Back up and restore the reporting databases

Moving the Reporting Databases | Web, Data, and Email Solutions | April 2022

Applies to:

Forcepoint Web Security and Forcepoint URL Filtering, v8.5.x

Forcepoint DLP, v8.5.1, v8.6.x, v8.7.x, v8.8.x, v8.9.x

Forcepoint Email Security, v8.5.x

Forcepoint appliances, v8.5.x

The databases (Web Log Database, DLP Incident and Configuration Database, and Email Log Database) are supported on a number of versions of Microsoft SQL Server. Find the supported versions of Microsoft SQL Server for your product by selecting the appropriate link in this article.

Before upgrading an existing installation of Microsoft SQL Server to a new version or migrating to a new machine, back up the reporting databases to a safe location.

Upgrading in place should not affect the reporting databases, but it is a best practice to make a backup copy to safeguard against corrupted data or other data loss.

When migrating databases to a new Microsoft SQL Server installation on another machine, to minimize downtime, start by installing and configuring SQL Server in the new location.

The upgrade or migration process begins with a backup of the existing reporting databases. Because the backup process can be quite time consuming, the instructions in this document perform the backup in 2 stages.

For web and email solutions:

The initial backup can be performed while the Log Database is online, processing data.

The second, incremental backup is performed on just the active partition (the partition currently receiving new records) and catalog database.

The intent is to minimize the database downtime required for the upgrade or database migration.

1: Perform a full database backup

Open SQL Server Management Studio and log on to the SQL Server instance that hosts the reporting databases.

In the Object Explorer, under Databases, locate the databases. The default database names are:

For web solutions, wslogdb70_n and wslogdb70_amt_1 (partition databases) and wslogdb70 (the catalog database)

For email solutions, esglogdb76_n (partition databases) and esglogdb76 (the catalog database)

For data solutions, wbsn-data-security and wbsn-data-security-temp-archive

In the web and email examples, "n" is the partition number. The higher the number, the newer the partition.

Right-click each database, expand the Tasks menu, and select Back Up.

Make sure the Backup type is Full.

In the Back Up Database window, either accept the default backup Destination or click Add and specify a new path or name for the backup file.

Save the file as *.BAK.

Click OK to run the backup.

At the end of this process, full backups have been made for all of the older partition databases, and there is a recent backup of the active partition (the one that new log records are being added to) and catalog database.

When timing is appropriate to temporarily stop database processing, continue with the next section.

2: Back up the catalog database and active partition (Web and Email)

Stop all Web Log Server or Email Log Server instances in your deployment.

Disable the web or email protection database jobs.

In the left navigation pane, click the SQL Server Agent folder for the instance hosting the Log Database.

Click Jobs, and disable each of the web or email protection jobs by right-clicking the job and selecting Disable.

The job names are in the format "Websense_xxx_<catalog database name>" where xxx is the type of job and <catalog database name> is the actual name of your catalog database (by default, wslogdb70 or esglogdb76).

Make sure that all of the jobs are completed before continuing. This could take several minutes or a few hours, depending on the environment. If necessary, ask a database administrator for assistance in determining whether the jobs are completed.

Perform a differential backup of the catalog database (wslogdb70 or esglogdb76). This will back up anything that has changed since the initial backup performed in Part 1 of this procedure.

Perform a differential backup of the active database partition (the one that is still receiving new log records). Its name is something like wsglogdb70_10 or esglogdb76_5).

3a: Upgrade in place

If the machine hosting the database engine is adequate to host an upgraded version of SQL Server:

Stop the Forcepoint DLP server. The Web and Email Log Servers are already stopped. Change the server startup type to Disabled.

Upgrade the Microsoft SQL Server installation, following the instructions in the Microsoft documentation.


	Note During upgrade, select the collation that the wbsn-data-security database uses. The SQL Server collation must match the incident and reporting database collation exactly. To determine a database collation, use the Microsoft SQL Server Management Studio. Right-click the server name and select Properties, then right-click the database name and do the same. The collation is listed in the Maintenance section.

Once installation is complete, enable the Forcepoint SQL Server Agent jobs:

In the left navigation pane, click the SQL Server Agent folder for the instance hosting the Log Database.

Click Jobs, and enable each of the web or email protection jobs by right-clicking the job and selecting Enable.

Start all Web Log Server or Email Log Server instances in your deployment.

Start the Forcepoint DLP server.

Log Server resumes sending data to the Log Database, and the ETL job begins processing the web or email records into the active partition.

3b: Migrate the database to a new SQL Server host

To move the reporting database to SQL Server on another machine:

Install the SQL Server on the new machine.


	Note During installation, select the collation that the wbsn-data-security database uses. The SQL Server collation must match the incident and reporting database collation exactly. To determine a database collation, use the Microsoft SQL Server Management Studio. Right-click the server name and select Properties, then right-click the database name and do the same. The collation is listed in the Maintenance section.

Open SQL Server Management Studio and log on to the SQL Server instance that will host the reporting databases.

To restore the reporting databases from their backup location:

In Object Explorer, right-click Databases and select Restore Database.

Enter the database name in the To database (or Database) field.

Select From device (or Device) then click the browse (...) button.

With File selected (the default), click Add and browse to the backup location.

Select the databases you want to restore from the Select the backup sets to restore list.

Select the Options page of the restore window, then verify that the Restore As column shows the correct location for the destination (restored) partition.

Repeat steps a through f until all databases have been restored.

Recreate the web or email database jobs on the new SQL Server installation.

Open the Query window and point to your catalog database (default name wslogdb70 or esglogdb76).

Run the following stored procedures:

exec dbo.usp_update_views;

exec dbo.usp_create_background_jobs;

If you are migrating a Web or Email Log Database, continue with Update Log Server and Log Database settings.

Direct the Forcepoint DLP management components to the new database server. To do this, run the Forcepoint Security Setup program, and select Modify.

Direct Forcepoint Email Security to the new database server by navigating to the Settings > Reporting > Log Database page and changing the configuration.