How to optimize Server.Utils.BackupS3 #2764
-
|
Hello, I was able to get the Server.Utils.BackupS3 artifact to run and upload to my S3 bucket successfully. I had a question about the expected time it should take to upload to a S3 bucket. I do know part of this will depend on what artifacts the backup will be collecting but I wanted to know if the system spec's will also play a factor in how fast the utile works? I started a back up on Friday and didn't touch Velociraptor until today and the backup just uploaded to my S3 bucket about 20 minutes ago. I did have it backup a Linux kape artifact but I wouldn't have though it would take that long to upload. Do to the fact that it was a fresh Linux box. Any suggestion or guidance on this would be greatly appreciated. Thanks!! |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 2 replies
-
|
Backups occur when the kape collection completes. How long did it take between the time of completion and the zip showing up in the bucket? That artifact creates a download zip to upload. It's the same one you can create in the GUI with the create download function on the flow overview page. It needs to compress all the files so that takes CPU resources. I guess if the host is very slow it could take a while but maybe not 2 days. You can check how long it took to actually compress the flow in the overview page. I suspect most of the delay is network traffic related. The other thing is that backups occur in a single thread so it might be waiting for other backups. You can increase parallelism by adding a workers parameter to the foreach in that artifact. |
Beta Was this translation helpful? Give feedback.
-
|
Ah, that makes sense, I was able to get the BackS3 artifact to run as we expected. If I wanted to, how can I stop the stop the Server.Utils.BackupS3 artifact from running? It looks like when I launch it the artifact it just continues to run in the back ground and waits for hunts to complete then push them to S3 after they are zipped. |
Beta Was this translation helpful? Give feedback.
-
|
That is what the artifact does. If you dont want it active any more you can remove it from the server event monitoring screen and add it when you want it later. |
Beta Was this translation helpful? Give feedback.
That is what the artifact does. If you dont want it active any more you can remove it from the server event monitoring screen and add it when you want it later.