How to fix XML backup from troubleshooting page for health check post upgrade

Question

Post jira upgrade, we are getting for XML backups in troubleshooting health check page, how to resolve it ?

Philipp Sendek _catworkx_ · Answer

Hi,

as stated in the documentation, you should ideally not have any XML backup files in these directories. XML backups are not a reliable backup method for Jira. If you use them for temporary purposes like a project import, that's fine, but you should delete them as soon as possible.

Also, if automatic creation of backup files is enabled, you should disable it and ensure that you are creating proper backups of your Jira instance. And then delete the XML backup files or alternatively move them to a safer location (folder) where you are sure no one has access to them. Right now, theoretically any Jira administrator or an attacker abusing a vulnerability could read out those files.

So in short: You should have a proper backup method for your Jira and neither have the automatic backup service enabled, nor should you store any XML backup files in the import or backup directory.

Greetings
Philipp

Bhargavi Vasa · Answer

Yes XML backup files found in the backups or import folder of Jira, as documented here

Do we need to move this folder to a different location or how to fix this? We don't have any secure storage

Philipp Sendek _catworkx_ · Answer

HI @Bhargavi Vasa ,

Going through the health checks I might know what you're referring to: 
Are you talking about the health check around XML backup files found in the backups or import folder of Jira, as documented here?
https://confluence.atlassian.com/jirakb/health-check-local-backup-security-1346245564.html

If so, you will find the answer to it on the documentation page. In short: XML backups are not a supported backup method for Jira. If you want to backup your instance, you should instead use proper methods to backup the server/virtual machine or the filesystem as well as the database and all other systems that store data for your Jira instance (such as shared storages).
Additionally, those backup files are not encrypted which means that whoever has access to those files can "rebuild" your Jira instance; this is also the reason for the health check.

I hope that helps!

Greetings
Philipp