Remotely Backing Up Logs to an OBS Bucket

Scenarios

To enhance data disaster recovery management and improve audit data security and system scalability, you can back up configuration logs on an Object Storage Service (OBS) bucket.

If you enable remote backup to an OBS bucket, the system automatically backs up logs of the previous day at 00:00 every day, generates log files, and uploads the backup files to the corresponding folder in the OBS bucket. To back up the logs of a certain day immediately, you can manually start the backup to the OBS bucket.

Billing

If you store logs in an OBS bucket through remote backup, OBS will charge you for the storage. For details, see OBS Billing.

Types of Logs That Can Be Backed Up

Table 1 lists the types of logs that can be backed up to an OBS bucket.

Notes and Constraints

• To back up system configuration data during auto backup, you need to enable auto backup for system configuration first. To do so, choose System > System Maintain > Backup&Restore > Config Backup and enable auto backup. Otherwise, no system configuration data will be backed up.
• During manual backup, your system configuration data is not backed up.

Prerequisites

• The role you belong to has the management permission for the System module. For details about how to check the permissions of each role, see Role.

• You have created an OBS bucket, and the network between the OBS bucket and your bastion host is normal. For details, see Creating a Bucket.

Enabling Auto Backup to an OBS Bucket

After remote backup to an OBS bucket is enabled and the connectivity test is successful, the system automatically backs up logs of the previous day at 00:00 every day and uploads the logs to the remote OBS bucket.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose System > Data Maintain > Log Backup to go to the log backup management page.
3. On the right of the Remote Backup To OBS area, click Edit. In the displayed dialog box, configure bucket parameters.

   Table 2 Parameters for remote backup to OBS

   Parameter	Description
   Status	Whether to back up logs to an OBS bucket. This function is disabled by default. : Backing up logs to OBS buckets is enabled. The system automatically starts backup at 00:00 every day. : Backing up logs to OBS buckets is disabled.
   Access Key ID	Access key ID, which is used to verify the identity of the request sender for accessing the OBS bucket. An access key ID is a unique identifier associated with a secret access key and is used together with the secret access key to sign requests cryptographically. For details about how to obtain an access key, see Access Keys.
   Secret Access Key	Secret access key, which is used together with the access key ID. A secret access key works as a cryptographic signature to identify the sender of a request and prevent the request from being tampered with.
   EndPoint	Region where the bucket is located. For details about how to obtain the OBS endpoint of the region, see Viewing Bucket Information.
   Bucket	Bucket name.
   Path	Bucket path or bucket folder path. The path cannot contain three or more consecutive slashes (/). If the OBS bucket does not have the corresponding path, a folder is automatically generated in the bucket. Example: cbh/bastion/test/01
   Test connectivity	Tests whether the network between your bastion host and the configured OBS bucket is reachable. The connectivity test checks only the network status between the bastion host and the OBS bucket.
   Backup Content	Type of logs to be backed up. Select at least one type. For details about supported types, see Types of Logs That Can Be Backed Up.
   Encryption password	Enter the encryption password of the backup file. This parameter is mandatory when System Config is selected for Backup Content. The password must contain 8 to 32 characters; contain at least three types of the following characters: uppercase letters, lowercase letters, digits, and special characters !@$%^-_=+[{}]:,./?~#*; and contain only the allowed characters listed above.
   User password	Enter the login password of the current user. This parameter is mandatory when System Config is selected for Backup Content.

4. Click OK. You can then view the backup information on the Log Backup tab.

Manually Backing Up Data to an OBS Bucket

After configuring an OBS bucket, you can manually start an immediate backup task to back up logs of a certain day to the bucket. During manual backup, your system configuration data is not backed up by default.

1. Log in to your bastion host system.
2. In the navigation pane on the left, choose System > Data Maintain > Log Backup to go to the log backup management page.
3. In the Remote Backup To OBS area, select a backup date and click Backup.
   Figure 1 Manual backup to an OBS bucket
   

Follow-up Operations

• To disable OBS bucket backup, click Edit. In the displayed dialog box, set Status to Disabled.
• To view or download logs backed up to the OBS bucket, log in to the OBS console and perform operations in the corresponding bucket folder.
• To play video recordings backed up to an OBS bucket, download them and use a local player to play them back. For details, see Playing a Historical Session Video Recording Locally.