> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/siem/how-can-i-create-an-external-backup-of-my-raw-logs-in-the-enginsight-siem.md).

# How can I create an external backup of my raw logs in the Enginsight SIEM?

The Enginsight SIEM component Loggernaut currently supports two backup strategies for automatically backing up raw logs in addition to local storage on the SIEM Management Server:

* [SFTP backup](#sftp-backup-without-encryption): In addition to being stored locally on the SIEM Management Server, the raw logs are also stored on an SFTP (Secure File Transfer Protocol) server.
* [S3 backup](#s3-backup-without-encryption): In addition to being stored locally on the SIEM Management Server, the raw logs are also stored in Amazon S3.

***

## SFTP Backup (Without Encryption)

Store the raw logs on an SFTP server in addition to storing them locally on the SIEM Management Server.

To do so, complete the following steps:

{% stepper %}
{% step %}

### Open the Loggernaut configuration file

1. Log in to the **SIEM Management Server** or to the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

3. Navigate to the `backup` section:

```
{    
    "api": {...},
    "siem": {...},
    ...,
    "backup": {
        "strategy": "",
        ...
        }
}
```

{% endstep %}

{% step %}

### Adjust the `strategy` parameter

Adjust the `strategy` parameter. This parameter defines how Loggernaut handles backups.

The following values are available:

<table><thead><tr><th width="199.77734375">Value</th><th>Description</th></tr></thead><tbody><tr><td><code>local</code></td><td>Raw logs are stored only locally on the SIEM Management Server.</td></tr><tr><td><code>remove</code></td><td>Raw logs are deleted after the log retention period (TTL; Time-to-Live) has expired.</td></tr><tr><td><code>sftp</code></td><td>Raw logs are transferred to an SFTP server in addition to being stored on the SIEM Management Server.</td></tr><tr><td><code>s3</code></td><td>Raw logs are transferred to Amazon S3 storage in addition to being stored on the SIEM Management Server.</td></tr></tbody></table>

Set the parameter as follows:

<pre><code>"backup": {
<strong>        "strategy": "sftp",
</strong>        ...
        }
</code></pre>

{% endstep %}

{% step %}

### Adjust the `sftp` parameter

Adjust the `sftp` parameter, including SFTP-specific fields and SSH credentials.

#### SFTP-specific fields

Enter the appropriate values for the highlighted, SFTP-specific parameters.

<pre><code>"backup": {
        "strategy": "sftp",
<strong>        "sftp": {
</strong><strong>            "permissions": "",
</strong><strong>            "remoteDirectory": "",
</strong><strong>            "keepLocalCopy": ,
</strong>            "ssh": {
            ...
            }
        }
    }
</code></pre>

<table><thead><tr><th width="200.06640625">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>permissions</code></td><td><p>Set Unix-style permissions for log files.</p><p><br>For example, to grant all users read and write access, enter the value <code>0666</code> .</p></td></tr><tr><td><code>remoteDirectory</code></td><td><p>Enter the path to the target directory on the SFTP server where the log backups should be stored.</p><div data-gb-custom-block data-tag="hint" data-style="danger" class="hint hint-danger"><p><strong>Please note</strong>: If the target directory is, for example, <code>/user/siem/logs</code> and the chroot (Change Root) command is set to <code>/user</code>, <code>remoteDirectory</code> must be set to <code>/siem/logs</code>!</p></div></td></tr><tr><td><code>keepLocalCopy</code></td><td><p>Define what should happen to the original logs after the TTL has been exceeded.<br><br>The following values are available:</p><ul><li><code>false</code> : All logs whose TTL has been exceeded are deleted locally from the SIEM Management Server as soon as they have been transferred to the SFTP server.</li><li><code>true</code>: A copy of the logs remains locally on the SIEM Management Server, even if the TTL has already been exceeded.</li></ul></td></tr></tbody></table>

#### SSH credentials (sftp.ssh)

Enter the appropriate values for the highlighted `ssh` parameters.

<pre><code>"backup": {
        "strategy": "sftp",
        "sftp": {
            "permissions": "",
            "remoteDirectory": "",
            "keepLocalCopy": ,
<strong>            "ssh": {
</strong><strong>                "username": "",
</strong><strong>                "password": "",
</strong><strong>                "ip": "",
</strong><strong>                "port": "",
</strong><strong>                "privateKeyPath": "",
</strong><strong>                "privateKeyPassphrase": "",
</strong><strong>                "knownHostsPath": ""
</strong><strong>            }
</strong>        }
    }
</code></pre>

<table><thead><tr><th width="198.3203125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>username</code></td><td>Enter the username for the SSH connection to the SFTP server.</td></tr><tr><td><code>password</code></td><td><p>Enter the password for the SSH connection to the SFTP server.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This field can be left empty if you use an SSH key.</p></div></td></tr><tr><td><code>ip</code></td><td>Enter the IP address of the SFTP server.</td></tr><tr><td><code>port</code></td><td><p>Enter the port for the SSH connection.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If you leave this field empty, SSH port <strong>22</strong> is used by default.</p></div></td></tr><tr><td><code>privateKeyPath</code></td><td><p>Enter the path to the private SSH key.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This field can be left empty if you use username and password for authentication.</p></div></td></tr><tr><td><code>privateKeyPassphrase</code></td><td><p>Enter the password for the private SSH key if it is encrypted.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>This field can be left empty if you use username and password or an unencrypted private SSH key for authentication.</p></div></td></tr><tr><td><code>knownHostsPath</code></td><td><p>Enter the path to the SSH <strong>known_hosts</strong> file used to verify the SFTP server.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If you leave this field empty, the host check is skipped and it is assumed that the correct SFTP server has been specified.</p></div></td></tr></tbody></table>
{% endstep %}

{% step %}

### Save the configuration changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart Loggernaut

Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***

## S3 Backup (Without Encryption)

Store the raw logs in Amazon S3 in addition to storing them locally on the SIEM Management Server.

To do so, complete the following steps:

{% stepper %}
{% step %}

### Open the Loggernaut configuration file

1. Log in to the **SIEM Management Server** or to the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

3. Navigate to the `backup` section:

```
{    
    "api": {...},
    "siem": {...},
    ...,
    "backup": {
        "strategy": "",
        ...
        }
}
```

{% endstep %}

{% step %}

### Adjust the `strategy` parameter

Adjust the `strategy` parameter. This parameter defines how Loggernaut handles backups.

The following values are available:

<table><thead><tr><th width="199.77734375">Value</th><th>Description</th></tr></thead><tbody><tr><td><code>local</code></td><td>Raw logs are stored only locally on the SIEM Management Server.</td></tr><tr><td><code>remove</code></td><td>Raw logs are deleted after the log retention period (TTL; Time-to-Live) has expired.</td></tr><tr><td><code>sftp</code></td><td>Raw logs are transferred to an SFTP server in addition to being stored on the SIEM Management Server.</td></tr><tr><td><code>s3</code></td><td>Raw logs are transferred to Amazon S3 storage in addition to being stored on the SIEM Management Server.</td></tr></tbody></table>

Set the parameter as follows:

<pre><code>"backup": {
<strong>        "strategy": "s3",
</strong>        ...
        }
</code></pre>

{% endstep %}

{% step %}

### Adjust the `s3` parameter

Enter the appropriate values for the highlighted, S3-specific parameters.

<pre><code>"backup": {
    "strategy": "s3",
<strong>    "s3": {
</strong><strong>      "endpoint": "",
</strong><strong>      "accessKeyId": "",
</strong><strong>      "accessKeySecret": "",
</strong><strong>      "bucketPrefix": "",
</strong><strong>      "region": "",
</strong><strong>      "keepLocalCopy": 
</strong>    }
  }
</code></pre>

<table><thead><tr><th width="198.3203125">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>endpoint</code></td><td><p>Enter the path to the storage location.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>The path can vary depending on the provider, but usually follows this pattern: <code>&#x3C;Region>.s3.&#x3C;HostingProvider>.com</code></p></div></td></tr><tr><td><code>accessKeyId</code></td><td>Enter the access key ID for API access.</td></tr><tr><td><code>accessKeySecret</code></td><td>Enter the access key secret for API access.</td></tr><tr><td><code>bucketPrefix</code></td><td>Amazon S3 bucket names use the following pattern: <code>&#x3C;BucketPrefix>-&#x3C;OrganisationID></code><br><br>For <code>bucketPrefix</code>, enter the first part of your S3 bucket name that appears before your organization ID.</td></tr><tr><td><code>region</code></td><td>Enter the AWS Region of the storage service.</td></tr><tr><td><code>keepLocalCopy</code></td><td><p>Define what should happen to the original logs after the TTL has been exceeded.<br><br>The following values are available:</p><ul><li><code>false</code> : All logs whose TTL has been exceeded are deleted locally from the SIEM Management Server as soon as they have been transferred to S3 storage.</li><li><code>true</code>: A copy of the logs remains locally on the SIEM Management Server, even if the TTL has already been exceeded.</li></ul></td></tr></tbody></table>
{% endstep %}

{% step %}

### Save the configuration changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart Loggernaut

Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***

## Backup With Encryption

You can optionally encrypt your backups. Loggernaut currently supports only the **AGE encryption method**.

{% hint style="info" %}
**Please note**: All organizations on a SIEM instance use the same AGE public key for encryption. There is *no organization-specific key configuration*.
{% endhint %}

Follow these steps:

{% stepper %}
{% step %}

### Generate an AGE key pair

1. Log in to the **SIEM Management Server** or to the dedicated server on which you installed the Enginsight SIEM component Loggernaut.
2. Generate the required AGE key pair using the following command:

```
sudo ./ngs-loggernaut -generate-age-keys
```

{% hint style="danger" %}
**Please note**: This command generates both a private key pair and a public key pair. For the Loggernaut configuration, you only need the public key. Store the private key in a secure location so that you can decrypt backups at a later time!
{% endhint %}

{% hint style="info" %}
A valid **AGE public key** always starts with `age` and contains only characters from `[a-z0-9]`. Example: `age1ms3c0gmdxakx3lxzlp422g78lju4pmrse0rp6jl8lpu696yvea7qttzsl0`
{% endhint %}
{% endstep %}

{% step %}

### Open the Loggernaut configuration file

1. Open the **Loggernaut configuration file** using the following command:

```
sudo nano /opt/enginsight/loggernaut/config.json
```

3. Navigate to the `backup` section:

```
{    
    "api": {...},
    "siem": {...},
    ...,
    "backup": {
        "strategy": "",
        ...
        }
}
```

{% endstep %}

{% step %}

### Add the `encryption` parameter

Add the `encryption` parameter to the configuration as shown in the highlighted lines and enter the corresponding values.

<pre><code>"backup": {
    "strategy": "...",
    ...
    },
<strong>    "encryption": {
</strong><strong>      "package": "",
</strong><strong>      "publickey": ""
</strong>    }
  }
</code></pre>

<table><thead><tr><th width="199.66015625">Parameter</th><th>Description</th></tr></thead><tbody><tr><td><code>package</code></td><td><p>Define whether you want to use encryption or explicitly disable it.<br><br>The following values are available:</p><ul><li><code>"age"</code> : AGE encryption is used.</li><li><code>"none"</code> : Encryption is explicitly disabled.</li></ul></td></tr><tr><td><code>publickey</code></td><td><p>Enter the AGE public key you generated previously.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>A valid <strong>AGE public key</strong> always starts with <code>age</code> and contains only characters from <code>[a-z0-9]</code>. Example: <code>age1ms3c0gmdxakx3lxzlp422g78lju4pmrse0rp6jl8lpu696yvea7qttzsl0</code></p></div></td></tr></tbody></table>
{% endstep %}

{% step %}

### Save the configuration changes

Save the configuration file (**Ctrl** + **o**) and confirm the save process. Close the file (**Ctrl** + **x**).
{% endstep %}

{% step %}

### Restart Loggernaut

Restart Loggernaut using the following command to apply the changes:

```
sudo systemctl restart ngs-loggernaut
```

{% endstep %}
{% endstepper %}

***