# Tenable.sc RHEL Migration and Recovery Skill

> Migrate Tenable Enclave Security / Tenable.sc to standalone RHEL 8 with external PostgreSQL, preserving data and runtime.

- Type: Skill
- Author: conard0-git
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Last reviewed: 2026-10-05
- Source repository: https://github.com/conard0-git/tenable-enclave-to-sc-rpm-migration
- Repo state: not archived
- Last push: 2026-10-02T20:10:47Z
- Stars: 0 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Tenable, AWS
- Domains: platform-operations, vulnerability-management
- Tags: tenable, tenable-sc, security-center, migration, rhel, postgresql, aws-rds
- Date added: 2026-10-02
- Compatible platforms: Claude Code
- Invocation: `/tenable-enclave-to-sc-rpm-migration`
- Listing page: https://exchange.tenable.com/skills/tenable-enclave-to-sc-rpm-migration
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/tenable-enclave-to-sc-rpm-migration.md

A guided runbook for migrating or recovering Tenable Enclave Security / Tenable Security Center data onto a standalone RHEL 8 Tenable.sc host backed by external PostgreSQL (for example AWS RDS). Distilled from a real recovery after a container-to-RPM migration broke the fresh runtime.

## What it does

Walks an operator through, in order: establishing rollback points (RDS snapshot, preserved failed `/opt/sc`, stopped-service tar backup); building a clean RPM runtime and proving it starts against the external database before touching data; selectively `rsync`-ing persistent data from the old tree while preserving the fresh host's `.pgvars` and `data/enc.key`; and troubleshooting the usual follow-on failures — `fapolicyd` blocking PHP, PHP `memory_limit` exhaustion during feed updates, and `/opt/sc` growing from leftover feed directories. Includes an upgrade preparation checklist and a diagnostic decision tree.

## How it works

The skill treats the external PostgreSQL database as authoritative application state and the RPM `/opt/sc` tree as replaceable runtime. Instead of overwriting the fresh RHEL runtime with a container `/opt/sc` tree (which carries different PHP/library binaries and causes silent startup failures), it rebuilds a clean RPM install against the preserved database, then overlays only persistent data directories (`orgs`, `repositories`, parts of `data`) with an explicit `rsync` exclude list. Each phase is gated by validation — connectivity, service start, feed/job processing — before the next destructive step runs.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/tenable-enclave-to-sc-rpm-migration.json. The full index and how to read it: https://exchange.tenable.com/llms.txt