Backup copying and restoration of the Administration Server data

Data backup allows you to save the Administration Server data in a certain state, and restore the data if needed, for example, if the Administration Server data is corrupted.

Before you back up the Administration Server data, check whether a virtual Administration Server is added to the administration group. If a virtual Administration Server is added, make sure that an administrator is assigned to this virtual Administration Server before the backup. You cannot grant the administrator access rights to the virtual Administration Server after the backup. Note that if the administrator account credentials are lost, you will not be able to assign a new administrator to the virtual Administrator Server.

You can create a backup copy of the Administration Server data only by running the Backup of Administration Server data task. This task is automatically created when you deploy Kaspersky Next XDR Expert.

On the primary Administration Server, creating and removing the Backup of Administration Server data task is not available.

The backup copy is saved in the /var/spool/ksc/backup directory. The backup directory is automatically created on the worker node on which Administration Server is installed when you deploy Kaspersky Next XDR Expert. On the primary Administration Server, you cannot change the backup directory path.

The following data is saved in the backup copy of Administration Server:

• Database of Administration Server (policies, tasks, application settings, events saved on the Administration Server)
• Configuration details of the structure of administration groups and client devices
• Repository of distribution packages of applications for remote installation
• Administration Server certificate

Recovery of the Administration Server data is only possible by using the KDT utility.

You can create a backup copy of the KUMA Core and restore it from the backup if needed. You can also back up other Kaspersky Next XDR Expert components by using third-party tools only if you use the DBMS installed on a separate server outside the Kubernetes cluster. You must not create the Administration Server database backup by using third-party tools.

Configuring the Administration Server Backup task

The Administration Server Backup task automatically is created when you deploy Kaspersky Next XDR Expert and cannot be deleted. You can create a backup copy of Administration Server data only by running the Administration Server Backup task.

To configure the Backup of Administration Server data task:

1. In the main menu, go to Assets (Devices) → Tasks, and then select the Administration Server Backup task.
2. Click the Administration Server Backup task.

   The task properties window opens.

3. If necessary, specify the general task settings according to your needs.
4. In the Application settings section, set the backup protection password and number of backup copies if needed.

   We recommend limiting the number of Administration Server data backups, to avoid overflow in the disk space allocated to store backups.

5. Click Save to apply changes.

The Backup of Administration Server data task is configured.

Using the KDT utility to recover Administration Server data

The Backup of Administration Server data task allows you to copy Administration Server data for backup. To recover Administration Server data, you must use the KDT utility.

To recover Administration Server data:

1. On the administrator host where the KDT utility is located, run the following command:

   ./kdt invoke ksc --action listBackup

   The list of backups located in the /var/spool/ksc/backup directory is displayed.

2. Run the following command:

   ./kdt invoke ksc --action restoreBackup --param ksc_file_backup='<file name>' --param ksc_backup_password="<password>"

   where:

   • ksc_file_backup is the path to the required backup archive and the archive name.
   • ksc_backup_password is the archive password if the backup was saved with a password. If no password was used set the ksc_backup_password variable to "".

The Administration Server data is recovered from the selected backup archive.