Splunk Phantom backup tools
Use the ibackup.pyc tool to create, manage, and restore backups.
Logs for each run of the tool are written to
Completed backups are stored in
If you are using an unprivileged installation, the logs are written to
You can find a repository of staging files for the PostgreSQL database backup in
The following table shows the ibackup.pyc arguments:
|-h, --help||Shows the ibackup.pyc tool help message and exits.|
|--setup||Prepares the instance or cluster for backup and restore.|
|--max-cores <value>||Specifies the maximum number of processing cores allowed for database backup and restore operations. The default value is two cores.|
|--backup||Performs a backup.|
||Performs a restore. You must provide a path to the the last backup tar file to perform a restore.|
|--set-pgbackrest-repo <path to repository>||Sets the path of the pgbackrest repository.|
|--backup-components||Selectively backs up specific Phantom components. The default is all components.
You must specify the same components for
|--config-only||Backups include only configuration data. This always creates a full backup of configuration data. Incremental backup of configuration data is not supported.
|--restore-components <components>||Selectively restores specific Phantom components. The default is all components.
The following components are valid components:
|--list-backups||Lists existing backups and their state. Use with |
|--delete-all||Deletes all backups. |
This action is irreversible.
|--delete-backup-group <group number>||Deletes a full backup group. Takes an integer that represents the backup group to delete.|
|--version||Shows the ibackup.pyc tool version number and exit.|
||Overrides the default backup path |
|--backup-type <full,incr>||Backup type. Using "full" creates a new full backup. Using "incr" creates an incremental on top of the current full backup.
If no full backup is taken and "incr" is given, the backup type defaults to "full". The default option if none is specified is "incr".
|--set-full-backup-limit <value>||Sets the maximum number of full backups allowed at once. Automatically rotates once the limit is reached.|
|--verbose||Writes debug-level log information to the console.|
|--list-settings||Lists the current settings for ibackup.|
|--no-prompt||Automatically responds with "yes" to all prompts from ibackup.|
|The following option has been deprecated.|
Use this argument only in exceptional circumstances, such as preventing a new full backup from overwriting an existing one.
Restore from a backup
Use ibackup.pyc with warm standby
This documentation applies to the following versions of Splunk® Phantom: 4.8