Documentation Center
AlienVault® USM Appliance™

Known Issue: Event Backup Stops Working After Upgrading to 5.4

Reported Version: All versions prior to 5.4
Fixed Version 5.4.1
Deployment: All deployments
AlienVault Ticket ID ENG-105798

Description

In USM Appliance version 5.4, AlienVault added a new parameter, backup_events_min_free_disk_space, to the backup process. This parameter sets the minimum free disk space required for the SIEM event backup to take place. The default is 10%. If the free disk space on the system is less than this setting, event backup will not start.

For USM Appliance upgrading to version 5.4, this parameter is added but not set, therefore event backup does not start.

Workaround

AlienVault is aware of this issue and working on a hotfix to make available for all customers. In the meantime, you can set this parameter manually.

To set the minimum free disk requirement for event backup:

  1. From the USM Appliance web interface, go to Configuration > Administration > Main > Backup.
  2. Set the Allowed free disk space for the SIEM backups parameter.

    Available values are 10% or 15 %.

  3. Click Update Configuration.
  4. Connect to the AlienVault Console through SSH and use your credentials to log in.

    The AlienVault Setup menu displays.

  5. Select Maintenance & Troubleshooting.
  6. Select Restart System Services.
  7. Select Restart AlienVault Frameworkd Service.

    Confirm when prompted.

  8. Exit after restarting finishes.