Backup Profile Manager Database (Working Solution for OS X 10.10)

[Carter]

It's annoying that Apple has no easy solution for something that should be a major & required feature for it's Profile Manager. With the help of the post here https://discussions.apple.com/thread/6855393 I had gone ahead and created scripts that I now have running on my server that will backup the Profile Manager Database daily.

 

I've tested this and I was able to backup the database then erase/reset Profile Manager to scratch then run the restore and have the server backup and running with all the devices, groups etc.

 

Here are the commands:

 

Dump/Create backup of the database

#!/bin/bash
sudo pg_dump -h /Library/Server/ProfileManager/Config/var/PostgreSQL -U _devicemgr devicemgr_v2m0 -c -f ~/Desktop/profileManager.sql

 

 

Erase/Reset Profile Manager database

sudo /Applications/Server.app/Contents/ServerRoot/usr/share/devicemgr/backend/wipeDB .sh

 

 

Restore Profile Manager

sudo -s
cat ~/Desktop/profileManager.sql | psql -h /Library/Server/ProfileManager/Config/var/PostgreSQL -U _devicemgr devicemgr_v2m0

 

 

If you are doing daily backups like I am I had added this to the script. It will make a copy of the database and add the date & time and copy it to another folder.

cp ~/Desktop/profileManager.sql /Profile\ Manager\ Database\ Backups/$(date +%B_%d_%Y_Time_H%H_M%M)_profileManager.sql

 

If there's interest in the scripts for doing this daily let me know.

Edited August 12, 2015 by Carter

[Carter]

As a quick update I've been running backups for over a week now and this is working great. Scripts run to backup the database every night and copies them to a backup share. Gives me a much needed sigh of relief that if I or someone else makes an adjustment which unfortunately there is no undo for or proper backups from Apple's end that I can rely on myself having done backups to roll back to.

[Jwzg]

Very nice!

[Carter]

I can now confirm this works! I actually had a server stop working and had to rebuild a new one from scratch and thank god I was running a script that dumped the database daily. I was able to setup profilemanager on a new server and restore the backup and now 100% backup and running.

 

Blows my mind that Apple has missed such a crucial option/step in Profile Manager.

[slancaster]

fantastic scripts, thank you.

 

I am having major profile manager issues at the moment. I think the migration from server 4 to server 5 went a little cuckoo - I receive "an error has occurred" when I try and browse profile manager via a web browser. A re-index of the DB sometimes helps (I have a script if anyone wants it?) but still no joy. I have a feeling there are some stale or currupt entered in the DB.

 

Any thoughts would be appreciated.

[Carter]

Not too sure why you would get that though doing an upgrade could be part of it.

Ddi you do a database dump in the script above before upgrading?

 

If not maybe try dumping it now and doing a wipe and restore.

 

I have a script setup to backup the database nightly at 4m and not only makes a copy on the local server HD but also places a backup on a remote server share incase the server itself has an issue that cannot be resolved.

[slancaster]

I didn't backup the DB before upgrade - learning the hard way I'm afraid

 

I have tried the export, wipe and re-import which hasn't fixed things but I may try again just to try my luck!

 

I definitely need to automate the DB backup on a daily basis, Mac Server seems to fragile - I can't believe how many people have problems after updates.

 

Would you mind sharing the last bit of the script to backup the files remotely please? Im sure a few people on here would benefit from it.

 

thanks.

[Carter]

I didn't backup the DB before upgrade - learning the hard way I'm afraid

 

I have tried the export, wipe and re-import which hasn't fixed things but I may try again just to try my luck!

 

I definitely need to automate the DB backup on a daily basis, Mac Server seems to fragile - I can't believe how many people have problems after updates.

 

Would you mind sharing the last bit of the script to backup the files remotely please? Im sure a few people on here would benefit from it.

 

thanks.

 

 

I've updated the article with the scripts here How To Backup Profile Manager Database (Working Solution for OS X 10.10)

[slancaster]

muchos gracias!

[slancaster]

Just for information... I did managed to SUCCESSFULLY restore my entire server from a Time Machine backup.

I rolled back from El Capitan Server 5.4 to Yosemite Server 4... simply by restoring from time machine backup.

I'll be honest and say I was a little nervous, but everything came back fine. All I had to do was rebind the Mac to AD and wait for the profile manager tasks to settle down a bit.

 

I didn't need to archive OD or backup PM Database. Definitely worth doing the backups obviously but thought I'd post a success story just in case anyone else was in the same boat.

 

Server 5 with VPP killed my set up so I shall revisit this slowly...

[Carter]

Just for information... I did managed to SUCCESSFULLY restore my entire server from a Time Machine backup.

I rolled back from El Capitan Server 5.4 to Yosemite Server 4... simply by restoring from time machine backup.

I'll be honest and say I was a little nervous, but everything came back fine. All I had to do was rebind the Mac to AD and wait for the profile manager tasks to settle down a bit.

 

I didn't need to archive OD or backup PM Database. Definitely worth doing the backups obviously but thought I'd post a success story just in case anyone else was in the same boat.

 

Server 5 with VPP killed my set up so I shall revisit this slowly...

At least you are back on track with your previous Server 4 Setup

[slancaster]

Big shame server 5 is so flaky.

I have been brave and upgraded to server 5 now as our environment is more stable (last time we upgraded we just so happened to have a nightmare with our web filter and new firewall).

The bugs are still there in server 5.04, but if I disable VPP in profile manager, things are more stable - but unfortunately slow and still get the odd "reload" error message.

 

Come on Apple, this is a poor update

[ishai222]

Hi all,

 

I saw you have managed to restore to a new server.

Was that new server configured the same as the old one (i.e. hostname, DNS record etc.) or were you able to restore profile manager to a completely different server?

I tried that without any success cause i can't take down the current server obviously.

 

Thanks in advance

 

Ishai

[slancaster]

I rolled back to the same machine via Time Machine. just had to rebind to AD and give profile manager a while to settle and "update info" on devices.

 

I did want to restore to a newer, better server but this was set up with a RAID array so Time Machine wouldn't go on to it. I could of used "migration assistant" but never done that with a server so I chickened out...

[ishai222]

Ok. Thanks !

I was looking for a way to do it like the policy in workgroup manager where you can export it and import into a different server.

I guess profile manager is bound to a specific hostname so that would probable not be possible.

Thanks again

[slancaster]

ah i gotcha. you can export the profile manager database and reimport it with terminal commands - got them here somewhere if you want them? that SHOULD contain everything. You can also export your oped directory config and import this in to the new server. I believe these go hand in hand with each other.

 

Its on my "to do" list to attempt a backup and restore a server using time machine but would rather do this on a test server rather than a live one.

 

- - - Updated - - -

 

http://www.edugeek.net/forums/mac/104624-how-backup-restore-apple-profile-manager-database.html

[Carter]

ah i gotcha. you can export the profile manager database and reimport it with terminal commands - got them here somewhere if you want them? that SHOULD contain everything. You can also export your oped directory config and import this in to the new server. I believe these go hand in hand with each other.

 

Its on my "to do" list to attempt a backup and restore a server using time machine but would rather do this on a test server rather than a live one.

 

- - - Updated - - -

 

http://www.edugeek.net/forums/mac/104624-how-backup-restore-apple-profile-manager-database.html

This post is for the old Server App. Use the directions in the first post of this topic for backing up and restoring a database.

[ishai222]

Thanks.

So just to make sure - is it possible to export and import Profile Manager from one server/hostname to another ?

[Carter]

Thanks.

So just to make sure - is it possible to export and import Profile Manager from one server/hostname to another ?

Yes I've exported a PM database then wiped the server and then used the Backup to restore. That said, I've done so with the server name staying the same. I have not restored a database with a server having a different hostname. Most likely would not matter but worth mentioning.

[Carter]

**UPDATE**

I can confirm that you can backup a database for Server App PM 5.0

I have not tested a restore of Server App PM 5.0 yet.

[hairyice]

There are some serious security issues that users of these scripts should be made aware of.

 

Plaintext account, wifi, and other passwords will appear in the .sql dump file. It it necessary to take precautions to encrypt and protect these backup files.

 

Here's a suggested modification that will gpg-encrypt the compressed .sql file, and also backup Open Directory, serveradmin settings, and other PostgreSQL tables.

 

#!/bin/bash
umask 077

OSX_SERVER_BACKUP=/private/var/backups/osx_server_backup
TS=`date ''+%F''`
ODBACKUP_PASSWD=protect-this-shell-script-too-because-it-has-the-plaintext-backup-passphrase

if [ ! -d "$OSX_SERVER_BACKUP" ]; then
       mkdir -m 700 -p "$OSX_SERVER_BACKUP"
fi

# Remove archives older than one year
find $OSX_SERVER_BACKUP -mindepth 1 -mtime +365 -exec /bin/rm {} ';'

# Open Directory backup
/Applications/Server.app/Contents/ServerRoot/usr/libexec/server_backup/openDirectory_backup -cmd backup -log /private/var/log/server_backup/openDirectory_backup.log

# Open Directory backup backup
cat <dirserv:backupArchiveParams:archivePassword = $ODBACKUP_PASSWD
dirserv:backupArchiveParams:archivePath = $OSX_SERVER_BACKUP/od_$TS
dirserv:command = backupArchive
SERVERADMIN_ODBACKUP

# serveradmin configuration plist
sh -c "serveradmin -x settings all | bzip2 -c | gpg -o - -c --passphrase $ODBACKUP_PASSWD > $OSX_SERVER_BACKUP/serveradmin_$TS.plist.bz2.gpg"
chmod go-rwx $OSX_SERVER_BACKUP/serveradmin_$TS.plist.bz2.gpg


# Backup all tables
sh -c "/Applications/Server.app/Contents/ServerRoot/usr/bin/pg_dumpall -U _postgres | bzip2 -c | gpg -o - -c --passphrase $ODBACKUP_PASSWD > $OSX_SERVER_BACKUP/postgres_$TS.dumpall.bz2.gpg"
chmod go-rwx $OSX_SERVER_BACKUP/postgres_$TS.dumpall.bz2.gpg

# Backup Profile Manager
sh -c "pg_dump -h /Library/Server/ProfileManager/Config/var/PostgreSQL -U _devicemgr devicemgr_v2m0 -c | bzip2 -c | gpg -o - -c --passphrase $ODBACKUP_PASSWD > $OSX_SERVER_BACKUP/ProfileManager_$TS.dump.bz2.gpg"
chmod go-rwx $OSX_SERVER_BACKUP/ProfileManager_$TS.dump.bz2.gpg

[jrpmedia]

Might we have an update of this please for OSX Catalina and Big Sur?

As it does not work for those macOS'

 

... or maybe there is an App to do it now? :-)