IBM Guardium

IBM Guardium

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Separate Archive Server for Collectors

    Posted 09/16/21 12:31 AM
    Hi Everyone,

    One of my Customer wants to store Archive Files for last 3 years.
    Totally they have 40 Collectors in the environment. Keeping archiving for last 3 years will be difficulty in the same server.
    Can we suggest separate archive server for each Collector?
    If collectors have separate archive server, shall we able to restore the archive files through Manage -> Data Restore or Catalog Import option?
    which one should be used?
    Please suggest.

    Thanks,
    Panendar Rao.C

    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------


  • 2.  RE: Separate Archive Server for Collectors

    Posted 09/16/21 02:04 AM
    1) You can specify individual archive server for each appliance.
    in Manage > Data Management > System Backup or Data Archive
    just provide Hostname or IP of the host you want to receive the archived data
    https://www.ibm.com/docs/en/guardium/11.3?topic=storage-configuring-scp-sftp-target-archive-backup

    2) You can also consider archive on aggregators (8 collectors -> 1 agg) total 5 aggregators so 5 archive servers. Its all up to you. Whether restore to empty appliance or existing appliance make sure you have the system's shared secret available on this system. Otherwise, it cannot decrypt the file. 

    3) Yes you have to create catalog entries if target restore system is not the system that generated the archive.

    Choose 1 of the 2 methods below:

    a) manually add entries into Catalog Archive in target
    ==> https://www.ibm.com/docs/en/guardium/11.3?topic=data-restoring-archived-empty-appliance

    b) export / import entries
             - export catalog entries from source (system A)
                         ==> https://www.ibm.com/docs/en/guardium/11.3?topic=catalogs-export-catalog-entries
             - then import the generated file to target (system B)
                         ==> https://www.ibm.com/docs/en/guardium/11.3?topic=catalogs-import-catalog-entries

    HTHs.

    ------------------------------
    DEMI SIEW PING LEE
    ------------------------------



  • 3.  RE: Separate Archive Server for Collectors

    Posted 09/16/21 07:05 AM
    HI Demi,

    Thanks for your information.
    Let me explain the my understand and correct me if I am wrong.

    If we need to restore the archived files in to new Guardium server which is not part of the same cluster, we need to follow the below steps:
    • Do Export catalog and save.csv file from Guardium server that generates archive files.
    • Import Catalog in the new Guardium server which exported as per the above step.
    • Then go with Catalog Archive -> Add, then give the parameters like filename, hostname, path etc and add it to store the archive file
    Then, if we do manage-> Data Management-> Data Restore and click search , we will be able to see the file we restored in Catalog Archive.
    Once we restore the file, we can see the data in new Guardium.

    Please correct me if my understanding is wrong.

    Thanks,
    Panendar Rao.C

    ------------------------------
    PHANENDRA RAO CHAVANA
    ------------------------------

    Original Message


  • 4.  RE: Separate Archive Server for Collectors

    Posted 09/16/21 11:28 PM
    Hi,

    If you have already performed Catalog Import the corresponding catalog entries should already exist in this appliance. Unless the catalog entry info is not correct(or need changes), you may edit (modify/remove->add) entry.

    One of basic requirement to successfully restore archive files:
    1. ensure the catalog entries are pointing to the correct hostname and location path 
    Use Search to view the catalog entry
    in GUI > Manage > Data Management > Catalog Archive. 

    To restore select "Data Restore" in GUI, choose the dates 'From' and 'To' and leave hostname blank, then click Search. A list of files will appear in a view, select the day you wish to restore and click Restore.

    ------------------------------
    DEMI SIEW PING LEE
    ------------------------------

    Original Message


Related Content