cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
429
Views
0
Helpful
3
Replies

Filters missing after restoring CSPM database

chrisv
Level 1
Level 1

After a database corruption, I had to restore the database from a previous backup. I then noticed that the filters I had set for each sensor was missing from the "Advanced Filtering" section.

However, on the sensor, in the packetd.conf, the RecordOfExcludedPattern is there.

How do I get back the filter settings in CSPM?

Thank you

3 Replies 3

jekrauss
Level 1
Level 1

Did you restore the database or did you just restore the topology (the .cpm file)?

Most of the information required for restoration is in the topology, but some information like previous alarms, changes to templates, and notifications are in the database.

I'd recommend that after you have things up and running well again that you save both a backup of your database AND a backup of your topology.

File>>Policy Database Backup

AND

File>>Export to file>>Export

HTH

Jeff

I restored the database, not the topology.

I do make a backup of the database (after signature updates) and topology. However, I don't have a backup of the database after I added filters.

Thank you,

Chris

You might try the following:

1) Go through the sensor configuration windows and copy down the configuration.

2) Delete the sensor, and save and update CSPM.

3) Now add the sensor again as a new sensor and choose the option to import the existing config from the sensor.

Thie should pull in your current sensor configuration with the filters.

What you might find, however, is that a few of the other configuration areas may not have been pulled in correctly.

4) Compare the newly imported configuration agains the copy from step1 and update the configuration where necessary to match.

If you only have a few filters it would be easier just to add them in manually.

But if you have several then doing the above may work for you.

Marco

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: