedview start