The following guide will show you how to manually backup all the advance configurations in Log Insight (e.g. IPs, DNS, Forwarding Rules, NTP) and custom work done such as Agent Groups, Dashboards, Alerts, etc. For full appliance backups, third party backup tools should still be used. Special thanks to VMware coworkers Steve Flanders, Yogita Patil, and Alan Castonguay for the advice when putting this together. The following guide will backup Log Insight 3.0 and above.
Backup Best Practices
- Setup scheduled backups (first one should be full backup)
- Replication is also recommended
- When using snapshots, Log Insight does not support quiesced snapshots
- Making changes to the configuration files directly from the appliance console is not officially supported beginning in vRealize Log Insight 3.0. You will need to use the built-in UI (see steps below).
How to manually Backup Log Insight Advanced Configurations
Open a browser and authenticate to the Log Insight cluster virtual IP (VIP) or master node
Log in to https://LogInsight_Hostname_Or_IpAddress/internal/config and login as admin
Check the box Show all settings and then select all and copy everything in the Server Settings Configuration box
Open Notepad and paste everything into Notepad. Save the settings.
- In a clustered environment, all the settings copied from the UI is identical and is replicated between all nodes therefore you will only need to make only one backup copy per a Log Insight cluster. You will only need to repeat these steps only if you have multiple Log Insight clusters.
How to Restore Advance Configuration Settings
If it recommended to have a clean snapshot and a full backup before you do the following steps. Also a restart may be required after restoring settings.
Open the saved Notepad file and Copy everything
Log in to https://LogInsight_Hostname_Or_IpAddress/internal/config and login with the admin credentials
Check the box Show all settings and then select all and paste
and replace everything in the Server Settings Configuration box
Change any settings if needed (optional if you want to change IP address or FQDN for example). Then click on Save
If a restart is required. Just click on Cluster > Select Node you want to restart > Restart Node. Wait 2 minutes for each node to complete restart and run startup checks before proceeding with the next node
- Note: If you are copying these settings to a new cluster, the new cluster probably won’t have the keys to decrypt them. You can use the normal UI (or API) to manually set the password for Active Directory and SMTP binding.
How to backup custom dashboards, alerts, queries, agent groups
The following guide will show you how to backup custom work that you have created. Each user will have to backup their My Content manually or they can choose to share their dashboard out and have it backed during the process of backing up all shared dashboards. Also new in Log Insight 3.6 and above is the ability to impersonate another user. This must be enabled in administration > General > Enable User Impersonation. This will allow a Super Admin to be able to impersonate any user. All logs will be stored in in ui_runtime.log. For more information on this you can read more about it http://sflanders.net/2016/11/07/log-insight-3-6-user-impersonation/
Login to Log Insight with an account with full admin rights
Go to > Content Packs > My Content
Hit the dropdown next to My Content and select Export
Select the Dashboards, Queries, Alerts, Extracted Fields, Agent Groups that you want to export then fill out the information on the right side and click on Export when you are done.
Click on OK to save the file
- Now click on Shared Content and repeat the process above to export Shared Content
How to restore custom dashboards, alerts, queries, agent groups
- Go to > Content Packs > My Content
On the bottom left click on Import Content Pack
- Select the backup file and click on Open
Select either import as Content Pack or into My Content (allows you to edit) and then click on Import when done
- Repeat the steps as needed for any other backups you have