Tenable.sc RHEL Migration and Recovery Skill
Migrate Tenable Enclave Security / Tenable.sc to standalone RHEL 8 with external PostgreSQL, preserving data and runtime.
Baseline review at submission: an accuracy and overt-behavior check, not a full security audit, and it does not cover later changes to the repository. Learn more about our security review process.
A guided runbook for migrating or recovering Tenable Enclave Security / Tenable Security Center data onto a standalone RHEL 8 Tenable.sc host backed by external PostgreSQL (for example AWS RDS). Distilled from a real recovery after a container-to-RPM migration broke the fresh runtime.
What it does
Walks an operator through, in order: establishing rollback points (RDS snapshot, preserved failed /opt/sc, stopped-service tar backup); building a clean RPM runtime and proving it starts against the external database before touching data; selectively rsync-ing persistent data from the old tree while preserving the fresh host’s .pgvars and data/enc.key; and troubleshooting the usual follow-on failures — fapolicyd blocking PHP, PHP memory_limit exhaustion during feed updates, and /opt/sc growing from leftover feed directories. Includes an upgrade preparation checklist and a diagnostic decision tree.
How it works
The skill treats the external PostgreSQL database as authoritative application state and the RPM /opt/sc tree as replaceable runtime. Instead of overwriting the fresh RHEL runtime with a container /opt/sc tree (which carries different PHP/library binaries and causes silent startup failures), it rebuilds a clean RPM install against the preserved database, then overlays only persistent data directories (orgs, repositories, parts of data) with an explicit rsync exclude list. Each phase is gated by validation — connectivity, service start, feed/job processing — before the next destructive step runs.