How to Perform a Data Backup for Collected Information.

[ocerna0721]

Hello,

I would like to understand how I can set up an automatic backup of the collected data to an alternate storage location when the local storage becomes low.

Thank you for your guidance.

[Nicolas Stefani]

Hello, 

Are you talking about the wazuh server or the wazuh indexer?

Anyways, here there are some links that can be useful:

* https://wazuh.com/blog/index-backup-management/

* https://wazuh.com/blog/recover-your-data-using-wazuh-alert-backups/

* https://documentation.wazuh.com/current/user-manual/files-backup/creating/wazuh-central-components.html

Regards,

--
You received this message because you are subscribed to the Google Groups "Wazuh mailing list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wazuh+un...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/6027830a-4a73-41f5-b0f7-f48cdfdb74e8n%40googlegroups.com.

--

Nicolás Stefani Software Engineer

[ocerna0721]

Thank you, the following link has been helpful: https://documentation.wazuh.com/current/user-manual/files-backup/creating/wazuh-central-components.html

I was able to perform the backup, but I would like to delete at least 30 days of data collected by Wazuh, is this possible?

[Nicolas Stefani]

Please, check this link:

* https://documentation.wazuh.com/current/user-manual/capabilities/log-data-collection/log-data-faq.html#how-long-are-the-logs-stored-on-the-server

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/fc9a7e89-35a3-4c0f-a8af-8e9f9dd5f69an%40googlegroups.com.

[ocerna0721]

Thank you for your responses, but I'm looking for something more specific. I found this in the frequently asked questions section you directed me to: "How long are the logs stored on the server?
Archived logs are not automatically deleted by default. However, you can choose when to manually or automatically (e.g., cron job) delete logs according to your own legal and regulatory requirements.
" , but I don't see an indication of how to do it, commands, or anything that needs to be configured in the ossec file.

[Nicolas Stefani]

Hi,

For example, you can use rsync to send the archives to a remote location and schedule this process with cron, every 30 days. Here you can find a general guide on how to do it.

The backup process is independent of Wazuh, so you don't need to add any configuration in the ossec.conf.

To view this discussion on the web visit https://groups.google.com/d/msgid/wazuh/a7c087c2-b817-4c71-98c7-d7fe19e48e5en%40googlegroups.com.

[ocerna0721]

Thank you so much Nicolas!