Skip to content

Instantly share code, notes, and snippets.

@mitchese
Last active June 7, 2017 05:14
Show Gist options
  • Save mitchese/c8e3f0e71c78a39dcbbe to your computer and use it in GitHub Desktop.
Save mitchese/c8e3f0e71c78a39dcbbe to your computer and use it in GitHub Desktop.
#!/bin/bash
# This is a script which will perform a full backup of an arcsight Express appliance
#
# The goal of this script is to provide a backup which can be restored to a completely new system
#
# Made according to directions at https://protect724.hp.com/docs/DOC-13608
# Above link moved to https://community.saas.hpe.com/t5/ESM-and-ESM-Express/ArcSight-Express-4-0-Backup-and-Recovery/ta-p/1588736
#
#
# Copyright 2016 Sean Mitchell
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# BASE_PATH = where is arcsight installed. this folder has "manager", "logger" etc inside it:
BASE_PATH="/opt/arcsight"
# What is the CORR-E Password for the arcsight user:
MYSQL_PASS="somethingSecretIHope!"
# Set this to a number between 0-6, 0 will only produce critical warnings on stderr
# and 6 will be very chatty about what's happening. This does not include any of the
# arcisght script input/output - this will still appear on standardout,stderr as usual
#
# Any value 0-3 will produce a .tar file in /tmp;
# A value of 4+ will produce the .tar file plus leave an unzipped directory of the same name in /tmp
DEBUG=0
########################################################################################
# End of configuration
# Generate a temp directory, if necessary change this to another mountpoint
TMP=`mktemp -d`
function debug_log {
# $1 = level (0-6; 0=critical; 6=debug)
# $2 = function
# $3 = message
if [ $1 -le $DEBUG ]
then
>&2 echo "$2 : $3"
fi
}
function start_stop {
# Function start_stop - used to "start/stop all but database"
# This was reversed from our arcsight, which has the following products listed below. Of course any added connectors will need to be added to this list
for service in conapp conapp_httpd connector_1 connector_2 arcsight_web manager logger
do
/sbin/service arcsight_services $1 $service
done
}
function backup_specialfiles {
# Backup special file sections as described in s.3
debug_log 6 "specialfiles" "Invoked"
FILELIST="/home/arcsight/.bash_profile $BASE_PATH/logger/data/mysql/my.cnf /etc/hosts $BASE_PATH/manager/config/server.properties $BASE_PATH/manager/config/database.properties $BASE_PATH/logger/current/arcsight/logger/user/logger/logger.properties $BASE_PATH/manager/config/server.wrapper.conf $BASE_PATH/manager/config/jetty $BASE_PATH/manager/jre/lib/security/cacerts $BASE_PATH/manager/user/manager/license/arcsight.lic"
debug_log 6 "specialfiles" "Starting backup"
tar -jcf $TMP/specialfiles.tar.bz2 $FILELIST
debug_log 5 "specialfiles" "Saved as $TMP/specialfiles.tar.bz2"
debug_log 6 "specialfiles" "Done"
}
function backup_systemtables {
#Backup system tables as described in s.4
debug_log 6 "systemtables" "Invoked"
$BASE_PATH/manager/bin/arcsight export_system_tables arcsight $MYSQL_PASS arcsight -s
gzip $BASE_PATH/manager/tmp/arcsight_dump_system_tables.sql
mv $BASE_PATH/manager/tmp/arcsight_dump_system_tables.sql.gz $TMP/
debug_log 6 "systemtables" "Done"
}
function backup_specialtables {
# Backup special tables as described in s.5
debug_log 6 "specialtables" "Invoked"
for TABLE in user_sequences arc_event_annotation arc_event_annotation_p arc_event_payload arc_event_payload_p
do
debug_log 6 "specialtables" "Doing $TABLE"
$BASE_PATH/logger/current/arcsight/bin/mysqldump -uarcsight -p${MYSQL_PASS} arcsight ${TABLE} | gzip > $TMP/${TABLE}.sql.gz
done
debug_log 6 "specialtables" "Done"
}
function backup_trends {
# Backup trends as described in s.6
debug_log 6 "trends" "Invoked"
SQL="SET group_concat_max_len = 10240; SELECT GROUP_CONCAT(table_name separator ' ') FROM information_schema.tables WHERE table_schema='arcsight' AND (table_name like 'arc_trend%');"
debug_log 5 "trends" "Generating table list"
TBLIST=`$BASE_PATH/logger/current/arcsight/bin/mysql -u arcsight -p${MYSQL_PASS} -AN -e "${SQL}"`
debug_log 5 "trends" "Dumping data"
$BASE_PATH/logger/current/arcsight/bin/mysqldump -u arcsight -p${MYSQL_PASS} arcsight ${TBLIST} > $TMP/arcsight_trends.sql
debug_log 5 "trends" "Zipping data"
gzip $TMP/arcsight_trends.sql
debug_log 6 "trends" "Done"
}
function backup_systemparameters {
debug_log 6 "sysparams" "Invoked"
TEXTFILE="$TMP/sysparams.txt"
# Clear out contents...just in case
echo "" > $TEXTFILE
echo "Operating system and version ################################################################" >>$TEXTFILE
uname -a >> $TEXTFILE
cat /etc/redhat-release >> $TEXTFILE
echo "Computer domain name and hostname ###########################################################" >>$TEXTFILE
echo $HOSTNAME >> $TEXTFILE
echo "File system type and Path to the archive locations for each storage group ###################" >>$TEXTFILE
cat /proc/mounts >> $TEXTFILE
echo "ESM version #################################################################################" >>$TEXTFILE
$BASE_PATH/manager/bin/arcsight version >> $TEXTFILE
echo "MySQL password ##############################################################################" >>$TEXTFILE
echo "$MYSQL_PASS" >> $TEXTFILE
echo "Timezone of the machine #####################################################################" >>$TEXTFILE
date +'%:z %Z' >> $TEXTFILE
debug_log 6 "sysparams" "Done"
}
function backup_eventarchives {
debug_log 6 "eventarchives" "Invoked"
# Backup this folder:
# $BASE_PATH/logger/data/archives
mkdir $TMP/archives
cp -R $BASE_PATH/logger/data/archives/* $TMP/archives/
# If you cannot afford to lose events that occurred since midnight, when the last archive was
# created, back up $BASE_PATH/logger/data/logger. However, in addition to the un-archived
# data since midnight, you also get events from each day from yesterday to the beginning of your
# retention period, which are also in the archives.
#$BASE_PATH/logger/current/arcsight/bin/pg_dump -d rwdb -c -n data -U web |gzip -9 -v > /tmp/postgres_data.sql.gz
debug_log 6 "eventarchives" "Done"
}
function create_single_file {
# Take everything in $TMP and make a single file.
debug_log 6 "singlefile" "Invoked"
debug_log 5 "singlefile" "Creating ${TMP}.tar from $TMP"
# No need to zip it again, since everything that can be zipped is already zipped
tar -cf ${TMP}.tar $TMP
if [ $DEBUG -le 3 ]
then
rm -rf $TMP
fi
debug_log 6 "singlefile" "Done"
}
start_stop stop
backup_specialfiles
backup_specialtables
backup_systemtables
backup_trends
backup_systemparameters
backup_eventarchives
create_single_file
start_stop start
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment