What is Backed Up?

The backup process copies the configuration and real time databases, and all raw log data from the appliance.

Backed up Databases and Files
Backed Up Data Description
Configuration Database A full SQL configuration database dump, created every time at the scheduled time.
Raw Log Files The general raw syslog files, representing all logs collected from the appliance’s log sources, and stored in the appliance's local file system.

If an appliance is configured with a supported archiving method, for example NAS, the appliance pushes its older data such as raw syslog files, file-based log data, and indexed log data (if enabled) to the NAS volume. In this case, the backup does not copy files from your NAS server. You must copy files from your NAS server manually by evaluating your business needs and creating a plan.

LEA Certificate files Log Export API certificates specific to the Check Point Management Interface for the appliance.
Real Time Database The Real Time data assembled by the appliance based on its collected logs.

The Real Time database is much larger for LX and MX appliances than for ST appliances. The ST database consists of only a few tables.

System Configuration files
  • Text files related to the appliance
  • LogLogic application configuration on it
  • Configuration files related to Advanced Features (Bloks, Data Model, Advanced Dashboard, and Advanced Search)

LogLogic backs up files on the appliance up to the midnight before when the backup is run. That is, if you start a backup at 10 a.m. the backup captures data through the midnight ten hours prior.

The only exception is that the backup collects only through 6 hours prior. That is, if you start the backup between midnight and 6 a.m. the backup copies data through midnight the previous day, not the most recent midnight.