Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Filters missing after restoring CSPM database

After a database corruption, I had to restore the database from a previous backup. I then noticed that the filters I had set for each sensor was missing from the "Advanced Filtering" section.

However, on the sensor, in the packetd.conf, the RecordOfExcludedPattern is there.

How do I get back the filter settings in CSPM?

Thank you

  • Other Security Subjects
3 REPLIES
New Member

Re: Filters missing after restoring CSPM database

Did you restore the database or did you just restore the topology (the .cpm file)?

Most of the information required for restoration is in the topology, but some information like previous alarms, changes to templates, and notifications are in the database.

I'd recommend that after you have things up and running well again that you save both a backup of your database AND a backup of your topology.

File>>Policy Database Backup

AND

File>>Export to file>>Export

HTH

Jeff

New Member

Re: Filters missing after restoring CSPM database

I restored the database, not the topology.

I do make a backup of the database (after signature updates) and topology. However, I don't have a backup of the database after I added filters.

Thank you,

Chris

Cisco Employee

Re: Filters missing after restoring CSPM database

You might try the following:

1) Go through the sensor configuration windows and copy down the configuration.

2) Delete the sensor, and save and update CSPM.

3) Now add the sensor again as a new sensor and choose the option to import the existing config from the sensor.

Thie should pull in your current sensor configuration with the filters.

What you might find, however, is that a few of the other configuration areas may not have been pulled in correctly.

4) Compare the newly imported configuration agains the copy from step1 and update the configuration where necessary to match.

If you only have a few filters it would be easier just to add them in manually.

But if you have several then doing the above may work for you.

Marco

89
Views
0
Helpful
3
Replies
This widget could not be displayed.