> Source: [sk122655](https://support.checkpoint.com/results/sk/sk122655)

# sk122655 - How to back up and restore a SmartEvent log database in R80/R80.x

| Property | Value |
|----------|-------|
| Solution ID | sk122655 |
| Date Created | 2018-02-08 |
| Last Modified | 2025-01-16 |
| Technical Level | General |
| Products | Security Management Server |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Solution

**Note** : Do this procedure on the server that runs the correlation unit **and** the server that runs the SmartEvent.

To back up events:

1. Run the `fw logswitch` command.  

2. Run the`fw logswitch -audit` command.  

3. Run the `cpstop `command.  

4. Compress all log-files:  
   `gtar -zcvf fw_logs.tgz $FWDIR/log/*20*.*log*`  

5. Compress all log-Indexes:  
   `gtar -zcvf log_indexes.tgz $RTDIR/log_indexes/*20*`  

6. Copy these files to an external storage:
   * *$INDEXERDIR/data/FetchedFiles*
   * *log_indexes.tgz, fw_logs.tgz*

To restore events:

1. Run the `cpstop `command.  

2. Remove all old files:
   * `rm -rf $RTDIR/log_indexes/*20*`
   * `rm -f $INDEXERDIR/data/Fetche``dFiles`  

3. Extract the *log_indexes.tgz* file to *$RTDIR/log_indexes/* directory.  

4. Extract the*fw_logs.tgz* file to *$FWDIR/log/* directory.  

5. Put the previously copied *FetchedFiles* file (see step # 6) into the *$INDEXERDIR/data/FetchedFiles* directory.  

6. Run the `cpstart `command.

To back up the correlation unit and events policy, run the "`migrate export`" command without the `-l` parameter. For more on this command, refer to the "Syntax" section in the [Installation and Upgrade Guide R80.10](https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_Installation_and_Upgrade_Guide/html_frameset.htm?topic=documents/R80.10/WebAdminGuides/EN/CP_R80.10_Installation_and_Upgrade_Guide/128363&anchor=o130317).

**Important Notes**

* Restore can only be done to the same Mgmt-DB server it was backed up from (using migrate/\<_server\> export/import).
* Starting in R81, you cannot transfer the Event-DB from a version lower than R80.x.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content