Skip to content

Commit bb4bca2

Browse files
ayodekoayodeko
authored
Merge pull request #8761 from wazuh/enhancement/idr255-update-backup-guide
Update the Backup guide
2 parents 0166387 + b23a382 commit bb4bca2

File tree

4 files changed

+65
-49
lines changed

4 files changed

+65
-49
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ All notable changes to this project will be documented in this file.
4545
- **Post-release**: Added steps to export and import dashboard customizations in the upgrade guide. ([#8618](https://github.com/wazuh/wazuh-documentation/pull/8618))
4646
- **Post-release**: Updated the vulnerability detection capability section. ([#8693](https://github.com/wazuh/wazuh-documentation/pull/8693))
4747
- **Post-release**: Changed the warning note on using the `$` and `&` characters when changing passwords in Docker deployments. ([#8694](https://github.com/wazuh/wazuh-documentation/pull/8694))
48+
- **Post-release**: Changed Windows commands in the backup guide to PowerShell. ([#8761](https://github.com/wazuh/wazuh-documentation/pull/8761))
4849

4950
### Fixed
5051

‎source/migration-guide/creating/wazuh-agent.rst‎

Lines changed: 37 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -26,18 +26,14 @@ Preparing the backup
2626
# bkp_folder=~/wazuh_files_backup/$(date +%F_%H:%M)
2727
# mkdir -p $bkp_folder && echo $bkp_folder
2828
29-
.. group-tab:: Windows (CMD Admin)
30-
31-
.. code-block:: doscon
32-
33-
> set datetime=%date%-%time%
34-
> set datetime=%datetime: =_%
35-
> set datetime=%datetime:/=-%
36-
> set datetime=%datetime::=_%
37-
> set datetime=%datetime:.=_%
38-
> set bkp_folder=%userprofile%\wazuh_files_backup\%datetime%
39-
> mkdir %bkp_folder% && echo %bkp_folder%
40-
29+
.. group-tab:: Windows (Powershell Admin)
30+
31+
.. code-block:: ps1con
32+
33+
> $timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
34+
> mkdir %bkp_folder% ; echo %bkp_folder%
35+
> $bkp_folder = Join-Path -Path $env:USERPROFILE -ChildPath "wazuh_files_backup\$timestamp"
36+
4137
.. group-tab:: macOS
4238

4339
.. code-block:: console
@@ -65,18 +61,20 @@ Backing up a Wazuh agent
6561
/var/ossec/logs/ \
6662
/var/ossec/queue/rids/ $bkp_folder
6763
68-
.. group-tab:: Windows (CMD Admin)
64+
.. group-tab:: Windows (Powershell Admin)
6965

70-
.. code-block:: doscon
66+
.. code-block:: ps1con
7167
72-
> xcopy "C:\Program Files (x86)\ossec-agent\client.keys" %bkp_folder% /H /I /K /S /X
73-
> xcopy "C:\Program Files (x86)\ossec-agent\ossec.conf" %bkp_folder% /H /I /K /S /X
74-
> xcopy "C:\Program Files (x86)\ossec-agent\internal_options.conf" %bkp_folder% /H /I /K /S /X
75-
> xcopy "C:\Program Files (x86)\ossec-agent\local_internal_options.conf" %bkp_folder% /H /I /K /S /X
76-
> xcopy "C:\Program Files (x86)\ossec-agent\*.pem" %bkp_folder% /H /I /K /S /X
77-
> xcopy "C:\Program Files (x86)\ossec-agent\ossec.log" %bkp_folder% /H /I /K /S /X
78-
> xcopy "C:\Program Files (x86)\ossec-agent\logs\*" %bkp_folder%\logs\ /H /I /K /S /X
79-
> xcopy "C:\Program Files (x86)\ossec-agent\rids\*" %bkp_folder%\rids\ /H /I /K /S /X
68+
> New-Item -Path $bkp_folder -ItemType Directory -Force | Out-Null
69+
> Write-Output $bkp_folder
70+
> Copy-Item "C:\Program Files (x86)\ossec-agent\client.keys" $bkp_folder -Recurse -Force
71+
> Copy-Item "C:\Program Files (x86)\ossec-agent\ossec.conf" $bkp_folder -Recurse -Force
72+
> Copy-Item "C:\Program Files (x86)\ossec-agent\internal_options.conf" $bkp_folder -Recurse -Force
73+
> Copy-Item "C:\Program Files (x86)\ossec-agent\local_internal_options.conf" $bkp_folder -Recurse -Force
74+
> Copy-Item "C:\Program Files (x86)\ossec-agent\*.pem" $bkp_folder -Recurse -Force
75+
> Copy-Item "C:\Program Files (x86)\ossec-agent\ossec.log" $bkp_folder -Recurse -Force
76+
> Copy-Item "C:\Program Files (x86)\ossec-agent\logs\*" "$bkp_folder\logs\" -Recurse -Force
77+
> Copy-Item "C:\Program Files (x86)\ossec-agent\rids" "$bkp_folder\rids" -Recurse -Force
8078
8179
.. group-tab:: macOS
8280

@@ -103,13 +101,22 @@ Backing up a Wazuh agent
103101
# rsync -aREz /var/ossec/active-response/bin/<CUSTOM_ACTIVE_RESPONSE_SCRIPT> $bkp_folder
104102
# rsync -aREz /var/ossec/wodles/<CUSTOM_WODLE_SCRIPT> $bkp_folder
105103
106-
.. group-tab:: Windows (CMD Admin)
104+
.. group-tab:: Windows (Powershell Admin)
105+
106+
.. code-block:: powershell
107+
108+
# Example variables - replace with your actual file names and folders
109+
110+
$SCA_DIRECTORY = "sca"
111+
$CUSTOM_SCA_FILE = "custom_sca.yml"
112+
$CUSTOM_ACTIVE_RESPONSE_SCRIPT = "my_response.ps1"
113+
$CUSTOM_WODLE_SCRIPT = "custom_wodle.py"
107114
108-
.. code-block:: doscon
115+
.. code-block:: ps1con
109116
110-
> xcopy "C:\Program Files (x86)\ossec-agent\<SCA_DIRECTORY>\<CUSTOM_SCA_FILE>" %bkp_folder% /H /I /K /S /X
111-
> xcopy "C:\Program Files (x86)\ossec-agent\active-response\bin\<CUSTOM_ACTIVE_RESPONSE_SCRIPT>" %bkp_folder%\active-response\bin\ /H /I /K /S /X
112-
> xcopy "C:\Program Files (x86)\ossec-agent\wodles\<CUSTOM_WODLE_SCRIPT>" %bkp_folder%\wodles\ /H /I /K /S /X
117+
> Copy-Item "$SCA_DIRECTORY\$CUSTOM_SCA_FILE" "C:\Program Files (x86)\ossec-agent\$SCA_DIRECTORY" -Recurse -Force
118+
> Copy-Item "active-response\bin\$CUSTOM_ACTIVE_RESPONSE_SCRIPT" "C:\Program Files (x86)\ossec-agent\active-response\bin" -Recurse -Force
119+
> Copy-Item "wodles\$CUSTOM_WODLE_SCRIPT" "C:\Program Files (x86)\ossec-agent\wodles" -Recurse -Force
113120
114121
.. group-tab:: macOS
115122

@@ -133,11 +140,11 @@ Checking the backup
133140
134141
# find $bkp_folder -type f | sed "s|$bkp_folder/||" | less
135142
136-
.. group-tab:: Windows (CMD Admin)
143+
.. group-tab:: Windows (Powershell Admin)
137144

138-
.. code-block:: doscon
145+
.. code-block:: ps1con
139146
140-
> tree %bkp_folder% /f
147+
> tree (Get-ChildItem "$env:USERPROFILE\wazuh_files_backup" -Directory | Sort-Object LastWriteTime -Descending | Select-Object -First 1 -ExpandProperty FullName) /f
141148
142149
.. group-tab:: macOS
143150

‎source/migration-guide/index.rst‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Backup guide
88

99
In this section you can find instructions on how to create and restore a backup of your Wazuh installation.
1010

11-
To do this backup, you copy key files to a folder preserving file permissions, ownership, and path. Later, you can move this folder contents back to the corresponding location to restore your Wazuh data, certificates, and configurations. Backing up Wazuh files is useful in cases such as moving your Wazuh installation to another system.
11+
To do this backup, copy the key files to a designated folder while preserving file permissions, ownership, and directory structure. This ensures you can later restore your Wazuh data, certificates, and configurations by transferring the files back to their original locations. This method is particularly useful when migrating your Wazuh installation to a new system.
1212

1313
.. toctree::
1414
:maxdepth: 2

‎source/migration-guide/restoring/wazuh-agent.rst‎

Lines changed: 26 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -102,38 +102,46 @@ Preparing the data restoration
102102
Restoring Wazuh agent files
103103
^^^^^^^^^^^^^^^^^^^^^^^^^^^
104104

105-
Perform the steps below in an elevated Windows Command Prompt (CMD) to restore the Wazuh agent files on a Windows endpoint.
105+
Perform the steps below to restore Wazuh agent files on a Windows endpoint.
106106

107-
#. Stop the Wazuh agent to prevent any modification to the Wazuh agent files during the restore process by running the following command on the Command Prompt as an administrator:
107+
#. Stop the Wazuh agent to prevent any modification to the Wazuh agent files during the restore process by running the following command on PowerShell as an administrator:
108108

109-
.. code-block:: doscon
109+
.. code-block:: ps1con
110110
111-
NET STOP WazuhSvc
111+
> NET STOP WazuhSvc
112112
113-
#. Launch the Windows Command Prompt as an administrator and navigate to the ``wazuh_files_backup/<DATE_TIME>`` folder that contains the backup files.
113+
#. Launch PowerShell as an administrator and navigate to the ``wazuh_files_backup/<DATE_TIME>`` folder that contains the backup files.
114114

115115
#. Run the following commands to copy the Wazuh agent data, certificates, and configurations:
116116

117-
.. code-block:: doscon
117+
.. code-block:: ps1con
118118
119-
> xcopy client.keys "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
120-
> xcopy ossec.conf "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
121-
> xcopy internal_options.conf "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
122-
> xcopy local_internal_options.conf "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
123-
> xcopy *.pem "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
124-
> xcopy ossec.log "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
125-
> xcopy logs\* "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
126-
> xcopy rids\* "C:\Program Files (x86)\ossec-agent\" /H /I /K /S /X /Y
119+
> Copy-Item "$bkp_folder\client.keys" "C:\Program Files (x86)\ossec-agent" -Recurse -Force
120+
> Copy-Item "$bkp_folder\ossec.conf" "C:\Program Files (x86)\ossec-agent" -Recurse -Force
121+
> Copy-Item "$bkp_folder\internal_options.conf" "C:\Program Files (x86)\ossec-agent" -Recurse -Force
122+
> Copy-Item "$bkp_folder\local_internal_options.conf" "C:\Program Files (x86)\ossec-agent" -Recurse -Force
123+
> Copy-Item "$bkp_folder\*.pem" "C:\Program Files (x86)\ossec-agent" -Recurse -Force
124+
> Copy-Item "$bkp_folder\ossec.log" "C:\Program Files (x86)\ossec-agent" -Recurse -Force
125+
> Copy-Item "$bkp_folder\logs\*" "C:\Program Files (x86)\ossec-agent\logs" -Recurse -Force
126+
> Copy-Item "$bkp_folder\rids\*" "C:\Program Files (x86)\ossec-agent\rids" -Recurse -Force
127127
128128
You can also copy these files using the *drag and drop* method.
129129

130130
#. Restore your custom files, such as local SCA policies, active response scripts, and wodle commands, if there are any. Adapt the following command accordingly.
131131

132-
.. code-block:: doscon
132+
.. code-block:: powershell
133+
134+
# Example variables - replace with your actual file names and folders
135+
$SCA_DIRECTORY = "sca"
136+
$CUSTOM_SCA_FILE = "custom_sca.yml"
137+
$CUSTOM_ACTIVE_RESPONSE_SCRIPT = "my_response.ps1"
138+
$CUSTOM_WODLE_SCRIPT = "custom_wodle.py"
139+
140+
.. code-block:: ps1con
133141
134-
> xcopy <SCA_DIRECTORY>\<CUSTOM_SCA_FILE> “C:\Program Files (x86)\ossec-agent\<SCA_DIRECTORY>” /H /I /K /S /X /Y
135-
> xcopy active-response\bin\<CUSTOM_ACTIVE_RESPONSE_SCRIPT> "C:\Program Files (x86)\ossec-agent\active-response\bin\" /H /I /K /S /X /Y
136-
> xcopy wodles\<CUSTOM_WODLE_SCRIPT> "C:\Program Files (x86)\ossec-agent\wodles\" /H /I /K /S /X /Y
142+
> Copy-Item "$SCA_DIRECTORY\$CUSTOM_SCA_FILE" "C:\Program Files (x86)\ossec-agent\$SCA_DIRECTORY" -Recurse -Force
143+
> Copy-Item "active-response\bin\$CUSTOM_ACTIVE_RESPONSE_SCRIPT" "C:\Program Files (x86)\ossec-agent\active-response\bin" -Recurse -Force
144+
> Copy-Item "wodles\$CUSTOM_WODLE_SCRIPT" "C:\Program Files (x86)\ossec-agent\wodles" -Recurse -Force
137145
138146
#. Start the Wazuh agent service by running the following command on the Command Prompt as an administrator:
139147

0 commit comments

Comments
 (0)