MISP / MISP

MISP (core software) - Open Source Threat Intelligence and Sharing Platform

Home Page:https://www.misp-project.org/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Move data from old instance

Moorocks opened this issue · comments

Support Questions

Hi All,
I ran coolacid misp image (https://github.com/coolacid/docker-misp) for a while now and would like to tranistion to official misp provided image.
I'm running this coolacid docker image on RHEL 8 and now I would like to take a backup of database for decomissioning it. Is it possible? If yes, could you please guide me through it, thanks.

MISP version

2.4.177

Operating System

RedHat

Operating System version

8

PHP version

7.4

Browser

No response

Browser version

No response

Relevant log output

No response

Extra attachments

No response

Code of Conduct

  • I agree to follow this project's Code of Conduct

If you just want the events then one option is to add the old server to the new server as a sync partnership, ticking the local instance and performing a pull - this will change the creator to the user performing the pull, but I believe otherwise the events should arrive unchanged.

If you want everything then I'd expect exporting the database with mysqldump misp > misp.sql and importing it with mysql misp < misp.sql, assuming you update your new config.php to match things like the salt and database encryption key.

I think I'd prefer the second option, getting the full database as I do not want to setup the remote servers, users, api keys and stuff again.

i guess i can export the database and import it. However can you give more details about changing config.php? What should i change?
Note - We host misp as docker on RHEL, not as stand alone application.

My plan - I thought of copying the sql folder present within the old container to my host machine. Once done, i thought of replacing the new container's sql folder with the backup sql folder and restart all the containers.

Problem - Now you mentioned about config.php, so not sure what needs to be done here.