ESM 11.x Data backup duration

[lilMonix3]

Hi, 

Has anyone performed a databackup yet on ESM 11.x? What is the typical duration for that data backup? We tried performing one and it was going for about the rate of 200G/day. On 2 environments weve experienced this despite one having just a switch between the remote location and the SIEM? Is this normal on ver 11.x ? previously on the same setup but on 10.x we were able to perform a fullbackup estiamated around 6TB in just 2 days. Please advise 

[pbpillai · Accepted solution]

.

[lilMonix3]

HI,

But should it be the same as 10.x backup? Based on your experience how long does it take? Should it be as fast a a 10.x fullbackup? Weve had 2 systems weve observed the 200GB/day rate and one of them has a virtual back-to-back connection with the remote location with only a switch is between them. 

[danwsdg]

I have the same problem. In version 10.X "full backup" took several hours and the resulting files were almost 5 TB. In version 11.3.2 the "data backup" has been running for several days and the resulting files are now only 130 GB. The backup is performed to the same NFS location. Nothing has changed in the network connections.

[lratcliffe]

Check the backup is still running with:

curl -X GET http://127.0.0.1:8888/Snowservice/SnowflexAdminServices/GetBackupRestoreStatus | python -mjson.tool

If the backup is no longer running and didn't complete as expected, please raise a service request so we can investigate and assist and reference SIEMSFX-1822 - this may be related.   We need to confirm if this is the same issue.

[danwsdg]

My backup is still running:

Curl response:

{

"addlInfo": "Backup is currently in progress serverNames: XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX ",
"operationType": "backup",
"status": "inProgress"
}

[lilMonix3]

Hi

Were currently running a data backup with one of our clients, weve arranged a virtually back-to-back connect between SIEM and the NFS server and the transfer rate is still very slow. Weve tried the query you provided and our backup is still running however at a very slow rate 10GB at 2.5 hrs. Can you confirm if the data backup generation for 11.x is supposed to be this slow ? In your experience what is the fastest completion time or if you could give us an idea on how fast the data backup should run that would be helpful. Thank you.

[danwsdg]

Hi 

My first data backup took about 10 days to perform. From the records in the backup log it seems that most of the time the alert tables were backed up. It seems that the problem is not the connection to NAS but the long time of execution of queries selecting data for backup. Another run of data backup I have not yet performed because in the meantime there was another problem, which is being diagnosed.