# Backup and Restore

## Backup

Create backups of Logpoint configurations and/or log files. Backups are generated in the background, and are saved in the Backup Archive. While creating a backup of files, Logpoint stores the buffer of the logs in a separate file. Files cannot be restored if you rename the file containing the buffer. Configuration backups do not store the Logpoint License. You must separately add a new license before restoring a configuration backup to a new Logpoint.

{% hint style="success" %}
The CSV files uploaded and used when creating a CSV Enrichment Source are not backed up. After restoring the configuration, you must re-upload the CSV files.
{% endhint %}

<details>

<summary>Creating Backups</summary>

There are two ways to create backups:

1. Save configuration files and generated reports to Logpoint. You can setup a scheduled backup in addition to an immediate backup of configuration files and reports.
2. Use Simple File Transfer Protocol (SFTP) client and an external device to create an external backup of your logs.
   1. Use the put command to transfer the backup files to Logpoint.
   2. Log file backups are stored in `/opt/immune/backup/repos/<folder_name>`.
   3. Configurations are backed up in `/opt/immune/backup/configurations/zipped`

The log backup files are named after the backup date. If any logs are delayed, they are backed up with an incremental value. For example, the backup for February 5, 2025, is saved as logs\_2025-02-05.backup, while delayed logs for the same date are stored as logs\_2025-02-05\_1.backup. A snapshot is also created with the `.snap` extention.

</details>

<details>

<summary>Saving Configuration Files to Logpoint</summary>

1. Go to **Settings >> System Settings** from the navigation bar and click **Backup and Restore**.
2. Click **Backup Settings**.
3. In **CONFIGURATION BACKUP**, click **Schedule Backup** to schedule the backup time and retention period.
4. Select **Backup Reports too** to backup generated reports.
5. In **Interval**, select how often to backup the report.
   1. If you select weekly, select the day of the week to backup.
6. In **Backup Run Hour**, enter the time to run the backup. Use Coordinated Universal Time (UTC).
7. In **Backup Retention period** enter the number of days Logpoint stores the backup files.
8. Click **Backup now** to create a backup of all current configurations.

</details>

<details>

<summary>Saving Configuration Files to External Device</summary>

**Prepare the external device**

1. Generate a public SSH key on the device to transfer the backup files using `ssh-keygen` command.
2. In Logpoint, go to **Settings >> System Settings** from the navigation bar and click **Backup and Restore**.
3. Click **Backup Settings**.
4. In **TRANSPORT TO EXTERNAL**, enter the public key of the device.

![Backup configurations or log files to an external device using SFTP](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-da865b1dd4c7e6212ef95cf2ab918e21cd024115%2FLP_Settings_Backup_Add%20\(1\).png?alt=media)

**Configure log backups and transfer**

In **LOGS BACKUP**:

5. Click **Schedule Log Backup** to schedule the time and retention period for the logs backup.
6. In **Backup Run Hour**, enter the time to run the backup in UTC.
7. Enter the **Backup Retention** period. It is the amount of time (in days) for which Logpoint stores the backups of the logs collected in the repos. It is independent of the retention period for repos.
8. Select **Full Backup** to back up logs from all repos for the past 7 days. To ensure optimal performance, we recommend performing a full backup only when Logpoint is receiving a lower volume of logs.
9. In Backup logs from, select All Days to backup all the logs stored in the repo from past 7 days or select a date to backup logs from that date.
10. In Repos to backup, select the repos to backup and click the forward icon.
11. Click **Backup now** to create a backup of the current logs and indexes from past 7 days.
12. In the external device, make an SFTP connection to the Logpoint instance or server as a `loginspect` user:

```
sftp loginspect@<IP address of Logpoint server>
```

![SFTP Connection to Logpoint](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-7566bd936b05417127627a178ce25f279bf3e9ba%2FsftpConnectiontoLogpoint.png?alt=media)

13. Verify the current folder in the local machine using the `lpwd` command. You can switch folders using `lcd`.
14. Use the `get` SFTP command to download the backup files to the current folder:

```
cd configuration/zipped
get <backup file name>
```

15. When the backup is done, the command prompt displays:

![Files are backed up to external device using SFTP](https://2590616924-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZJI3Yx2mS6Pn4JEd0IKM%2Fuploads%2Fgit-blob-0b4ed205a37bce8a828e31cb9d3b3645d32a114b%2FBackup_SMTP_Done.png?alt=media)

</details>

## Restore

You can restore backup files from Logpoint or an external device by using a public SSH key to access another Logpoint instance or server, and SFTP to transfer the backup files from:

* `/opt/immune/backup/repos/<folder_name>` for log file backups
* `/opt/immune/backup/configurations/zipped` for configuration file backups

The name of the repository must match the name of the directory where you are restoring or importing the backup. The Logpoint version to create a backup must be the same version when you restore a backup.

If you are using a Standalone or Distributed Logpoint you can't restore their backup files to a Fabric-enabled Logpoint. You also can't restore Fabric-enabled backup files to a Standalone or Distributed Logpoint.

{% hint style="danger" %}
When you restore log file backups they replace existing logs. You must restore backed up configuration files before restoring their log backups.
{% endhint %}

You can restore single backup files, or restore multiple backup files at the same time.

<details>

<summary>Restoring Backup Files</summary>

1. Go to **Settings >> System Settings** from the navigation bar and click **Backup and Restore**.
2. Click **Backup Archive**.
3. The list of backup files can be long. The default view lists all backups. To filter the list, use **FILTER** at the top left to select:
   1. Log backups only
   2. Configuration backups only
   3. Checksum backups only
4. To backup:
   1. a single backup file, find it in the list and select it. In the **Actions** column, click the **arrow** icon.
   2. multiple backups, select them in the list. At the top right, click the **MORE** dropdown and click **Restore Selected**.
5. Click **Yes** to confirm file restoration.

</details>

<details>

<summary>Deleting Backup Files</summary>

1. Go to **Settings >> System Settings** from the navigation bar and click **Backup and Restore**.
2. Click **Backup Archive**.
3. The list of backup files can be long. The default view lists all backups. To filter the list, use **FILTER** at the top left to select:
   1. Log backups only to backup the log files.
   2. Configuration backups only to back up what you configured in Logpoint.
   3. Checksum backups only to ensure data integrity and verify that logs and configurations are not altered and that there are no errors.
4. To delete:
   1. a single backup file, find it in the list and select it. In the Actions column, click the delete icon.
   2. multiple backups, select them in the list. At the top right, click the MORE dropdown and click Delete Selected.
   3. all backups, select them all in the list from the top left. At the top right, click the MORE dropdown and click Delete All.
5. Click **Yes** to confirm file deletion.

</details>
