Users may find that a system notification has been generated and the scheduled backup on Juniper Secure Analytics (JSA) has failed to complete due to the error "Backup: The last scheduled backup exceeded execution threshold."

This article explains what must be done to resolve the error and have the backup complete successfully.

 

Scheduled backups run for a long time, and then fail to complete successfully due to the error "Backup: The last scheduled backup exceeded execution threshold."

The following messages are also displayed in the /var/log/qradar.log file:

Jan 18 03:00:21 127.0.0.1 [Scheduled Backup]com.q1labs.hostcontext.backup.BackupRecoveryEngine: [WARN] [NOT:0150024101][10.x.x.x/- -] [-/- -]Backup has exceeded its time limit of 10800s, canceling...
Jan 18 03:00:21 127.0.0.1 [Scheduled Backup]com.q1labs.hostcontext.backup.BackupRecoveryEngine: [ERROR] [NOT:0150023105][10.x.x.x/- -] [-/- -]Backup Failed: TIMED_OUT

 

The system notification is generated because the configured backup time limit is being exceeded.

By default, configuration backups in JSA are set to time out in 180 minutes. In some cases, administrators might need to adjust this value or change the default priority setting if backups fail to complete in the allotted time. Administrators should start an investigation of this issue by reviewing the duration of any successful backups, and then adjust the backup time limit, if required.

 

When the above error occurs, administrators can take one of the following actions:

• Edit the backup configuration to extend the time limit configured to complete the backup. Do not extend the time limit over 24 hours.

OR

• Edit the failed backup and change the priority level to a higher priority. Higher priority levels allocate more system resources for completing the backup.

 

Procedure

To extend the time limit for the backup to complete or to modify the priority, perform the following steps:

1. Log in to the QRadar Console as an administrator.

2. Click the Admin tab.

3. Click the Backup and Recovery icon. This icon is found under System Configuration.

4. From the navigation bar, click Configure.

5. The default configuration for backups is to set a Backup Time Limit (min) of 180 minutes. Change this value to 720.

6. Verify that the Backup Priority field is configured to High.

7. Click Save.

8. From the navigation bar on the Admin tab, click Deploy Changes.

The administrator can monitor the status to ensure that a backup completes successfully. It is typically suggested that administrators set time limits on configuration backups to be 45–60 minutes longer than the longest backup.