Cisco SMA backup Email tracking

[mikiNet]

Hi All,

I have a question about how can I do the backup of Email tracking stored on Cisco SMA ? 

I found this document:

https://www.cisco.com/c/en/us/support/docs/security/content-security-management-appliance/118441-technote-sma-00.html

But it only tell that I can backup from one SMA to the second SMA.

I don't want to do this. I want to backup data (Email tracking) from SMA to (for example) my FTP server.

Anyone know how to do this ? 

[Ken Stieers]

There is no facility to do that.
No backup, no restore of the tracking DB other than the backup SMA.

You can export logs which carry all of the data the tracking db is built from.

[mikiNet]

"You can export logs which carry all of the data the tracking db is built from."

How ? From CLI - backupconfig is only for backup from primary SMA to secondary SMA. From GUI I only see only Configuration backup.

[Ken Stieers]

Enable FTP on an interface, then you can get to the various log directories via FTP
Keep in mind that the ESA processes the logs into the database as they're written. Depending upon how you have the log subscription configured, they'll rotate. Tracking DB is based on the files in the "mail_logs."
If you need the logs longer term, you probably should look at feeding them to your SEIM or similar log aggregation facility. You could also configure the CEF logs, which gives you all the things that happen to an email in one line, instead of the many lines Mail_logs are in.

[mikiNet]

ESA transfer email to the SMA. Maybe first I describe why I want to this operation. We want to upgrade all SMA and ESA, but from 13.6.2 version, the Splunk Database is no longer used for email tracking data... so if we upgrade, we lost all old emails, but we want to have it... 

So base on your solution, we should only copy mail_logs via FTP?

[Ken Stieers]

If you want to keep the your tracking data, your ONLY choice is to have another SMA or SMAv and back your tracking db to it.
My apologies, it wasn't clear that you were trying to keep your current historical data.

Mail logs are short term... depending on how much mail flow you have, it could be as little as a few days.
Keeping mail logs is a solution going forward, not for preserving your historical data.