Tanium 6.x: Disaster Recovery

Tanium Server Backup and Restore Procedures

The streamlined infrastructure of the Tanium platform makes backup and recovery of a failed management server a very quick process.

Please note: instances of Apache referenced below are exclusively for version 6.2 of the platform and prior. Version 6.5 and further replace Apache with the Tanium Server service.

Organizations should implement one of three recommended backup and recovery options based on their Disaster Recovery and High Availability service level agreements:

  • The Cold Failover procedure requires the least amount of effort in the back up process, but may take several hours to restore.
  • Conversely, the Warm Failover procedure assumes that you have a second, dedicated server available to restore the backup on a nightly basis so that recovery in the event of failure would be less than an hour or two.
  • In the third option, Hot Failover, a backup server can take over from a failed server immediately if your network environment is configured to support servers within an Active-Active array.


Regardless of the option you choose for back up and restore, it is essential that you maintain copies of the Tanium system credential files from the current deployment: 

Default Location of Server Credential Files
File Directory Filename
Private Key \Program Files\Tanium\Tanium Server\ tanium.pvk
Public Key \Program Files\Tanium\Tanium Server\ tanium.pub

These files are unique to your deployment and cannot be recreated or recovered if they should become lost, destroyed, or unusable. Copies of these files should be archived, secured, and managed according to your internal security policies as you would any other system-level security and credential files.

Cold Failover

Nightly Backup Procedure

  1. Following your organization’s standard procedures for database backup and recovery, implement a process to perform nightly backups of the tanium and tanium_archive databases.
  2. If the Tanium and Apache services are configured to use a service account to access a remote SQL Database, backup the service account's User ID information from the Security table of SQL Server DBMS Master database. Microsoft provides more details on: How to transfer logins and passwords between instances of SQL Server
  3. Backup the Tanium Server application folder and all subfolders. In a default installation, backup all files in the path \program files\Tanium\Tanium Server\
  4. Explicitly back up the Tanium Server’s Download directory if it was set to a non-default location following the instructions at Relocate Downloads Directory.
  5. Backup the SSL private key and certificate pair used during the original installation to enable an encrypted connection for the Tanium browser console:

 

Default Location of Apache SSL Credential Files
File Directory Filename
Private Key \Program Files\Tanium\Tanium Server\Apache24\conf\ installed-server.key
Certificate \Program Files\Tanium\Tanium Server\Apache24\conf\ installed-server.crt

Recovery to a new application server instance

  1. Provision a new server with the same OS version as the original Tanium server.
  2. Update the host file on the new server to point the fully qualified domain name of the server to the IP address of the new server.
  3. Install the same version of SQL Server used on the old Tanium server to the new server device.
  4. Restore the SQL Server login information to the new database following the Microsoft guidelines on: How to transfer logins and passwords between instances of SQL Server
  5. Restore the tanium and tanium_archive databases from backup.
  6. Install the Tanium Server component using a version of the SetupServer.exe program equivalent to the version of the original server when it failed.
    • Be sure to designate the same directory structure used in the original install
    • When prompted for the Apache SSL Certificate, use the file pair that you backed up from the original server.
  7. At the conclusion of the installation, restore the backed up files/folders from the original server, making sure to replace the server credential files, tanium.pvk and tanium.pub, from the original server over the 2 credential files created during the installation in the earlier step.

 

Warm Failover

Option 1

Nightly Backup Procedure

  1. Clone the image of the Tanium application Server

Recovery to Warm Standby Server

  1. Provision a new server with the same OS version as the original Tanium server.
  2. Block the backup server from any network access.
  3. Restore the clone image to the backup server.
  4. Update the host file on the new server to point the fully qualified domain name of the server to the IP address of the new server.
  5. Flush DNS

Option 2

Nightly Backup Procedure

  1. Following your organization’s standard procedures for database backup and recovery, implement a process to perform nightly backups of the tanium and tanium_archive databases and restore them to the backup server
  2. Unless it is the case that the SQL server service and the Tanium services exist on the same machine and the Tanium Services run as Local System, backup the accounts and privileges associated with the tanium and tanium_archive databases from the SQL Server DBMS Master database. Microsoft provides more information on: How to transfer logins and passwords between instances of SQL Server.
  3. Backup the Tanium Server application folder and all subfolders to the backup server: \program files\Tanium\Tanium Server\
  4. Explicitly back up the Tanium Server’s Download directory if it was set to a non-default location following the instructions at Relocate Downloads Directory.

Recovery to Warm Standby Server

  1. Update the DNS entry for the original Tanium Server to point to the IP address of the backup server.
  2. Flush DNS

 

Hot Failover

The primary Tanium Server and backup server can be configured in an active-active array so that in the event of failure, the remaining server can take over management of the system immediately.

See the Active-Active Server Setup instructions for complete details to implement this recovery solution. 

Verification of Restoration

  1. Ensure you can load the Tanium Console.
  2. Ask a Question and ensure results come in.
  3. Create a test package with a source file and ensure clients show the package completed.

When the Tanium Clients discover that the Server is unavailable, they will gradually increase the amount of time to wait before they try to contact the server again. Consequently, if the Server is off line for an extended period of time, it may take some time before all clients are reporting in again after the server has been restored.

Have more questions? Submit a request