ePO server backup and disaster recovery procedure
Technical Articles ID:
KB66616
Last Modified: 1/3/2020
Last Modified: 1/3/2020
Environment
McAfee ePolicy Orchestrator (ePO) 5.x
Summary
This article provides information about the backup and disaster recovery process for the ePO server.
IMPORTANT:
IMPORTANT:
- This procedure is intended for use only by network and ePO administrators. McAfee does not assume responsibility for any damage incurred because the article is intended as a guideline for disaster recovery. All liability for use of the following information remains with the user.
- It is preferable to use the built-in Disaster Recovery feature. Only use this article if a snapshot was not created, and a manual recovery is needed.
For information about the Disaster Recovery feature, see the Restoring McAfee ePO section of the relevant ePolicy Orchestrator Installation Guide.
For McAfee product documents, go to the Enterprise Product Documentation portal at https://docs.mcafee.com.
- You must follow the instructions in KB71078, if you are either:
- Migrating from a 32-bit to a 64-bit operating system
Or - Installing ePO to a different path
- Migrating from a 32-bit to a 64-bit operating system
NOTES:
- The agent uses either the last known IP address, DNS name, or NetBIOS name of the ePO server. If you change any one of these values, make sure that the agents have a way to locate the server. The easiest way is to retain the existing DNS record and change it to be directed to the new IP address of the ePO server. After the agent successfully connects to the ePO server, it downloads an updated
Sitelist.xml with the current information. - You can also use this procedure if you want to migrate the ePO server to another system. But, it is preferable to use the built-in Disaster Recovery feature to migrate the ePO server to another system.
- Reimport the certificate, if you imported a certificate to the Java certificate store after following the process in KB84628. Complete the task after you have either:
- Completed an upgrade
- Taken a snapshot recovery
- Implement a disaster recovery
- Make sure that you restore the same version of ePO Server and Update.
- To make sure a smooth recovery, do not perform a backup while the server is in the process of installing an extension.
Before backing up
Shut down the ePO Application Server service (Tomcat) when you perform the backup. If you can't shut down Tomcat, make sure that no one is performing the following actions during the backup:
- Installing, uninstalling, or upgrading an extension
- Updating the ePO database configuration
To back up the ePO server
- Use the following documents to back up the SQL database (normally named ePO_<ServerName>, where <ServerName> is your ePO server name):
- For details about backing up the ePO database using SQL Server Management Studio, See KB52126
- For details about backing up the ePO database using OSQL commands, See KB67591
IMPORTANT: In ePO 5.10 and later, threat event information has been split into its own database, so you must back up both databases. Carry out the backup process on both the main database (default nameePO_ePO_server_name ) and the events database (default nameePO_ePO_server_name_Events ).
- You must also back up the following folder paths:
NOTE: The default 64-bit installation paths are listed below. But, your installation might differ. For example, the default 32-bit installation path is
C:\Program Files\McAfee\ePolicy Orchestrator .
The default path to ePO software extension information.
The default path to needed files used by the ePO software extensions.
These keys are for ePO agent-server communication and the repositories.
Products that have been checked in to the Master Repository are located here.
The agent-server communication and Repository Keys that are unique to your installation are located here. Failing to restore this folder results in all client systems being unable to communicate with the server, and you have to redeploy the agent to all systems. Also, you must check in all deployable packages again.
The following are located here:
- The server configuration settings for Apache
- SSL certificates needed to authorize the server to handle agent requests
- Console certificates
NOTE: Failure to back up and restore these directory structures requires a reinstallation of ePO to create new ones. It might also require a clean database installation and redeployment of agents to all client systems.
To recover the ePO server
- Delete the ePO database on the SQL Server. If you do not know how to perform the MSSQL operation, see http://technet.microsoft.com/en-us/library/ms177419.aspx or contact Microsoft Support.
- If restoring ePO to the same system, uninstall ePO. Make sure that there is no ePolicy Orchestrator folder in the original installation path after the software is uninstalled.
NOTE: Renaming the existing ePO folder and leaving the old directory in place might interfere with the new installation. So, we recommend that you remove the old directory completely.
- Reinstall ePO to the same version and update level as the server you are restoring.
NOTE: You can verify the ePO update level. Look at the Version field in the backed-upServer.ini file (C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\) and cross-reference it with article KB59938.
IMPORTANT: You must reinstall ePO to the exact same directory path as the previous installation for this article to apply. If you do not, the initialization of extensions fails when the restore is complete. If the installation path is different, follow the steps in article KB71078 instead.
- Apply any additional updates, hotfixes, or POCs to ePO that had been previously applied. If you previously installed Policy Auditor 6.2 for use with ePO, install the same version of Policy Auditor. Including any hotfix releases, that had been installed before.
IMPORTANT: When restoring an ePO 5.10 environment that has had a Cumulative Update applied. Make sure that you apply the same update version to the newly installed ePO server. If this action is not done, the ePO Application Server service is unable to start.
- Stop and disable all ePO services:
- Click Start, Run, type
services.msc , and click OK.
- Right-click each of the following services and select Stop:
McAfee ePolicy Orchestrator Application Server
McAfee ePolicy Orchestrator Event Parser
McAfee ePolicy Orchestrator Server
- Double-click each of the following services and change Startup type to Disabled:
McAfee ePolicy Orchestrator Application Server
McAfee ePolicy Orchestrator Event Parser
McAfee ePolicy Orchestrator Server
- Click Start, Run, type
- Restore the database. See article KB52126 for details about restoring the ePO database using SQL Server Management Studio.
NOTE: Restore the database so that you do not require the ePO database configuration to be updated. For example, same name, host, port. Otherwise, you must update the restored
DB.PROPERTIES file inC:\Program Files\McAfee\ePolicy Orchestrator\Server\conf\orion with the new information, before you start the server.
IMPORTANT: In ePO 5.10 and later, threat event information has been split into its own database, so you must restore both databases. Carry out the restore process on both the main database and the events database. - Rename the following folders. For example, rename the extensions folder to extensions_old. Then replace them with the corresponding folders that were backed up earlier in step 2:
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\extensions
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\conf
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Server\keystore
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Software
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\DB\Keystore
C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\conf - Start only the McAfee ePolicy Orchestrator Application Server service.
- Access the core/config page of ePO and confirm the DB credentials if you are unable to access the ePO console. See KB69850 for detailed instructions on how to access the core\config page and update the DB credentials if needed.
IMPORTANT: If you are restoring an ePO 5.10 environment, select the option Change password, and re-enter the password for the account used to access SQL, even though it has not changed.
Verify that the password is accepted by using the Test Connection option. Assuming the connection is successful, click Apply to save the password, and restart the ePO application server service. This step is needed to create a new password hash based on the new ePO server's unique key.
- Attempt to log on to the ePO console. If you are unable to log on, review all steps performed in this article and make sure that they have been properly completed. If you can't resolve the console logon issue, contact Technical Support for further assistance before you continue.
To contact Technical Support, log on to the ServicePortal and go to the Create a Service Request page at https://support.mcafee.com/ServicePortal/faces/serviceRequests/createSR:- If you are a registered user, type your User Id and Password, and then click Log In.
- If you are not a registered user, click Register and complete the required fields. Your password and logon instructions will be emailed to you.
NOTE: You must successfully log on, for the rest of the recovery steps to work.
- Rename the
SSL.CRT folder (see path below) toSSL.CRT.OLD and manually create an empty folder namedSSL.CRT in the same path. If you do not, the setup fails to create a new certificate:
64-bit: "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
32-bit: "C:\Program Files\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt"
- Click Start, type cmd in the search field, right-click, and click Run as administrator.
- Change directories to your ePO installation directory.
Default paths:
64-bit:Program Files (x86)\McAfee\ePolicy Orchestrator\
32-bit:Program Files\McAfee\ePolicy Orchestrator \
- Run the following command:
Rundll32.exe ahsetup.dll RunDllGenCerts ePO_server_name console_HTTPS_port> admin_username password "installdir\Apache2\conf\ssl.crt"
Where:
ePO_server_name - Your ePO server NetBIOS name
Console_HTTPS_port - Your ePO console port (default is 8443)
Admin_username - Administrator (use the default ePO administrator console account)
Password - The password to the ePO administrator console account
Installdir\Apache2\conf\ssl.crt -Your installation path to the Apache folder; Default installation path:
64-bit: "C:\Program Files (x86)\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt "
32-bit: "C:\Program Files\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt "
Example
Rundll32.exe ahsetup.dll RunDllGenCerts epo_server_name 8443 administrator password "C:\Program Files\McAfee\ePolicy Orchestrator\Apache2\conf\ssl.crt" IMPORTANT:- This command fails if you have enabled User Account Control (UAC) on this server. If the server is running Windows Server 2008 or later, disable this feature. You can find more information about UAC at: http://technet.microsoft.com/en-us/library/cc709691(WS.10).aspx.
- This command is case sensitive. The ahsetup.log provides information about whether the command succeeded or failed. It also states whether it used the files located in the ssl.crt folder.
NOTE: Theahsetup.log is located inePO_install_directory\Apache2\conf\ssl.crt .
- Start the following services:
McAfee ePolicy Orchestrator Event Parser
McAfee ePolicy Orchestrator Server
- Look in the
DB/logs/server.log to make sure that the Agent Handler (Apache server) started correctly. It must state something similar to the following:
I #4108 NAIMSRV ePolicy Orchestrator server started.
If it does not, there is an error similar to the following:
E #4736 NAIMSRV Failed to get server key information
Related Information
For information about the ePO cluster backup and disaster recovery procedure, see KB75497.
Keywords: Recovery, recovery procedure
Keywords: Recovery, recovery procedure
Affected Products
Languages:
This article is available in the following languages:
GermanEnglish United States
Spanish Spain
México - Español
French
Italian
Japanese
Korean
Dutch
Portuguese Brasileiro
Chinese Simplified
Chinese Traditional
