Last update:
Last verified version: AAC 4.4.3
Manually Archiving Scans
ASGARD Analysis Cockpit stores each scan as a single file in the /var/lib/asgard-analysis-cockpit/events directory.
To manually archive scans, move the corresponding event files from this folder to your archive location using the console. Files processed and imported have an .ok suffix, such as __9.txt.gz.ok.
Administrators can perform a full backup of all AAC data via the dashboard under "Settings/Configuration".
This import process does not remove existing event data from the Elasticsearch database.
Importing Archived Scans
To re-import archived scans, copy files from your archive folder to the /var/lib/asgard-analysis-cockpit/events directory.
Before copying, remove the .ok suffix from filenames. AAC will reprocess these files and, if the import succeeds, append the .ok suffix again. Set the file user and group to cockpit for proper processing.