######################
Backup / Restore
######################

This page covers backup and restore of an Atomic OSSEC (AEO) hub: OSSEC manager
state under ``/var/ossec`` and AWP hub state under ``/var/awp``.

For NFS-based persistent storage layouts, see :doc:`/AEO/server/sre/sre`.

In a clustered deployment, back up the **master** hub. Workers re-synchronize
agent keys and shared configuration from the master. See
:doc:`/AEO/server/clustering/index`.


What to back up
===============

Critical persistent data on the hub:

.. list-table::
   :header-rows: 1
   :widths: 35 65

   * - Path
     - Purpose
   * - ``/var/ossec/etc/``
     - Manager configuration, agent keys (``client.keys``), shared agent
       policies (``shared/``), local rules (``rules.d/``), and auth material
   * - ``/var/ossec/queue/``
     - FIM and agent database state (including ``queue/db/``)
   * - ``/var/ossec/logs/``
     - Alerts, archives, and related manager logs
   * - ``/var/ossec/ac-cluster/etc/.comms.key``
     - Cluster communications key (required when clustering is enabled)
   * - ``/var/ossec/.ssh/``
     - Agentless SSH keys (when agentless monitoring is used)
   * - ``/var/awp/etc/``
     - Hub configuration, SSL certificates (``.ssl/`` / ``ssl/``), per-group
       policy JSON under ``agents/``
   * - ``/var/awp/data/``
     - Console users and groups (``.awp.dat``, ``.awp.key``), reports,
       vulnerability/SCA data, quarantine, and related hub service data

.. note::

   ``/var/awp/www/`` is normally provided by packages and is not first-class
   backup state. Prefer restoring packages, then overlaying ``/var/awp/etc``
   and ``/var/awp/data``.


Backup procedure
================

**Step 1: Quiesce services**

Stop the manager and hub services so the snapshot is consistent:

.. code-block:: console

   systemctl stop awpd
   systemctl stop ossec-hids

**Step 2: Archive OSSEC manager state**

Example (tar to a mounted volume):

.. code-block:: console

   mkdir -p /mnt/hub-backup
   tar -czf /mnt/hub-backup/ossec-etc-$(date +%Y%m%d).tar.gz -C / var/ossec/etc
   tar -czf /mnt/hub-backup/ossec-queue-$(date +%Y%m%d).tar.gz -C / var/ossec/queue
   tar -czf /mnt/hub-backup/ossec-logs-$(date +%Y%m%d).tar.gz -C / var/ossec/logs

If clustering is enabled, also archive the cluster key directory:

.. code-block:: console

   tar -czf /mnt/hub-backup/ossec-ac-cluster-$(date +%Y%m%d).tar.gz \
     -C / var/ossec/ac-cluster/etc

Example (rsync over SSH):

.. code-block:: console

   rsync -av -e ssh root@aeo:/var/ossec/etc/ /mnt/hub-backup/ossec-etc/
   rsync -av -e ssh root@aeo:/var/ossec/queue/ /mnt/hub-backup/ossec-queue/
   rsync -av -e ssh root@aeo:/var/ossec/logs/ /mnt/hub-backup/ossec-logs/

**Step 3: Archive AWP hub state**

.. code-block:: console

   tar -czf /mnt/hub-backup/awp-etc-$(date +%Y%m%d).tar.gz -C / var/awp/etc
   tar -czf /mnt/hub-backup/awp-data-$(date +%Y%m%d).tar.gz -C / var/awp/data

Or with rsync:

.. code-block:: console

   rsync -av -e ssh root@aeo:/var/awp/etc/ /mnt/hub-backup/awp-etc/
   rsync -av -e ssh root@aeo:/var/awp/data/ /mnt/hub-backup/awp-data/

**Step 4: Restart services**

.. code-block:: console

   systemctl start ossec-hids
   systemctl start awpd


Restore procedure
=================

Restore configuration and identity first, then queue and log data.

**Step 1: Stop services**

.. code-block:: console

   systemctl stop awpd
   systemctl stop ossec-hids

**Step 2: Restore archives**

Extract on the target hub (paths assume archives created as above):

.. code-block:: console

   tar -xzf /mnt/hub-backup/ossec-etc-YYYYMMDD.tar.gz -C /
   tar -xzf /mnt/hub-backup/awp-etc-YYYYMMDD.tar.gz -C /
   tar -xzf /mnt/hub-backup/awp-data-YYYYMMDD.tar.gz -C /
   tar -xzf /mnt/hub-backup/ossec-queue-YYYYMMDD.tar.gz -C /
   tar -xzf /mnt/hub-backup/ossec-logs-YYYYMMDD.tar.gz -C /

If clustering was in use:

.. code-block:: console

   tar -xzf /mnt/hub-backup/ossec-ac-cluster-YYYYMMDD.tar.gz -C /

**Step 3: Fix ownership and modes**

Align with the usual hub layout (see also :doc:`/AEO/server/sre/sre`):

.. code-block:: console

   chown -R root:ossec /var/ossec/etc
   chmod 770 /var/ossec/etc
   chown -R ossec:ossec /var/ossec/logs
   chmod 750 /var/ossec/logs
   chown -R root:ossec /var/ossec/queue
   chmod 550 /var/ossec/queue

Preserve ownership from the backup when possible (``tar`` / ``rsync -a``).
Adjust only if ownership was lost during transfer.

**Step 4: Start services and verify**

.. code-block:: console

   systemctl start ossec-hids
   systemctl start awpd

Confirm:

- Hub console login works (depends on ``/var/awp/data/.awp.dat`` and ``.awp.key``)
- Agents reconnect (``/var/ossec/etc/client.keys`` and shared policies restored)
- If clustered, ``/var/ossec/ac-cluster/etc/.comms.key`` matches across nodes


Backup: Alert data (Cold Storage)
=================================

Alert data is rotated and compressed in JSON and log format every 24 hours.
AEO indexes the JSON data in the console; these archives are the primary focus
for long-term alert retention backups.

**Step 1: Backup / transfer archive data**

Copy ``/var/ossec/logs/alerts/<YYYY>/<Mon>/`` to the backup location.

Example (rsync over SSH):

.. code-block:: console

   rsync -av -e ssh root@aeo:/var/ossec/logs/alerts/2020/* /mnt/hub-backup/alerts/


Restore: Alert data (Cold Storage)
==================================

**Step 1: Transfer cold storage to hot storage**

Copy backup data to ``/var/ossec/logs/alerts/<YYYY>/<Mon>/``.

Example (rsync over SSH):

.. code-block:: console

   rsync -av -e ssh /mnt/hub-backup/alerts/ root@aeo:/var/ossec/logs/alerts/2020/

**Step 2: Re-index restored data**

On the AEO hub run:

.. code-block:: console

   systemctl stop awpd

   /var/awp/bin/awp_indexgen

   systemctl start awpd

.. note::

   Index generation can take several minutes per file.


Search / OpenSearch recovery
============================

There is no separate OpenSearch volume snapshot procedure in this guide.
To recover searchable alert history:

1. Restore alert archives under ``/var/ossec/logs/alerts/`` (see cold storage above).
2. Run ``/var/awp/bin/awp_indexgen`` after stopping ``awpd``, then start ``awpd`` again.


Optional components
===================

**Agentless SSH keys**

If you use agentless monitoring, include ``/var/ossec/.ssh/`` (and any
registered agentless host state under ``/var/ossec/agentless/``) in the backup
set with the OSSEC manager archives.

**MySQL / database output**

If OSSEC database output is enabled on the hub, back up that database with your
normal database tools in addition to the filesystem trees above. Most hubs do
not require a separate MySQL dump for day-to-day AEO operation.
