Lightshot Snapshot

Introduction to Gaia Lightshot Snapshot

Each Regular Gaia Snapshot and each Scheduled Gaia Snapshot requires significant disk space (more than 12 gigabytes on a Security Gateway, more than 30 gigabytes on a VSX Gateway). It takes a long time to create these Gaia Snapshots.

Starting in R82, Gaia OS has an additional feature - Lightshot Snapshot. This snapshot type saves only the delta of the disk partition. As a result, it takes less disk space and less time to create each Lightshot Snapshot. The smaller the delta between the current state of the disk partition and the previous Lightshot Snapshot, the less disk space and less time are required.

Item

Lightshot Snapshot

Regular Gaia Snapshot,

Scheduled Gaia Snapshot

Required disk space for each snapshot

Small.

Large.

Required time to create each snapshot

Short.

Long.

Required disk partition to store each snapshot

Uses one disk partition for all snapshots:

/mnt/lightshot

Creates a dedicated disk partition for each snapshot.

Deleting an existing snapshot

You can delete snapshots only in the order they were created (from the latest to the earliest).

You can delete any snapshot in any order.

Exporting a new snapshot

Supported over the SSH protocol.

Supported over the FTP protocol and the SCP protocol.

Importing an existing snapshot

Supported over the SSH protocol.

Supported over the FTP protocol and the SCP protocol.

Scheduling a snapshot

Must use the Gaia Job Scheduler to run the Expert mode command "lightshot".

See Job Scheduler.

Supported directly in Gaia OS.

Notes:

  • Some Lightshot CLI features are different in Gaia Clish / Gaia gClish and in the Expert mode.

  • To create a Gaia Lightshot Snapshot and upload it to a remote server, the remote server must run a Linux OS with the "rsync" package version 3.0.9 or higher. This also applies to the download of a Gaia Lightshot Snapshot from a remote server.

Lightshot Syntax in Gaia Clish / Gaia gClish

On Scalable Platforms, you must run the applicable commands in Gaia gClish of the applicable Security Group.

add lightshot name <Name of Snapshot> description "<Text>" [target ssh ip <IP Address> username <Username> password <Password>] [force]

set lightshot

      configuration

            savelogs

                  state {enabled | disabled}

                  verbosity {0 | 1 | 2 | 3}

      import name <Name of Snapshot> target ssh ip <IP Address> username <Username> password <Password>

      restore

            callback

            name <Name of Snapshot>

show

      lightshot

            configuration

                  savelogs

      lightshot-partition

            available-space

            required-space

            size

            used-space

      lightshots

            [target ssh ip <IP Address> username <Username> password <Password>]

            [verbose]

delete lightshot name <Name of Snapshot>

      [force]

      [target ssh ip <IP Address> username <Username> password <Password>]

Parameter

Description

add lightshot <Parameters>

Creates a new lightshot snapshot.

  • name <Name of Snapshot>

    Specifies the name of the snapshot (without spaces).

  • description "<Text>"

    Specifies the description text for this snapshot.

  • target ssh <Parameters>

    Specifies the remote server.

  • force

    Forces the update of an existing snapshot file.

Note - The command uses this default path:

/var/log/lightshot/

set lightshot configuration <Parameters>

Configures the lightshot snapshot settings.

  • configuration savelogs state {enabled | disabled}

    When you remove a Security Group Member from its Security Group , it restores itself to factory defaults.

    By default, the Security Group Member does not save any logs before this action.

    You can configure the Security Group Member to save various log files before it leaves the Security Group.

    This is useful for troubleshooting.

  • configuration savelogs verbosity {0 | 1 | 2 | 3}

    Configures the log verbosity level:

    • 0 - General Logs (this is the default) - output of the "cpdata_collector -r" command (sk164414)

    • 1 - General Logs and Outputs of Commands

    • 2 - General Logs and Outputs of Commands, and HCP report

    • 3 - General Logs, Outputs of Commands, HCP report, CPView Database, and CPInfo

set lightshot import <Parameters>

Imports the lightshot snapshot from a remote server to this Gaia server.

When importing a lightshot from a remote server, the local lightshot partition will be adjusted according to the lightshot being imported.

set lightshot restore <Parameters>

Restores an existing local lightshot snapshot on this Gaia server.

  • callback

    Deletes the registered request to restore a local lightshot snapshot during the next reboot.

    This command works only if you did not reboot the Gaia server yet.

  • name <Name of Snapshot>

    Specifies the name of the snapshot.

Notes:

  • You can restore a Lightshot Snapshot only on the same Check Point Appliance, on which you created it.

  • You must make sure that the size of the Lightshot partition equals, at a minimum, to the size of the local snapshot you need to restore.

  • After restoring to a lightshot snapshot, all local lightshots will be deleted from the the Security Gateway.

show lightshot configuration <Parameters>

Shows the lightshot configuration for logs.

  • configuration savelogs

    Shows the log state and log verbosity level.

show lightshot-partition <Parameters>

Shows the information about the Lightshot partition.

  • available-space

  • required-space

  • size

  • used-space

show lightshots <Parameters>

Shows all existing lightshot snapshots (Name, Description, Date and Time).

  • target ssh <Parameters>

    Shows all existing lightshot snapshots on the remote server.

  • verbose

    Also shows the snapshot size (this output can take some time).

delete lightshot <Parameters>

Deletes an existing lightshot snapshot.

  • name <Name of Snapshot>

    Specifies the name of the snapshot.

  • target ssh <Parameters>

    Deletes an existing lightshot snapshot on the remote server.

  • force

    Forces the deletion of an existing snapshot file.

target ssh <Parameters>

Specifies the remote server.

This server must be reachable over the SSH protocol.

  • ip <IP Address>

    Specifies the IP address of a remote server.

  • username <Username>]

    Specifies the username for an SSH connection.

    This username must have root permissions.

  • password <Password>

    Specifies the password for an SSH connection.

Lightshot Syntax in the Expert mode

On Scalable Platforms, you must run the applicable commands in the Expert mode on the applicable Security Group.

The log file for this command: /var/log/lightshot.log

lightshot -h

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      callback

            -h

            update-token

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      clone

            -h

            --reboot

            --ssh-mode

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      create

            -h

           [--descr "<Text>"]

           [--force]

           [<Name of Snapshot>]

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      delete

            -h

           [--fcd]

           [--force]

           [--keep <Number>]

           [<Name of Snapshot>]

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      expert

            -h

            mount

            show-token

            umount

            update-token

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      import

            -h

           [<Name of Snapshot>]

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      restore

            -h

           [--fcd]

           [--now]

           [--reboot]

           [<Name of Snapshot>]

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      set

            -h

            configuration

                  -h

                  state {enabled | disabled}

                  verbosity {0 | 1 | 2 | 3}

lightshot [--ip <IP Address> [--username <Username>] [--pswd <Password>]] [--format {txt | json | yaml}

      show

            -h

            configuration

                  -h

                  savelogs

            diff

                  -h

                  <Name of Snapshot 1> <Name of Snapshot 1>

            partition

                  -h

                  [--filter <Parameter>]

            snapshot

                  -h

                  [--name <Name of Snapshot>]

            snapshots

                  -h

                  [--verbose]

Parameter

Description

-h

Shows the built-in help.

--ip <IP Address

Specifies the IP address of a remote server.

This IP address must be reachable over the SSH protocol.

  • --username <Username>]

    Specifies the username for an SSH connection.

    This username must have root permissions.

  • --pswd <Password>

    Specifies the password for an SSH connection.

--format {txt | json | yaml}

Specifies the output format:

  • txt - Plain text (this is the default)

  • json - JSON

  • yaml - YAML

lightshot callback

Deletes the registered request to restore a lightshot snapshot (with the "lightshot restore" sub-command) during the next reboot.

This command works only if you did not reboot the Gaia server yet.

lightshot clone <Parameters>

Clones the lightshot snapshot from a remote server to this Gaia server.

  • --ssh-mode

    Forces to use the SSH protocol.

  • --reboot

    Forces to reboot after the cloning.

These parameters are mandatory for this sub-command:

--ip <IP Address> [--username <Username>] [--pswd <Password>]

lightshot create <Parameters>

Creates a new lightshot snapshot.

You can specify a remote server.

  • --descr "<Text>"

    Specifies the description for this snapshot.

  • --force

    Forces the update of an existing snapshot file.

  • <Name of Snapshot>

    Specifies the name of the snapshot (without spaces).

Note - The command uses this default path:

/var/log/lightshot/

lightshot delete <Parameters>

Deletes an existing local lightshot snapshot.

  • --fcd

    Forces the deletion of an entire partition.

  • --force

    Forces the deletion of an existing local snapshot file.

  • --keep <Number>

    Configures the number of last snapshots to keep.

    In the last parameter "<Name of Snapshot>", you can enter a string to filter for snapshots, whose name contains this string.

  • <Name of Snapshot>

    Specifies the name of the snapshot.

lightshot expert <Parameters>

Expert sub-commands:

  • mount

  • show-token

  • umount

  • update-token

lightshot import <Parameters>

Imports the lightshot snapshot from a remote server to this Gaia server.

  • <Name of Snapshot>

    Specifies the name of the snapshot.

These parameters are mandatory for this sub-command:

--ip <IP Address> [--username <Username>] [--pswd <Password>]

lightshot restore <Parameters>

Restores an existing lightshot snapshot on this Gaia server.

  • --fcd

    Forces the restoration of an entire partition.

  • --now

    Forces the immediate restoration.

  • --reboot

    Forces the restoration after a reboot.

  • <Name of Snapshot>

    Specifies the name of the snapshot.

Notes:

  • You can restore a lightshot snapshot only on the same Check Point Appliance, on which you created it.

  • You must make sure that the size of the lightshot partition equals, at a minimum, to the size of the local snapshot you need to restore.

lightshot set <Parameters>

Configures the lightshot snapshot settings.

  • configuration savelogs state

    Enables or disables (this is the default) the saving of the logs state.

  • configuration savelogs verbosity {0 | 1 | 2 | 3}

    Configures the log verbosity level:

    • 0 - General Log (this is the default)

    • 1 - General Log, and Commands

    • 2 - General Log, Commands, and HCP

    • 3 - General Log, Commands, HCP, CPInfo, and CPviewDB

lightshot show configuration <Parameters>

Shows the lightshot configuration for logs.

  • configuration savelogs

    Shows the log state and log verbosity level.

lightshot show diff <Parameters>

Compares two specified local lightshot snapshots.

lightshot show partition <Parameters>

Shows the information about the Lightshot partition.

  • partition --filter <Parameter>

    Shows only the specified parameter:

    • available

    • mount-on

    • required-space

    • size

    • used

lightshot show snapshot <Parameters>

Shows the specified existing local lightshot snapshots (Name, Description, Date and Time).

lightshot show snapshots <Parameters>

Shows all existing local lightshot snapshots (Name, Description, Date and Time).

  • snapshots --verbose

    Also shows the snapshot size (this output can take some time).

Target Profiles for Lightshot Snapshots

Overview:

Lightshot supports reusable target profiles for storing snapshots on a remote server that runs on the Linux operating system.

A target profile defines the connection parameters to the snapshot destination.

You can create multiple target profiles and reuse them when creating Lightshot snapshots.

  • Reusable target profiles for remote snapshot storage.

  • Remote targets use SSH connections.

  • These authentication methods are supported:

    • SSH key authentication (when no password is entered).

    • Password supplied directly in the command.

    • Interactive password prompt (the entered password does not appear on the screen).

Workflow:

  1. Create a target profile.

  2. Create a lightshot snapshot using this target profile.

Managing the target profiles:

add lightshot target-profile name <Name of New Profile> description "<Text>" target ssh ip <IP Address of Remote Server> username <Username on Remote Server> [password <Password on Remote Server> | password-hidden] [lightshots-path <Path to Directory>]

Parameters:

Parameter

Description

name <Name of Profile>

Specifies the name of the target profile.

Note - Requirements for a target profile name:

  • Upper-case letters (A–Z)

  • Lower-case letters (a–z)

  • Digits (0–9)

  • Underscore (_)

  • Minus (-)

  • Period (.)

description "<Text>"

Specifies the description text for the target profile.

Note - Requirements for a description text:

  • Upper-case letters (A–Z)

  • Lower-case letters (a–z)

  • Digits (0–9)

  • Underscore (_)

  • Minus (-)

  • Space ( )

ip <IP Address of Remote Server>

Specifies the IP address of the remote SSH server.

username <Username on Remote Server>

Specifies the username to authenticate on the remote server.

Note - Requirements for a username:

  • This username must have root permissions.

  • Maximum length is 32 characters.

  • Must start with a letter or underscore.

  • Remaining characters can include:

    • Upper-case letters (A–Z)

    • Lower-case letters (a–z)

    • Digits (0–9)

    • Underscore (_)

    • Minus (-)

password <Password on Remote Server>

Specifies the password to authenticate on the remote server.

Note - If you do not specify a password, the system uses SSH key authentication.

password-hidden

Prompts for password to authenticate on the remote server.

The entered password characters do not appear on the screen.

Note - If you do not enter a password, the system uses SSH key authentication.

lightshots-path <Path to Directory>

Specifies the base folder on a remote server.

Notes:

  • Requirements for a base folder on a remote server:

    • Must be an absolute Linux path.

    • Upper-case letters (A–Z)

    • Lower-case letters (a–z)

    • Digits (0–9)

    • Underscore (_)

    • Minus (-)

    • Period (.)

    • Forward slash(/)

  • If you do not specify this path, then the command uses this default path:

    /var/log/lightshot/

show lightshot target-profiles

Example output:

Name Username Hostname Target Description Lightshots Path
Server_1 admin1 192.168.3.61 ssh Backup - weekly /var/log/lightshot_weekly_MySG
Server_2 admin2 172.23.52.84 ssh Backup - monthly /var/log/lightshot_monthly_MySG

delete lightshot target-profile name <Name of Existing Profile>

Warning - After you delete a target profile, it is not possible to view lightshot snapshots that were created using this specific target profile.

To view those lightshot snapshots again, you must configure a target profile for the same remote server again.

Using the target profiles:

add lightshot name <Name of Snapshot> description "<Text> target-profile <Name of Existing Profile>

Note - Requirements for a snapshot name:

  • Upper-case letters (A–Z)

  • Lower-case letters (a–z)

  • Digits (0–9)

  • Underscore (_)

  • Minus (-)

show lightshots target-profile <Name of Existing Profile>

Note - A target profile for the remote server must exist.

Exporting the configuration of existing target profiles

Notes:

  • Passwords are removed from the configuration when it is printed on the screen (they appear as ****).

  • The commands below show the Gaia Clish commands that you can save and use later:

    • To restore the required target profiles.

    • To configure the same target profiles on another Gaia server.

show configuration lightshot target-profiles

show configuration lightshot target-profile name <Name of Profile>