Monitor restore activity with the Code42 API

Step 1: Download the script from GitHub

The example script, restoreWatch.py, is located on GitHub. You may download the script in one of two ways:

• Use git:
  • From a command line, enter:
    git clone https://github.com/code42/crashplan_api_examples.git
  • This downloads the entire crashplan_api_examples directory, including the restoreWatch.py script.
• Access the website:
  1. Navigate to the Code42 GitHub page.
  2. Click Raw file.
  3. Copy the script directly from the browser window.

Step 2: Place the script on a test device

The restoreWatch.py script can be run from:

• A Code42 server (either a master server or storage server).
• Any computer, server, or workstation able to communicate securely with the master server on port 4285 or 4280.
  • Using port 4285 and SSL is recommended for security reasons.
  • Using port 4280 may expose sensitive data.

The restoreWatch.py script can run on any device that has version 2.7 or higher of the Python language.

To install the restoreWatch.py script:

1. Copy the script to the device and directory where it will run.
2. Change the permissions of the script to allow execution of the script (for example, using Unix/Linux chmod).
   • The restoreWatch.py script may contain sensitive information such as the username and password of a user with SYSADMIN privileges on your master server.
   • Set permissions as restrictively as possible to prevent unauthorized access to the file contents.

Step 3: Modify the script by adding parameters for your test environment

Change the values of the parameters below to match your test Code42 environment. Before making changes, make a backup copy of the original script.

Set the parameters described below to values that test the script accurately for your Code42 environment. Each parameter is in the section of the script defined by the headings below:

Step 4: Test the script

You are now ready to test the restoreWatch.py script from the command line. Running the script from the command line before adding it to your system's job scheduler has the following advantages:

• You can immediately see any errors generated by the script.
• Files generated by the script are immediately available for inspection.

python restoreWatch.py

linuxServer:dataLeakPrevention admin$ ls -al
total 208
drwxr-xr-x   8 admin  root root    272 May 29 14:20 .
drwxr-xr-x  19 admin  root root    646 May 28 20:52 ..
-rwxr-xr-x   1 admin  root root  24081 May 28 20:57 restoreWatch.py
-rw-r--r--   1 admin  root root    891 May 29 14:25 restoreWatchData
linuxServer:dataLeakPrevention admin$ date
Fri May 29 14:26:39 CDT 2015

Step 5: Add the script to a job scheduler

Add the restoreWatch.py script to your system's job scheduler.

On a Linux system, use the command crontab -e to add the script to the system or user's crontab file. See the Linux man page for crontab for more information.

The following crontab entry runs the restoreWatchy.py script every minute:

* * * * * python /home/ubuntu/restoreWatch.py

Step 6: Test the script after the job scheduler runs

1. After the script is run by your system's job scheduler, perform one of the following types of restores based on the settings that you configured in Monitored User Parameters:
   • A web restore
   • A number of client restores that exceeds the threshold set by the TOO_MANY_RESTORES_THRESHOLD parameter
   • A web restore that is performed by a user who is not the owner of the files
   • A web restore to a device that is not the same device as the source of the files

2. After the next scheduled run of the script, confirm that the file restoreWatch.csv exists in the directory where the restoreWatch.py script is located, or that it was appended with the new data if you did not delete it in Step 4.
   Each run of the script appends to the existing csv file. The script does not create a new csv file during each run.

3. Open the csv file with a spreadsheet program such as Excel to verify that the contents contain the restore events that you used to trigger the script.
4. Confirm that the alert email was sent to the configured admin, and optionally to the monitored user's email address.

Step 1: Find the data dictionary object "initial_data"

1. Using your favorite text editor, such as vim, Notepad, or Emacs, open the restoreWatch.py script.
2. Navigate to the location in the file where the data dictionary variable initial_data is declared:

## Modify initial_data dictionary object with care.
initial_data={ USERID:{
                              'too_many_restores_action':TOO_MANY_RESTORES_ACTION,
                              'too_many_restores_threshold':TOO_MANY_RESTORES_THRESHOLD,
                              'non_origin_device_restore_action':NON_ORIGIN_DEVICE_RESTORE_ACTION,
                              'non_owner_restore_action':NON_OWNER_RESTORE_ACTION,
                              'web_restore_action':WEB_RESTORE_ACTION }
                              }

Step 2: Append additional users

Add additional users by copying and pasting the first entry in the data dictionary, separating each new entry with a comma. In this example, two additional users to monitor were added, with userIds 1001 and 1002:

## Modify initial_data dictionary object with care.
initial_data={ USERID:{
                              'too_many_restores_action':TOO_MANY_RESTORES_ACTION,
                              'too_many_restores_threshold':TOO_MANY_RESTORES_THRESHOLD,
                              'non_origin_device_restore_action':NON_ORIGIN_DEVICE_RESTORE_ACTION,
                              'non_owner_restore_action':NON_OWNER_RESTORE_ACTION,
                              'web_restore_action':WEB_RESTORE_ACTION },
                1001:{
                              'too_many_restores_action':TOO_MANY_RESTORES_ACTION,
                              'too_many_restores_threshold':TOO_MANY_RESTORES_THRESHOLD,
                              'non_origin_device_restore_action':NON_ORIGIN_DEVICE_RESTORE_ACTION,
                              'non_owner_restore_action':NON_OWNER_RESTORE_ACTION,
                              'web_restore_action':WEB_RESTORE_ACTION },
                1002:{
                              'too_many_restores_action':TOO_MANY_RESTORES_ACTION,
                              'too_many_restores_threshold':TOO_MANY_RESTORES_THRESHOLD,
                              'non_origin_device_restore_action':NON_ORIGIN_DEVICE_RESTORE_ACTION,
                              'non_owner_restore_action':NON_OWNER_RESTORE_ACTION,
                              'web_restore_action':WEB_RESTORE_ACTION }
                              }

Note that the monitoring settings defined under MONITORED USER PARAMETERS apply to all of the users being monitored, although these parameters could also be customized for each user by replacing the constants in all caps with literal values, such as WARN or BLOCK.

Resource usage

The restoreWatch.py script calls the Code42 API RestoreRecord and User resources on every run for each user being monitored. Using the script to monitor large numbers of users, or running the script at frequent intervals, could cause performance issues for the script and your Code42 environment. You should test any application of the script in a realistic test environment before deployment.