Configuring Scheduled Backups

Important:

When you create a backup on a Management Server, make sure to close all SmartConsole clients. Otherwise, scheduled backup does not start.
Maestro Security Groups that contain different Security Appliance models do not support Gaia Backup operations (in the Global Gaia Portal or Global Gaia Clish).

To collect or import a Gaia Backup in such a Security Group, connect directly to Gaia Portal or Gaia Clish on each Security Appliance in the Security Group.
You can configure only one schedule for one location. For example, you can configure only one schedule for an SCP server, and only one schedule for an FTP server.
For regular backups, see Backing Up and Restoring the System.

Note - Gaia Operating System uses this template for the name of a scheduled backup output file regardless of the Gaia Display Format for Time and Date:

backup_-<Name_of_Scheduled_Backup>-_<HostName>.<Domain>_<YYYY>_<MM>_<DD>_<HH>_<MM>_<SS>.tgz

Example for 20 May 2024, 18:04:43:

backup_-MyDailyBkp-_MyGW.MyDomain.com_2024_May_20_18_04_43.tgz

Note - In addition to the scheduled backup file, the Gaia Operating System also creates a file with the required metadata. If you later need to upload this scheduled backup file to Check Point cloud (for example, Zero Touch), then you also have to upload this metadata file. The Gaia Operating System uses this template for the name of a scheduled backup metadata file regardless of the Gaia Display Format for Time and Date (the same file name as the scheduled backup file, with a different file extension):

backup_-<Name_of_Scheduled_Backup>-_<HostName>.<Domain>_<YYYY>_<MM>_<DD>_<HH>_<MM>_<SS>.info

Example for 20 May 2024, 18:04:43:

backup_-MyDailyBkp-_MyGW.MyDomain.com_2024_May_20_18_04_43.info

Configuring Scheduled Backups in Gaia Portal

Important - On Scalable Platforms (ElasticXL, Maestro, and Chassis), you must connect to the Gaia Portal of the applicable Security Group.

Watch the Video

Adding a scheduled backup

Step

Instructions

In the navigation tree, click Maintenance > System Backup.

Refer to the Scheduled Backup section.

Click Add Scheduled Backup.

In the Backup Name field, enter the name of the job.

The maximum length is 15 characters.
The name can consist only of letters, numbers, or underscore "_".

In the Backup Type section, configure the location of the backup file:

This appliance

To keep the collected backup locally in the /var/log/CPbackup/backups/ directory.

Management

To send the collected backup to the Management Server that manages this Security Gateway.

Enter the Username and Password for the applicable SCP user.

The Security Gateway (or Cluster Member) uploads the file to the /home/<username>/ directory on the Management Server.

Important - Follow sk164234 to configure the Security Gateway (or Cluster Member) as a trusted host on the Management Server.

Private server:

In the Protocol field, select the server type.

FTP

To send the collected backup to an FTP server.

Enter the IPv4 address, Username, Password, and Upload path.

Important -The username must have permissions to delete files on the FTP server.

TFTP

To send the collected backup to a TFTP server.

Enter the IPv4 address.

SCP

To send the collected backup to an SCP server.

Enter the IPv4 address, Username, Password, and Upload path.

Important:

First, you must follow sk164234 to configure the SCP server as a trusted host on Gaia.
The username must have permissions to delete files on the SCP server.

Cloud storage

In the Cloud type field, select the cloud vendor.
- Amazon S3
  
  To send the collected backup to your Amazon S3 bucket.
  
  Enter the S3 Region, S3 Bucket Name, Upload Path, S3 Access Key, and S3 Secret Access Key.
- Azure Storage
  
  To send the collected backup to your Microsoft Azure storage container.
  
  Enter the Storage Account, Storage Container, Shared Access Signature (SAS) Token, and Upload Path.

In the Backup Schedule section, configure the frequency for this backup (Daily, Weekly, Monthly, Minute Interval, Hourly).

Optional: In the Retention Policy section, configure the backup retention policy:

In the Maximum backups to keep field, configure the maximum number of backup files to save.

If the new backup files exceeds this number, then Gaia deletes the oldest backup file.
In the Maximum disk space to be used (in MB) field, configure the amount of free disk space to maintain at all times.

If the new backup files exceeds this number, then Gaia does not create the new backup file.

Important:

These settings apply only to the new backup files (and do not apply to existing backup files).
If the job creates a new backup file, it deletes the oldest existing backup file.
The scheduled backup job stops, if Gaia cannot meet the configured retention policy.

For example, the disk space limit is not enough to create a new backup file, and the minimum number of backup files does not allow to delete the existing backup files.

In this case, Gaia does not show a notification.

An administrator must manually check why Gaia did not create the new backup file.
These settings do not support a job that uploads a backup file to a TFTP server because TFTP servers cannot delete files.
These settings apply only to scheduled backup files configured and created in R82 version.

Click Add.

The scheduled backup appears in the Scheduled Backups table.

Deleting a scheduled backup

Step	Instructions
1	In the navigation tree, click Maintenance > System Backup. Refer to the Scheduled Backup section.
2	Select the backup to delete.
3	Click Delete.

Step

Instructions

In the navigation tree, click Maintenance > System Backup.

Refer to the Scheduled Backup section.

Select the backup to delete.

Click Delete.

Configuring Scheduled Backups in Gaia Clish

Important - On Scalable Platforms (ElasticXL, Maestro, and Chassis), you must run the applicable commands in Gaia gClish of the applicable Security Group.

Syntax

add backup-scheduled name <Name of Schedule>

aws region <AWS S3 Region> bucket <AWS S3 Bucket> path <Path in AWS S3 Bucket> access-key <AWS S3 Access Key> secret-access-key <AWS S3 Secret Access Key>

azure storage <Azure Storage> container <Azure Container> path <Path in Azure Container> sas-token <Azure SAS Token>

ftp path <Path on FTP Server> ip <IPv4 Address of FTP Server> username <Username on FTP Server> {password <Password in Plain Text> | internal <Password>}

local

management username <SCP Username on Management Server> password <Password in Plain Text>

scp path <Path on SCP Server> ip <IPv4 Address of SCP Server> username <Username on SCP Server> {password <Password in Plain Text> | internal <Password>}

tftp ip <IPv4 Address of TFTP Server>

set backup-scheduled name <Name of Schedule> recurrence

daily time <HH:MM>

hourly hours {<Hours> | all} at <0-59>

interval minutes <1-59>

monthly month {<Months> | all} days <Days> time <HH:MM>

weekly days {<Days> | all} time <HH:MM>

set backup-scheduled name <Name of Schedule> retention-policy

keep-occupied-disk-space-in-MB {<Disk Space> | 0}

max-backups-to-keep {<Number> | 0}

min-backups-to-keep {<Number> | 0}

show backup-scheduled <Name of Schedule>

delete backup-scheduled <Name of Schedule>

Procedure

Configure the backup retention policy

Configure the amount of free disk space to maintain:

set backup-scheduled name <Name of Schedule> retention-policy keep-occupied-disk-space-in-MB {<Disk Space> | 0}

Configure the maximum number of backup files to save:

set backup-scheduled name <Name of Schedule> retention-policy max-backups-to-keep {<Number> | 0}

Configure the minimum number of backup files to save:

set backup-scheduled name <Name of Schedule> retention-policy min-backups-to-keep {<Number> | 0}

Important - After you add, configure, or delete features, run the "save config" command to save the settings permanently. Scalable Platforms save the changes automatically.

Parameters

Parameter

Description

name <Name of Schedule>

Defines the name of the scheduled backup:

The maximum length is 15 characters.
The name can consist only of letters, numbers, or underscore "_".

local

Keeps the backup file locally on this Security Gateway (or Cluster Member).

Gaia keeps the file in the /var/log/CPbackup/backups/ directory.

management username <SCP Username on Management Server> password <Password in Plain Text>

Uploads the backup file over SCP to the Management Server that manages this Security Gateway.

The Security Gateway (or Cluster Member) uploads the file to the /home/<username>/ directory on the Management Server.

Important - Follow sk164234 to configure the Security Gateway (or Cluster Member) as a trusted host on the Management Server.

ftp ip <IPv4 Address of FTP Server>

Specifies the IPv4 address of the remote FTP server.

scp ip <IPv4 Address of SCP Server>

Specifies the IPv4 address of the remote SCP server.

Important - First, you must follow sk164234 to configure the SCP server as a trusted host on Gaia.

tftp ip <IPv4 Address of TFTP Server>

Specifies the IPv4 address of the remote TFTP server.

path <Path on FTP Server>

Specifies the path on the remote FTP server where to upload the backup file.

path <Path on SCP Server>

Specifies the path on the remote SCP server where to upload the backup file.

path <Path in AWS S3 Bucket>

Specifies the path AWS S3 Bucket where to upload the backup file.

path <Path in Azure Container>

Specifies the path Azure Container where to upload the backup file.

username <Username on FTP Server>

Specifies the username required to log in to the remote FTP server.

Important - The username must have permissions to delete files on the FTP server.

username <Username on SCP Server>

Specifies the username required to log in to the remote SCP server.

Important - The username must have permissions to delete files on the SCP server.

password <Password in Plain Text>

Specifies the password (in plain text) required to log in to the remote server.

region <AWS S3 Region>

Specifies the Amazon S3 Region.

bucket <AWS S3 Bucket>

Specifies the Amazon S3 Bucket.

access-key <AWS S3 Access Key>

Specifies the Amazon S3 Access Key.

secret-access-key <AWS S3 Secret Access Key>

Specifies the Amazon S3 Secret Access Key.

storage <Azure Storage>

Specifies the Microsoft Azure Storage Account.

container <Azure Container>

Specifies the Microsoft Azure Container.

sas-token <Azure SAS Token>

Specifies the Microsoft Azure Shared Access Signature (SAS) Token.

recurrence daily time <HH:MM>

Specifies that the job must run once a day - each day, at specified time.

Enter the time of day in the 24-hour clock format - <Hours>:<Minutes>.
Example:

HostName> set backup-scheduled name MyBackup recurrence daily time 14:35

HostName> show backup-scheduled MyBackup

The scheduled backup is performed locally.

Every day at 14:35

recurrence hourly hours {<Hours> | all} at <Minutes 0-59>

Specifies that the job must run many times during the day - at the specified time.

You can specify a single hour of a day by a number from 0 to 23.
You can specify several hours of a day.

Enter the hours separated by commas.

Example - for hours 14, 15, and 16, enter: 14,15,16
To specify each hour of a day, enter: all
You must specify the minutes of each configured hour by a number from 0 to 59.

Example:

HostName> set backup-scheduled name MyBackup recurrence hourly hours 14,15,16 at 35

HostName> show backup-scheduled MyBackup

The scheduled backup is performed locally.

Every day at 14:35,15:35,16:35

recurrence interval minutes <1-59>

Specifies that the job must run many times during the day - at intervals of the specified number of minutes.

Example:

HostName> set backup-scheduled name MyBackup recurrence interval minutes 30

HostName> show backup-scheduled MyBackup

The scheduled backup is performed locally.

Every 30 minutes.

recurrence monthly month {<Months> | all} days <Days> time <HH:MM>

Specifies that the job must run once a month - on the specified months, on the specified dates, and at the specified time.

Specify the months by numbers from 1 to 12:

January = 1, February = 2, ..., December = 12.
To specify several months, enter their numbers separated by commas.

Example - for January, February, and March, enter: 1,2,3
To specify each month of the year, enter: all
Specify the dates of a month by numbers from 1 to 31.
To specify several dates, enter their numbers separated by commas.

Example - for 1st, 2nd and 3rd day of month, enter: 1,2,3

Example:

HostName> set backup-scheduled name MyBackup recurrence monthly month 1,2,3 days 1,2,3 time 14:35

HostName> show backup-scheduled MyBackup

The scheduled backup is performed locally.

Each January, February, March on days 1, 2, 3 at 14:35

recurrence weekly days {<Days> | all} time <HH:MM>

Specifies that the job must run once a week - on specified days of week, and at specified time.

Specify the days of a week by numbers from 0 to 6:

Sunday = 0, Monday = 1, Tuesday = 2, Wednesday = 3, Thursday = 4, Friday = 5, Saturday = 6.
To specify several days of a week, enter their numbers separated by commas.

Example- for Sunday, Monday, and Tuesday, enter: 0,1,2
To specify each day of the week, enter: all

Example:

HostName> set backup-scheduled name MyBackup recurrence weekly days 1,3 time 14:35

HostName> show backup-scheduled MyBackup

The scheduled backup is performed locally.

Every week on Monday, Wednesday at 14:35

retention-policy <Options>

Specifies how much disk space the backup files can take and how many backup files to keep on Gaia:

retention-policy keep-occupied-disk-space-in-MB {<Disk Space> | 0}

Specifies how many much disk space (in megabytes) the existing backup files can take on Gaia.
retention-policy max-backups-to-keep {<Number> | 0}

Specifies how many backup files to keep on Gaia at maximum.

If the job creates a new backup file, it deletes the oldest existing backup file.

The value for maximum number of backup files to keep must be greater than the value for minimum number of backup files.
retention-policy min-backups-to-keep {<Number> | 0}

Specifies how many backup files to keep on Gaia at minimum.

Notes:

Each of these retention policy settings is optional.
These settings apply only to the new backup files (and do not apply to existing backup files).
To change the current configuration, run the command again with a new value.
To disable this configuration, run the command again with the value 0 (zero).
If the job creates a new backup file, it deletes the oldest existing backup file.
If the job uploads a backup file to a remote server, the username must have permissions to delete files on the remote server.
The scheduled backup job stops, if Gaia cannot meet the configured retention policy.

For example, the disk space limit is not enough to create a new backup file, and the minimum number of backup files does not allow to delete the existing backup files.

In this case, Gaia does not show a notification.

An administrator must manually check why Gaia did not create the new backup file.
These settings do not support a job that uploads a backup file to a TFTP server because TFTP servers cannot delete files.
These settings apply only to scheduled backup files configured and created in R82 version.

Examples

Creating a daily backup file as a local LVM volume:

gaia> add backup-scheduled name Daily local

gaia>

gaia> set backup-scheduled name Daily recurrence daily time 22:00

gaia>

gaia> set backup-scheduled name Daily retention-policy keep-occupied-disk-space-in-MB 50000

gaia>

gaia> set backup-scheduled name Daily retention-policy max-backups-to-keep 10

gaia>

gaia> set backup-scheduled name Daily retention-policy min-backups-to-keep 3

gaia>

gaia> show backup-scheduled Daily

The scheduled backup is performed locally.

Retention-policy:

max-backups-to-keep 10

min-backups-to-keep 3

keep-occupied-disk-space-in-MB 50000

Every day at 22:00

gaia>

gaia> save config

Creating a monthly snapshot image as a file and uploading it to an SCP server:

gaia> add backup-scheduled name Monthly ftp ip 192.168.20.30 path /var/log/my_backups/ username backup_user password 123456

gaia>

gaia> set backup-scheduled name Monthly recurrence monthly month all days 1 time 22:00

gaia>

gaia> show backup-scheduled Monthly

The scheduled backup is performed to an ftp server.

IP: 192.168.20.30

Username: backup_user

Every month on day 1 at 22:00

gaia>

gaia> save config

Troubleshooting

Examine the location of the backup file.

Examine the /var/log/messages files.