Backup Manager — install & user guide

Every device on your network holds a configuration that took someone a long time to get right. Backup Manager logs in to each of them on a schedule, takes that configuration away, and keeps every version it has ever seen. When a device fails you restore from last night. When something stops working you look at what changed and when.

It talks to equipment over SSH, including older kit that only accepts legacy ciphers, over Telnet for devices that offer nothing else, and over HTTP/HTTPS for firewalls with a config-export API. It runs on your own server — no cloud, no agent on the devices.

The dashboard — device and backup counts, storage used, server CPU, RAM and disk, and recent jobs.

Want a different port or a different place for the data? Pass them in:

Once you are in, go to Settings and set the password policy, session timeout and login lockout to whatever your organisation requires.

When the service first starts it contacts the Optimus Secure licence server and is issued a 15-day trial. The clock starts then, not when the licence was created, so a trial is always a full trial. The Licence page in the sidebar shows what you have and how long is left.

To continue past the trial, talk to us and we will extend the term. You do not have to do anything on your server — the installation picks up the new term on its next check, within a few hours. You can force it immediately with Check now on the Licence page.

The Licence page — plan, expiry, device usage, machine fingerprint and what is available.

No internet on this server? Open the Licence page, copy the machine fingerprint and send it to us. We will send back a signed licence file that you paste under Offline activation. It is tied to that one machine and needs no network at all, ever.

Go to Credentials and add each login you use — a username with a password, or an SSH private key with its passphrase, plus an enable password where the device needs one. Everything is encrypted before it is written to disk.

When you add a device you can then just pick a saved credential instead of typing it again. Changing a password later means editing it in one place rather than on forty devices.

The Devices page — every device with its host, platform, mode, schedule and retention.

On Devices, press Discover and give it a subnet in CIDR form, for example 172.26.10.0/24. It checks TCP 22, 23, 443 and 80 on every address and lists what answered, with the SSH banner where there is one. A /24 takes about a minute. Anything already in Backup Manager is marked already added so it cannot go in twice.

Choosing what to add

Tick the ones you want, or press Select all new and untick the few you do not. Every row also has Add this one: that opens the ordinary Add Device form with the address already filled in, so a single device gets every option that form has.

Adding a batch offers the same settings — platform, what to back up (including HTTP), exclude patterns, the enable password, schedule, retention, parallel sessions, tags, and whether they start enabled or paused.

One login for the lot

A rack of switches usually shares one account, so the form asks how to log in before anything else:

Choosing a saved set takes the username and password fields away and tells you which account it will use — the set supplies the login, so there is nothing to type. Everything else can be changed per device afterwards.

Naming the kind of device

The Platform list is a label used for grouping and for reading the device list, and it is not fixed. Choose + Add a platform… in any platform list, give it a name, and it is there from then on — for the switch vendor, appliance or box that is not in the list as shipped.

Manage the ones I added… in the same list removes them again. The names that came with Backup Manager stay, and one still in use by a device is kept until those devices are changed.

There is also Import CSV next to Discover, for when the list comes from somewhere else.

Profiles for Cisco IOS, Juniper, Aruba, MikroTik, D-Link, Sophos, Cambium and Ruckus are built in. Each one knows how to log in, get to enable mode, turn off the --More-- pager and print the configuration.

If your device is not covered, open Device Profiles and build one: add each step as a command with the prompt to wait for. You can copy an existing profile and adjust it, which is usually quicker than starting from nothing.

Device Profiles — built-in command sequences, and your own alongside them.

Each device has its own schedule, chosen from a time picker rather than written as a cron expression. Give different devices different times — or give them the same time and let the built-in stagger spread them out, so forty switches do not all get hit on the same second.

A job that fails retries on its own, with a growing gap between attempts. Jobs that are queued or running appear under Running Tasks with a live percentage, so you can watch a large copy progress instead of wondering whether it has hung.

Running Tasks — what is queued, what is running, and how far along it is.

Every capture is compared with the one before it. If the configuration is identical, the existing version is marked as seen again. If it differs, a new version is stored and the device appears on the Changes page with the number of lines added and removed.

Open any change to see a line-by-line diff. Open any device to walk back through its full history and compare any two versions — last night against last month, or before and after a maintenance window.

Configuration Changes — which devices changed, when, and how much.

Rules are patterns that a configuration must or must not contain — telnet still enabled, no AAA configured, SNMP using a default community string, logging not pointed anywhere. A set of sensible rules ships with the product and you can add your own with a severity.

Run the check across every device, against a single device, or against one specific stored configuration. That last one lets you answer "was this device compliant in March?" — and because it is a look back at history, the result is shown but not saved, so the dashboard keeps reflecting how things stand today.

Compliance — rule results per device, with the exact line that failed.

Backup Storage lists every archive with its size, status and when it finished. For network devices you can read the captured configuration in the browser without downloading anything. For server backups you can look inside the archive and pull out a single file rather than fetching gigabytes.

Backup Storage — every stored archive, with view, download and delete on each row.

Open Config Push. The page is three steps on one screen: what to send, where to send it, and what happens around it.

1 · What to send

Type the commands one per line, exactly as you would type them into PuTTY. Nothing is added or rewritten — if the change needs enable, configure terminal and write memory, those are lines you type. A line starting with # is a note to yourself and is not sent.

A command can carry values that differ per device: {{name}}, {{host}}, {{username}}, {{platform}} and {{tags}}. Sets you use often can be saved by name and loaded again.

2 · Where to send it

Tick the devices. Search by name or address, narrow by platform, or use Select shown to take everything the filter is showing. Nothing is ever sent to "all devices" by default — the Push button stays disabled until you have chosen, and it tells you how many it will reach.

3 · Try it on one device first

Try on one device opens a live session to a single device from your selection. Press Run my commands here and you watch the device answer line by line. There is a box at the bottom to type anything else you want to check, and the session stays open while you do. When it looks right, Looks good — push to N takes you straight to the rest.

This is the same code that runs the real push, so what you see here is what the other devices will do.

Just opening a device

Every device in the list has a Console button, and there is an Open a device console button with the others. Either one opens a real terminal on that device — no commands to write first, nothing to select.

It behaves the way PuTTY does, because every key you press goes straight to the device rather than being collected into a line first:

Paste sends a block of text — a config stanza, for instance — as if it had been typed, and Maximise gives the session the whole window. The device is told the new size, so it wraps and pages to what you are actually looking at. The same button is on the configuration viewer.

What happens around the change

While it runs, and afterwards

Each device gets a row: waiting, running, done, failed or skipped, how far through the set it got, and how many configuration lines changed. What happened opens the full transcript for that device — every command and everything the device said back. You can stop a push part way; devices already changed stay changed, and the rest are skipped.

When a device says no

A device that answers Invalid input, % Incomplete command or command not found is marked failed rather than counted as a success, and the rest of the set is not sent to that device — running the remaining commands after one was refused is how half a change gets made.

The row tells you both things you need: how many commands went in before it stopped, and what the device actually said. The same reason appears against the run in Recent pushes, so you do not have to open anything to see it.

Config Push needs the operator or administrator role. A viewer cannot open it.

Backup summaries, compliance status, change history and device health can each be produced as a PDF with charts and tables. Download one whenever you like, or set up a schedule — weekly, or a date and time you choose — and have it emailed to whoever needs it.

Reports — scheduled reports, their recipients and when they last ran.

Health separates devices that have never backed up successfully, ones that used to and have stopped, and ones failing repeatedly. It is the page to look at first thing, and the one to check after adding a batch of devices.

Set up notifications under Settings so you do not have to look. Email, a webhook or Slack, triggered when a job fails, when a configuration changes, or as a daily summary at a time you pick.

Health — never backed up, stopped backing up, and repeatedly failing.

Under Settings you can point Backup Manager at S3-compatible storage and have every archive mirrored there automatically. If the backup server itself is lost, the backups are not.

Retention keeps the disk from filling up. As well as a simple age limit per device, there is a grandfather-father-son scheme that keeps a number of daily, weekly and monthly copies — so you keep a year of history without keeping a year of daily archives.

There is also an audit log of every action taken, and a login history. For scripts and monitoring, create an API token under Settings rather than sharing an account password.

From the dashboard

Open Licence and press Check for updates. If a newer release exists you get the version, its size, when it was published and what changed — and an Install update button next to it.

The page follows the update as it runs. Part way through, the service restarts — that signs you out, which is expected. Sign back in and the Licence page picks the update back up and tells you how it ended.

From the terminal

The same update, run by hand. It asks the licence server what is available, shows you the release notes, and installs it if you say yes. The download is checked against a published SHA-256 and refused if it does not match, so a tampered mirror cannot push code onto your server.

What happens to your data

Your database is copied aside first, the new version is put in beside the old one, and the service is switched over. If the new version does not come up healthy, the old one and the database go back automatically — by either route. Backups, configuration and history are never replaced.

The quickest thing you can send us is the output of sudo journalctl -u backup-manager -n 200 along with the device name and what you were trying to do. For a device that will not connect, the Test Connection transcript tells us most of what we need.