M86 Security M86 IR Enterprise Reporter, User Manual

Page: 33 / 110

A
DMINISTRATOR
S
ECTION
C
HAPTER
2: C
ONFIGURING THE
ER S
ERVER
M86 S
ECURITY
U
SER
G
UIDE
27
Although automatic backups to a local ER hard drive are
scheduled nightly by default, it is important that the ER
administrator implements a backup policy to ensure data
integrity and continuity in the event of any possible failure
scenario. This policy should include frequent, remote
backups, such that raw logs and ER database files are avail-
able for restoration without relying on the ER’s hard drives.
In general, recovery plans involve (i) restoring the most
recent backup of the database, and (ii) restoring raw logs to
fill in the gap between the most recent backup of the data-
base, and the current date and time.
Some scenarios and action plans to consider include the
following:
• The ER database becomes corrupted - Correct the
root problem. Restore the database from the most recent
ER backup, and reprocess raw logs up to the current
date and time.
• The data drive fails - Replace the data drive. Restore
the database from the ER backup drive, and reprocess
raw logs up to the current date and time.
• The backup drive fails - Replace the backup drive, and
perform a manual backup.
• Both data and backup drives are damaged - Restore
the database from the most recent remote backup, and
reprocess raw logs up to the current date and time.
As you can see, it is critical that raw logs are available to
bridge the gap between the last database backup and the
present time, and more frequent backups (local and remote)
result in less “catch-up” time required for reprocessing raw
logs.