Backup Manager Configuration Files for Disaster Recovery in ESM 5.0_1

Summary:

This document outlines a step-by-step recovery procedure for ArcSight ESM Version 5.0 GA, designed to minimize downtime and data loss in case of system failures or crashes. Key components include pre-requisites for backup procedures, detailed steps for restoring from a failed manager instance, and instructions for setting up a new manager. The document emphasizes the importance of maintaining backups of critical configuration files and advises customers to follow predefined steps for Oracle DB and ArcSight Manager backups.

Details:

ArcSight ESM™ Version 5.0 GA, released October 13, 2011, includes a comprehensive use case for quickly restoring the management service in case of system failures or crashes by following a step-by-step recovery procedure. The primary focus is on ensuring minimal downtime and no data loss through proper backup and configuration file restoration. ### Pre-requisites: To execute this process, customers must have access to https://arcsight.subscribenet.com and follow pre-defined steps for Oracle DB and ArcSight Manager backups. These include the following files under $ManagerHome: server.properties, jetty directory, cacerts file in jre/lib/security, common i18n directory, and notification configuration files. ### Backup Manager Configuration File: ArcSight advises that it is crucial to maintain backup procedures for both Oracle DB and ArcSight Manager configurations. The essential files under $ManagerHome for disaster recovery include server.properties, jetty, cacerts, common in the i18n directory, and notification configuration files. ### Recovery Procedure: In case of an unknown reason causing the current manager to fail, follow these steps to quickly reinstall and restore the new Manager: 1. Install a fresh copy of ArcSight ESM on a different path from the original installation; when prompted for install type, choose "Cancel" indicating it's not an upgrade but a new setup. 2. Copy the server.properties file from your backup location to the newly installed manager under $NewManagerHome/config directory. 3. Install any missing libraries or dependencies as required by the configuration files. 4. Start the Manager service, which should now be operational with minimal downtime and no data loss. This procedure ensures a swift recovery without significant disruptions and aids in maintaining system reliability and integrity. To set up a new manager, follow these steps: 1. Copy the "jetty" directory from your backup to the $NewManagerHome/config directory under the New Manager setup. Overwrite if prompted. 2. Copy the "cacerts" file from your backup to the $NewManagerHome/jre/lib directory under the New Manager setup. Overwrite if prompted. 3. Copy the "commons" directory from your backup to the $NewManagerHome/i18n/common directory under the New Manager setup. Overwrite if prompted. 4. Copy the "notification" directory from your backup to the $NewManagerHome/config/notification directory under the New Manager setup. Overwrite if prompted. 5. Run the command "arcsight managersetup" in the $NewManagerHome/bin directory of the new manager. Choose New Installation and proceed through the setup wizard, ensuring all settings are correct. 6. At the end of the setup wizard, select to remove the manager service. 7. Re-run the command "arcsight managersetup" from the same directory, choosing New Installation again and following the setup wizard to completion. This time, select to install the manager service at the end. 8. Start the Manager Service and log in via Console to verify it is up and running. 9. Once verified, exit out of the console and stop the new manager service. 10. Apply all necessary patches to ensure the new manager matches the patch level of the old one. 11. Restart the Manager Service to finalize the setup.

Disclaimer:

The content in this post is for informational and educational purposes only. It may reference technologies, configurations, or products that are outdated or no longer supported. If there are any comments or feedback, kindly leave a message and will be responded.