PingDirectory

Performing disaster recovery

If data is compromised across all systems and a restore is necessary, you can perform disaster recovery.

About this task

Consider the following for disaster recovery:

  • With the default configuration, the server automatically exports all data nightly using the Export All Non-Administrative Backends recurring task. Up to 7 days of exports are maintained.

You should archive these exports on another system.

  • The Data Recovery Log logs all changes in a reversible format to logs/data-recovery/data-recovery.

  • The bin/extract-data-recovery-log-changes tool provides the ability to redo or undo any changes from the logs/data-recovery/data-recovery logs.

The combination of these allows you to either rebuild the data set to any point in time or to revert specific changes on a live data set, such as if an errant application mistakenly wipes out some data.

For more information about LDIF exports, see LDIF export as a recurring task.

These steps assume that no server performs read or write operations during this process.

To complete a restore of your systems and perform a disaster recovery:

Steps

  1. Stop all servers.

  2. Go to one of the servers and remove it from the topology:

    Example:

    bin/remove-defunct-server --performLocalCleanup --no-prompt

  3. Locate the backup or exported LDIF file that represents the last working copy of the database.

  4. Restore the backup or import the LDIF file on a single server. If importing an LDIF file, use the --excludeReplication option with the bin/import-ldif command.

  5. Start the restored server. The server can now receive client requests.

  6. Clean up replication artifacts from the next server before starting it up:

    Example:

    bin/remove-defunct-server --performLocalCleanup --no-prompt

  7. Start the server in lockdown mode with the following command:

    Example:

    bin/start-server --skipPrime --lockdownMode

  8. Enable replication from the first server to the second server.

    Example:

    bin/dsreplication enable

  9. Initialize the second server from the first with the following command:

    Example:

    bin/dsreplication initialize

  10. Restart the second server or use the bin/leave-lockdown-mode command to exit lockdown mode.

    The second server can now receive client requests.

  11. Repeat steps 5 through 10 for any other servers.