After the future removal of the classic playbook editor, your existing classic playbooks will continue to run, However, you will no longer be able to visualize or modify existing classic playbooks.
For details, see:
backup tools
Use the ibackup tool to create, manage, and restore backups for Splunk SOAR (On-premises). The backup file can be transferred to another system and used to restore the state of the system at the time the backup was created.
On privileged deployments, logs for each run of the tool are written to /var/log/phantom/backup/backup.log
, and completed backups are stored in <PHANTOM_HOME>/phantom/data/backup
.
On all unprivileged deployments, the logs are written to <PHANTOM_HOME>/var/log/phantom/backup/backup.log
, and backups are stored in <PHANTOM_HOME>/phantom/data/backup
.
You can find a repository of staging files for the PostgreSQL database backup in <PHANTOM_HOME>/data/ibackup/repo/pg
.
ibackup arguments
The following table shows the ibackup arguments:
Argument | Description |
---|---|
-h, --help | Shows the ibackup tool help message and exits. |
--setup | Prepares the instance or cluster for backup and restore. |
--off | Stops ibackup from making any backups. Deletes pgbackrest.conf and postgresql.ibackup.conf. Stops the pgbackrest process. Backup files are left in either the default directory <PHANTOM_HOME>/phantom/data/backup , or a directory specified by using another argument such as --set-pgbackrest-repo or --ibackup-root. On external PostgreSQL databases the configuration file postgresql.ibackup.conf on the PostgreSQL server is not deleted. After running |
--max-cores <maximum number of CPU cores>
|
Specifies the maximum number of processing cores allowed for database backup and restore operations. Specify more cores to increase backup performance. Reduce the number of cores if making backups reduce system performance. The default value is two cores. The minimum value is one core. |
--backup | Performs a backup. |
--restore <path/to/backup/>
|
Performs a restore. You must provide a path to the desired backup tar file to perform a restore. |
--set-pgbackrest-repo <path/to/repository>
|
Sets the path of the pgbackrest repository. If you specify a different repository, you will need to specify the path to backups in your --restore commands.
|
--ibackup-root <path/to/backup_root_directory>
|
Use this argument to override the root directory for ibackup. --ibackup-root is different from the --backup-path argument which sets a path for a single backup, because the --ibackup-root argument overrides the default root directory for all backups in a group.
|
--backup-components <list of components>
|
Selectively backs up specific components. The default is all components.
You must specify the same components for The following components are valid components:
For example: |
--fs-only | Backup only critical files. Use this in conjunction with AWS backup tools on systems in AWS with RDS databases.
Only GlusterFS, XFS, ext4, and NFS filesystems are supported. Other filesystems are not backed up using ibackup. |
--config-only | Backups include only configuration data. This always creates a full backup of configuration data. Incremental backup of configuration data is not supported.
Using the |
--restore-components <list of components>
|
Selectively restores specific components. The default is all components.
The following components are valid components:
For example: |
--list-backups | Lists existing backups and their state. Use with --verbosity for more detailed output.
|
--delete-all | Deletes all backups. You must restart PostgreSQL after using this option. phsvc restart postgresql This action is irreversible. |
--delete-backup-group <group number>
|
Deletes a full backup group. Takes an integer that represents the backup group to delete. |
--backup-path <path/to/store/backups>
|
Overrides the default backup path <PHANTOM_HOME>/phantom/data/backup . Takes a directory path for the directory where backups will be stored.
|
--backup-type <full, incr>
|
Backup type.
The default option if none is specified is |
--set-full-backup-limit <value>
|
Sets the maximum number of full backups allowed at once. Automatically rotates once the limit is reached. |
--list-settings | Lists the current settings for ibackup. |
--force-pg-stop-backup | This option has been removed. |
--no-prompt | Automatically responds with "yes" to all prompts from ibackup. |
--ignore-size-check | Use this argument to skip the check for available disk space before performing a backup or restore.
|
--ignore-env-check | Ignore the environment check when running ibackup. |
-v <0,1, 2, 3> --verbosity <0,1, 2, 3> | Verbosity level; 0=minimal output, 1=normal output, 2=verbose output, 3=very verbose output |
--no-color | Don't colorize the command output. |
Restore from a backup | Use ibackup with warm standby |
This documentation applies to the following versions of Splunk® SOAR (On-premises): 6.2.1, 6.2.2, 6.3.0
Feedback submitted, thanks!