esmexpress_backup.sh

#!/bin/bash

# This is a script which will perform a full backup of an arcsight Express appliance
#
# The goal of this script is to provide a backup which can be restored to a completely new system
#
# Made according to directions at https://protect724.hp.com/docs/DOC-13608
# Above link moved to https://community.saas.hpe.com/t5/ESM-and-ESM-Express/ArcSight-Express-4-0-Backup-and-Recovery/ta-p/1588736
#
#
# Copyright 2016 Sean Mitchell
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# BASE_PATH = where is arcsight installed. this folder has "manager", "logger" etc inside it:
BASE_PATH="/opt/arcsight"

# What is the CORR-E Password for the arcsight user:
MYSQL_PASS="somethingSecretIHope!"


# Set this to a number between 0-6, 0 will only produce critical warnings on stderr
# and 6 will be very chatty about what's happening. This does not include any of the
# arcisght script input/output - this will still appear on standardout,stderr as usual
#
# Any value 0-3 will produce a .tar file in /tmp;
# A value of 4+ will produce the .tar file plus leave an unzipped directory of the same name in /tmp

DEBUG=0

########################################################################################
# End of configuration

# Generate a temp directory, if necessary change this to another mountpoint
TMP=`mktemp -d`

function debug_log {
  # $1 = level (0-6; 0=critical; 6=debug)
  # $2 = function
  # $3 = message
  if [ $1 -le $DEBUG ]
  then
    >&2 echo "$2 : $3"
  fi
}

function start_stop {
  # Function start_stop - used to "start/stop all but database"
  # This was reversed from our arcsight, which has the following products listed below. Of course any added connectors will need to be added to this list
  for service in conapp conapp_httpd connector_1 connector_2 arcsight_web manager logger
  do
    /sbin/service arcsight_services $1 $service
  done
}


function backup_specialfiles {
  # Backup special file sections as described in s.3
  debug_log 6 "specialfiles" "Invoked"
  FILELIST="/home/arcsight/.bash_profile $BASE_PATH/logger/data/mysql/my.cnf /etc/hosts $BASE_PATH/manager/config/server.properties $BASE_PATH/manager/config/database.properties $BASE_PATH/logger/current/arcsight/logger/user/logger/logger.properties $BASE_PATH/manager/config/server.wrapper.conf $BASE_PATH/manager/config/jetty $BASE_PATH/manager/jre/lib/security/cacerts $BASE_PATH/manager/user/manager/license/arcsight.lic"
  debug_log 6 "specialfiles" "Starting backup"
  tar -jcf $TMP/specialfiles.tar.bz2 $FILELIST
  debug_log 5 "specialfiles" "Saved as $TMP/specialfiles.tar.bz2"
  debug_log 6 "specialfiles" "Done"
}

function backup_systemtables {
  #Backup system tables as described in s.4
  debug_log 6 "systemtables" "Invoked"
  $BASE_PATH/manager/bin/arcsight export_system_tables arcsight $MYSQL_PASS arcsight -s
  gzip $BASE_PATH/manager/tmp/arcsight_dump_system_tables.sql
  mv $BASE_PATH/manager/tmp/arcsight_dump_system_tables.sql.gz $TMP/
  debug_log 6 "systemtables" "Done"
}

function backup_specialtables {
  # Backup special tables as described in s.5
  debug_log 6 "specialtables" "Invoked"
  for TABLE in user_sequences arc_event_annotation arc_event_annotation_p arc_event_payload arc_event_payload_p
  do
    debug_log 6 "specialtables" "Doing $TABLE"
    $BASE_PATH/logger/current/arcsight/bin/mysqldump -uarcsight -p${MYSQL_PASS} arcsight ${TABLE} | gzip > $TMP/${TABLE}.sql.gz
  done
  debug_log 6 "specialtables" "Done"
}

function backup_trends {
  # Backup trends as described in s.6
  debug_log 6 "trends" "Invoked"
  SQL="SET group_concat_max_len = 10240; SELECT GROUP_CONCAT(table_name separator ' ') FROM information_schema.tables WHERE table_schema='arcsight' AND (table_name like 'arc_trend%');"
  debug_log 5 "trends" "Generating table list"
  TBLIST=`$BASE_PATH/logger/current/arcsight/bin/mysql -u arcsight -p${MYSQL_PASS} -AN -e "${SQL}"`
  debug_log 5 "trends" "Dumping data"
  $BASE_PATH/logger/current/arcsight/bin/mysqldump -u arcsight -p${MYSQL_PASS} arcsight ${TBLIST} > $TMP/arcsight_trends.sql
  debug_log 5 "trends" "Zipping data"
  gzip $TMP/arcsight_trends.sql
  debug_log 6 "trends" "Done"
}
function backup_systemparameters {
  debug_log 6 "sysparams" "Invoked"
  TEXTFILE="$TMP/sysparams.txt"
  # Clear out contents...just in case
  echo "" > $TEXTFILE
  echo "Operating system and version ################################################################" >>$TEXTFILE
  uname -a >> $TEXTFILE
  cat /etc/redhat-release >> $TEXTFILE
  echo "Computer domain name and hostname ###########################################################" >>$TEXTFILE
  echo $HOSTNAME >> $TEXTFILE
  echo "File system type and Path to the archive locations for each storage group ###################" >>$TEXTFILE
  cat /proc/mounts >> $TEXTFILE
  echo "ESM version #################################################################################" >>$TEXTFILE
  $BASE_PATH/manager/bin/arcsight version >> $TEXTFILE
  echo "MySQL password ##############################################################################" >>$TEXTFILE
  echo "$MYSQL_PASS" >> $TEXTFILE
  echo "Timezone of the machine #####################################################################" >>$TEXTFILE
  date +'%:z %Z' >> $TEXTFILE
  debug_log 6 "sysparams" "Done"
}

function backup_eventarchives {
  debug_log 6 "eventarchives" "Invoked"
  # Backup this folder:
  #   $BASE_PATH/logger/data/archives
  mkdir $TMP/archives
  cp -R $BASE_PATH/logger/data/archives/* $TMP/archives/

  # If you cannot afford to lose events that occurred since midnight, when the last archive was
  # created, back up $BASE_PATH/logger/data/logger. However, in addition to the un-archived
  # data since midnight, you also get events from each day from yesterday to the beginning of your
  # retention period, which are also in the archives.
  #$BASE_PATH/logger/current/arcsight/bin/pg_dump -d rwdb -c -n data -U web |gzip -9 -v > /tmp/postgres_data.sql.gz
  debug_log 6 "eventarchives" "Done"
}

function create_single_file {
  # Take everything in $TMP and make a single file.
  debug_log 6 "singlefile" "Invoked"
  debug_log 5 "singlefile" "Creating ${TMP}.tar from $TMP"
  # No need to zip it again, since everything that can be zipped is already zipped
  tar -cf ${TMP}.tar $TMP
  if [ $DEBUG -le 3 ]
  then
    rm -rf $TMP
  fi

  debug_log 6 "singlefile" "Done"
}

start_stop stop

backup_specialfiles
backup_specialtables
backup_systemtables
backup_trends
backup_systemparameters
backup_eventarchives
create_single_file

start_stop start