cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
lilMonix3
Level 9
Report Inappropriate Content
Message 1 of 10

McAfee ESM backup

Hi,

Does anyone know if we can manually mount remote share to our ESM for backup purposes, also is there any document that may help us to mount file systems to our ESM. Thank you

9 Replies
pbpillai
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: McAfee ESM backup

.

lilMonix3
Level 9
Report Inappropriate Content
Message 3 of 10

Re: McAfee ESM backup

Hi,

Do I still have to create/make a directory for the mount ? From the sources Ive seen regarding mounting file systems on Linux, we need to make a local directory on the device to map to the external share. Is that also the case here ?

 

pbpillai
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 10

Re: McAfee ESM backup

.

lilMonix3
Level 9
Report Inappropriate Content
Message 5 of 10

Re: McAfee ESM backup

Hi,

I tried to create a directory in /mnt and used the mount command however it returned an error message that path was not found in /etc/fstad/. So we added the entry to /etc/fstad/ and tried the command once again, it returned another error "access denied by server while mounting ....." 

 

 

pbpillai
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: McAfee ESM backup

.

lilMonix3
Level 9
Report Inappropriate Content
Message 7 of 10

Re: McAfee ESM backup

Hi,

Yes the NFS path has been shared and R/w permission is there as far as were concerned because we tried to perform backup on this before and it worked before and we havent changed anything

lratcliffe
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 10

Re: McAfee ESM backup

1. Please don't modify /etc/fstab - it is not necessary and will only cause problems on your SIEM.

2. As Prashanth says, the error indicates a permissions issue.  Can you please show us the content of /etc/exports on your NFS server?  I suspect the path you are trying to mount is not exported.

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
lilMonix3
Level 9
Report Inappropriate Content
Message 9 of 10

Re: McAfee ESM backup

Hi,

But when we try to mount the NFS share without adding the entry on /etc/fstab/ itl return an error saying that the mount is not an entry on /etc/fstab/. Please see below the command we used:

mount -t nfs <IP>:/<remote path> /<dir in mnt>

 

if we try to use that without editing /etc/fstab were returned with an error message

 

The /etc/exports are we going to check that on the NFS server? or is that on SIEM? on the NFS server I dont think theres an /etc/exports directroy but I will check either way 

lratcliffe
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 10

Re: McAfee ESM backup

On any nfs server there should be an /etc/exports file - this file defines what paths are exported as available nfs shares - see https://linux.die.net/man/5/exports 

I'd need to see the full command in use - but a mount point only needs to be defined in /etc/fstab if the mount command is not fully populated.

I just tested and confirmed that the direct "mount -t nfs <ip>:<exported path> <local path>" works without needing to be added to fstab.

lratcli1@storage:~$ cat /etc/exports
/shares/nfs1 192.168.198.10(rw,no_subtree_check,sync,no_root_squash) 192.168.194.19(rw,no_subtree_check,sync,no_root_squash)
lratcli1@storage:~$ logout
Connection to 192.168.194.67 closed.
lratcli1@ayllratcliffedesk:~$ ssh root@192.168.198.10
Last login: Fri Jan 22 08:59:12 2021 from 192.168.198.1
McAfee-ETM-VM4 ~ # cat /etc/fstab
# Autogenerated by mkfstab.pl
UUID=7bfecdb7-6b8c-4395-8879-ead58174968b /boot ext3 noatime 1 1
UUID=95e316a3-08ce-4a8d-92c3-239235a339c4 none swap pri=1 0 0
UUID=d55e61b1-613b-4f5f-a8e2-c574ad215523 / ext4 noatime 1 1
proc /proc proc defaults 0 0
sysfs /sys sysfs defaults 0 0
devpts /dev/pts devpts gid=4,mode=620 0 0
shm /dev/shm tmpfs defaults 0 0
usbfs /proc/bus/usb usbfs defaults 0 0

UUID=f256d7ff-43a5-40aa-8ec2-e1186e9cccf8 /data_hd ext4 noatime 0 0
McAfee-ETM-VM4 ~ # mount -t nfs 192.168.194.67:/shares/nfs1 test
McAfee-ETM-VM4 ~ # findmnt
TARGET SOURCE FSTYPE OPTIONS
`-/root/test 192.168.194.67:/shares/nfs1
nfs4 rw,relatime,vers=4.0,rsize=131072,wsize=131072,namlen=255,hard,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=192.168.198.10,local_lock=none,addr=192.16

 

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community