APIC Replacement - Log History Backup

[a12288]

I am following on this document Cisco APIC M1/M2/M3/L1/L2/M3 to M4/L4 Cluster Migration, Release 5.3(1) - Cisco to replace APIC-M2 with APIC-M4.

It suggests that "...When you decommission a Cisco APIC, the APIC loses all fault, event, and audit log history that was stored in it. If you replace all Cisco APICs, you lose all log history. Before you migrate a Cisco APIC, we recommend that you manually backup the log history ..."

However, I am not clear:

• What logs I should back up, Audit log, Events log, Fault Records log, Health Records log, etc?
• How to back them up?
• How to restore them back to the new APIC-M4 controller?

Can someone give me some guidance? Thanks.

Leo

[mathew-paulson]

When replacing a Cisco Application Policy Infrastructure Controller (APIC), it’s essential to back up the log history to ensure you don’t lose valuable information. Here are the steps you can follow:

1. Manual Backup of Log History:

   • Before decommissioning an APIC, manually back up the following logs:
     • Audit Log: Contains records of administrative actions and changes.
     • Events Log: Captures system events and notifications.
     • Fault Records Log: Stores information about system faults and errors.
     • Health Records Log: Contains health-related data.
   • Unfortunately, the official documentation doesn’t provide specific instructions on how to back up these logs individually. 

2. Configuration Export Policy:

   • Log in to the Cisco ACI APIC Dashboard.
   • Navigate to Admin > Export Policies > Configuration Export.
   • Create a new policy, select your export format (XML or JSON), and initiate an immediate export.
   • Optionally, enable global AES encryption for added security.

3. Recurring Backups:

   • To set up recurring backups, configure a schedule for the export policy. This ensures that your logs are backed up regularly.

Remember that the exact steps may vary based on your specific APIC version and deployment. 

[Stefan Engel]

To manually backup fault, event & audit logs, copy them from /var/log/dme/log. 

[j.dzidowski]

Hi All,

While reviewing the best approach, how to a manually backup the log history I noticed on APIC's release 5.3 there is an option to download all logs via APIC GUI.

You need to navigate to System -> History where you find 5 log categories: 

1. Fault Records
2. Event Records
3. Audit Logs
4. Session Logs
5. Health Records

For each you click on Actions button and then Download All. You can download the logs in form of XML or JSON files.

I used JSON as it is still readable to me after "making it pretty". However there is no option to import it back to the replaced APIC.

You also can decide about the scope of the time for which you want to download the history log. By default, it is last 24 hours but you can specify whatever you like.

[julian.bendix]

Hey!

If you are just asking because it is written in the Cisco Doc, not because you really think you will need a backup of the old logs... I would recommond skipping this step.

I never backed up logs from ACI.