Documentation — clouderra

1. Installing the agent

The agent is a single statically linked binary and a unit file. It needs read access to the data you're copying and an outbound connection to our intake over TCP 443. The agent accepts no inbound connections and listens on no port.

The enrollment token is issued in the panel and is valid for 24 hours. After enrollment the agent switches to its own key and the token becomes useless.

Run it as a dedicated user, not root, if you're only copying files.
For database dumps it needs access to the DB socket and a role with read on all schemas.
The encryption key is printed exactly once at first initialization. Store it off this server.

If you lose the encryption key, no one can restore the copies — us included. This isn't a formality: we physically don't hold the second half of the key.

2. The first copy

Make the first job narrow — one directory or one database — and confirm it completes end to end. A full copy of the whole server as a first step usually hits the maintenance window and masks the real configuration error.

Progress is visible in the panel and in the agent log. Speed on the first copy is bounded by your link; we don't shape intake.

3. Scheduling

Set a start time and a maximum window duration. If a job regularly overruns the window, split it: two 40-minute jobs behave more predictably than one at an hour and a half.

Data type	Sensible interval	Note
Application files	1 day	Change on deploy, not constantly
User uploads	1–4 hours	Small increment, short window
PostgreSQL database	1 day + WAL	WAL gives a point at any moment
MySQL database	6–12 hours	Logical dump on a replica if you have one

4. Restoring

A restore always goes to a new location, never over the source. This is a deliberate limit: restoring over a running system is the most common way to turn a partial failure into a total one.

Choose a restore point and a target server where the agent is installed.
Specify the destination directory. The agent won't accept an existing non-empty directory.
Wait for completion and check the report: file count and total size.
For databases — bring up an instance on the restored data and check it separately, before switching the application over.

Restore speed is usually higher than copy speed: data is read from the nearest region and not recompressed.

5. Integrity checks

The scheduled check runs on our side and needs no involvement from you. An unscheduled one can be started manually — it's billed separately and takes from a few minutes to a few hours depending on volume.

The verification report lists the reconciled objects, any mismatches, and the agent version the copy was taken with. Mismatches aren't collapsed into a number — you see the specific paths.

6. Common errors

agent: token expired: The enrollment token is older than 24 hours. Issue a new one in the panel; no need to reinstall the agent.
snapshot: no space for LVM snapshot: No free space in the volume group for a snapshot. You need a reserve on the order of 10–15% of the volume size.
pg: role lacks CONNECT on database: The agent role can't see one of the databases. Grant CONNECT or exclude the database from the job explicitly.
window exceeded, job marked partial: The job didn't fit the window. Data that made it through is saved; the point is marked incomplete and isn't used for verification.

Didn't find what you needed — write to support@clouderra.ru, attaching the agent log for the period and the job ID.