APIC Replacement - Log History Backup

[a12288]

I am following on this document Cisco APIC M1/M2/M3/L1/L2/M3 to M4/L4 Cluster Migration, Release 5.3(1) - Cisco to replace APIC-M2 with APIC-M4.

It suggests that "...When you decommission a Cisco APIC, the APIC loses all fault, event, and audit log history that was stored in it. If you replace all Cisco APICs, you lose all log history. Before you migrate a Cisco APIC, we recommend that you manually backup the log history ..."

However, I am not clear:

• What logs I should back up, Audit log, Events log, Fault Records log, Health Records log, etc?
• How to back them up?
• How to restore them back to the new APIC-M4 controller?

Can someone give me some guidance? Thanks.

Leo

[mathew-paulson]

When replacing a Cisco Application Policy Infrastructure Controller (APIC), it’s essential to back up the log history to ensure you don’t lose valuable information. Here are the steps you can follow:

1. Manual Backup of Log History:

   • Before decommissioning an APIC, manually back up the following logs:
     • Audit Log: Contains records of administrative actions and changes.
     • Events Log: Captures system events and notifications.
     • Fault Records Log: Stores information about system faults and errors.
     • Health Records Log: Contains health-related data.
   • Unfortunately, the official documentation doesn’t provide specific instructions on how to back up these logs individually. 

2. Configuration Export Policy:

   • Log in to the Cisco ACI APIC Dashboard.
   • Navigate to Admin > Export Policies > Configuration Export.
   • Create a new policy, select your export format (XML or JSON), and initiate an immediate export.
   • Optionally, enable global AES encryption for added security.

3. Recurring Backups:

   • To set up recurring backups, configure a schedule for the export policy. This ensures that your logs are backed up regularly.

Remember that the exact steps may vary based on your specific APIC version and deployment. 

[Stefan Engel]

To manually backup fault, event & audit logs, copy them from /var/log/dme/log.