How do I back up and restore web protection software?

Backup and Restore | Forcepoint Web Security, Forcepoint URL Filtering | 29-Apr-2022

Use the Backup Utility to back up your web protection software settings and policy data, and to revert to a previous configuration.

Running the Backup Utility on Windows or Linux

Enabling scheduled backups on Windows servers

Configuring how long backup files are stored

Restoring your web protection configuration

What files does the Backup Utility save?

Running the Backup Utility on Windows or Linux

As a best practice, run the backup process on all machines with web protection components within a 30-minute time window. This may include:

Forcepoint appliances (see How do I back up and restore Forcepoint appliances?)

The Forcepoint management server

Note that on the management server, you need to run both the Backup Utility for your web protection product, as described in this section, and the backup procedure for the management infrastructure components, as described in How do I back up and restore the Forcepoint management infrastructure?.

Content Gateway (see How do I back up and restore Content Gateway?)

When restoring a previous configuration, restore all machines using backup files created in the same 30-minute window.

To run the Backup Utility on your Windows or Linux servers (excluding machines that host Content Gateway):

Make sure that all administrators are logged off of the Forcepoint Security Manager.

Do one of the following:

(Windows) Navigate to the bin directory (C:\Program Files or Program Files (x86)\Websense\Web Security\bin\).

(Linux) Navigate to the bin directory (/opt/Websense/bin/) and enter the following command:

export LD_LIBRARY_PATH=.

To run an immediate backup, enter the appropriate command for your operating system.

Windows:

wsbackup -b -d <directory>

Linux:

./wsbackup -b -d <directory>

Here, <directory> indicates a local or remote destination directory for the backup archive.


	Warning Do not store backup files in your product's \bin directory. This directory is deleted if you uninstall your software.

To schedule the backup process to run on a regular basis, use the following command.

Windows:

wsbackup -s -t "<m> <h> <day_of_month> <month> <day_of_week>" -d <directory>


	Important There is an additional, important step that must be completed for scheduled backups to be created properly on Windows servers. After completing this procedure, continue with Enabling scheduled backups on Windows servers.

Linux:

./wsbackup -b -s -t \"<m> <h> <day_of_month> <month> <day_of_week>\" -d <directory>

For example, to schedule a backup to run at 10:10 a.m. on Sundays:

./wsbackup -s -t "10 10 * * 0"

Here, the backup is scheduled to run at 10:10 a.m. on Sundays (regardless of the month or date).

Scheduled backup commands use crontab format, and the quotation marks and spaces are required.

In place of the variables shown in the example, provide the following information:


Variable	Information
<m>	0 - 59 Specify the precise minute to start the backup.
<h>	0 - 23 Specify the general hour of the day to start the backup.
<day_of_month>	1 - 31 Specify the date to perform the backup. If you schedule a backup for days 29 - 31, the utility uses the standard substitution procedure for the operating system in months that do not include that date.
<month>	1 - 12 Specify the month to perform the backup.
<day_of_week>	0 - 6 Specify a day of the week. 0 represents Sunday.

Each field can take a number, an asterisk, or a list of parameters. Refer to any crontab reference for details.

After running an immediate backup, or after the scheduled backup process has completed successfully, the WebsenseBackup.cfg file is created in the backup directory. Use this file to configure how long backup files are retailed. See Configuring how long backup files are stored.

Enabling scheduled backups on Windows servers

On supported Windows servers, the scheduled task that the Backup Utility creates does not include user account information required by server security settings. This means that the backup file is not saved as expected.

To address this issue, manually update the scheduled task to add the required user account information as follows:

Open the Windows Task Scheduler (Start > Administrative Tools > Task Scheduler or Server Manager > Tools > Task Scheduler).

Select Task Scheduler Library in the left navigation pane.

Right-click the Websense Backup task and select Export.

Save the XML file in a temporary directory, then open the file in a text or XML editor.

Update the <Author> container with an account with local administrator permissions in the format DOMAIN\UserName. If the backup files will be saved to a remote drive, this must be a domain account, rather than a local account.

<Author>FP-SVR\Administrator</Author>

Update the <UserId> container with an account with local administrator permissions in the format DOMAIN\UserName. If the backup files will be saved to a remote drive, this must be a domain account, rather than a local account.

<UserId>TEST-DOMAIN\NetworkUser</UserId>

Verify that the correct path to the Backup Utility (wsbackup.exe) appears in the <Command> container.

Verify that the correct destination directory appears in the <Arguments> container. Note that the directory path should have the following format:

Local storage:

C:\folder\subfolder

Remote storage:

\\10.102.55.4\BackupDirectory

For example:

<Arguments>--backup --dir "C:\WbsnBackup"</Arguments>

Note that there is no backslash at the end of the path.

Save and close the file.

10.

In the Task Scheduler, right-click the existing Websense Backup task and select Delete.

11.

In the right navigation pane, select Import Task.

12.

Navigate to the XML file that you edited in the previous steps, select it, and then click Open.

13.

To verify that the changes took effect correctly, right-click the new Websense Backup task and select Run, then make sure that a backup file was created in the expected location.

Configuring how long backup files are stored

After the first backup process has run, optionally use a text editor to edit the WebsenseBackup.cfg file, created with the backup archive, as follows:

Specify a numeric value for the KeepDays parameter, which sets the number of days archive files remain in the backup directory (365, by default).

When a file is older than the specified time period, it is deleted automatically.

Specify a numeric value for the KeepSize parameter, which sets the maximum number of bytes allotted for backup files (10857600, by default).

When the backup directory reaches the specified size limit, the oldest backup file is deleted automatically.

Restoring your web protection configuration

When you restore your Forcepoint Web Security or Forcepoint URL Filtering configuration, make sure that you are restoring data for the components that exist on the current machine.

If the machine was rebuilt after, for example, a serious hardware failure, make sure that you have installed only the components that previously resided on the machine. The backup process can only restore configuration information for components that were present on the machine when the backup file was created.

Also, remember that cross-platform backup and restore (from Windows to Linux, for example) is not supported.

When you restore your web protection configuration, also restore a Forcepoint Security Manager configuration from the same time period.

Review How do I back up or restore web protection components and the Forcepoint Security Manager? before you begin.

See How do I back up and restore the Forcepoint management infrastructure?.

After restoring the configuration on the Policy Broker machine, restart all web protection services in your deployment.

Make sure that all services are running after the restore process. Manually start any services that remain stopped.

To restore a previous configuration:

Make sure that all administrators are logged off of the Forcepoint Security Manager.

Do one of the following:

(Windows) Navigate to the bin directory (C:\Program Files or Program Files (x86)\Websense\Web Security\bin\).

(Linux) Navigate to the bin directory (/opt/Websense/bin/) and enter the following command:

export LD_LIBRARY_PATH=.

Enter the following command to initiate the restore process:

wsbackup -r -f <archive_file_name>.tar.gz


	Important The restore process may take several minutes. Do not stop the process while restoration is underway.

The Backup Utility saves some files used for communication with third-party integration products. Because these files reside outside the Forcepoint directory structure, you must restore them manually, by copying each file to the correct directory.

Files that must be restored manually include:


File name	Restore to
isa_ignore.txt	Windows\system32
ignore.txt	Windows\system32\bin

What files does the Backup Utility save?

The Backup Utility identifies and saves any of the following files that it finds on the machine on which it is run.


Path	File names
\Program Files or Program Files (x86)\Websense\Web Security\bin or /opt/Websense/bin	authserver.ini BrokerService.cfg config.xml das.ini diagnostics.cfg domains.txt eimserver.ini icap.conf ignore.txt linkingservice.ini LogServer.ini LSPProvider.cfg LSPConsumer.cfg mux.cfg muxplugins.cfg netcache.conf securewispproxy.ini	SIEMConsumer.cfg StateServer.cfg syncservice.ini TestRestService.ini transid.ini ufp.conf ufp_sic.conf UsageMonitor.ini websense.ini WebUI.ini wsauthserver.ini wscitrix.ini WSE.ini wsedir.ini wsradius.ini WSSEK.DAT wsufpserver.ini
bin/i18n	i18n.ini
bin/postgres/data	pg_hba.conf postgresql.conf
BlockPages/*/Custom	All custom block page files
ssdata/pac	websense.pac
Windows only
rtm\db\bin\	db.properties
rtm\conf\	config.properties system.properties
rtm\tomcat\conf\	catalina.properties
rtm\tomcat\conf\Catalina\localhost\	rtm.xml
tomcat\bin\	policyServers.ser
tomcat\conf\	catalina.properties wbsn-pairing-map.txt
tomcat\conf\Catalina\Localhost	mng.xml
webroot\	websense.ini
webroot\Exlorer\	favorites.xml websense.ini
Windows\system32\	ignore.txt isa_ignore.txt wsMsp.ini
Linux only
conf/	WebsenseDaemon
conf/restore/	local.policybroker.policies remote.policybroker.policies