LINUX-004 · Script
Create and Rotate File Backups
Creates a tar archive (optionally gzip-compressed) of each folder you list, verifies it can be read back and records a SHA-256 checksum, then removes this script's older archives beyond the retention period.
What it does
Report mode only lists what would be archived and which old archives would be removed. Rotation only touches files this script created (names like etc_HOST_YYYYMMDD-HHMMSS.tar.gz) in its own subfolders of --dest. Archives stop at filesystem boundaries (a separately mounted folder inside a source is not included; list it as its own source). Restore with: tar -xzf ARCHIVE -C / (or -xf for --compress=none). Store --dest on a different disk or copy it off the machine; a backup on the same disk does not protect against disk failure.
Requirements
Any Linux with tar, gzip and sha256sum (coreutils). Run as root so every file can be read. No prompts.
How to run it
- Run from: an admin workstation or scheduled task with the Microsoft modules installed and app sign-in configured
- This is an admin script for your Linux tenant, not a per-device endpoint script
- User interaction: none with app-only sign-in
- Schedule: run on demand, or weekly for reports
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| mode | default report | report, apply | report |
| sources | required comma-separated folders, for example /etc,/var/www | required | |
| dest | backup folder; default /var/backups/runbookia | /var/backups/runbookia | |
| compress | default gzip | gzip, none | gzip |
| keep-days | remove archives older than this; default 30 | 30 | |
| keep-min | default 3; always keep at least this many newest archives per folder, whatever their age | 3 | |
| exclude | optional comma-separated tar patterns to skip, for example *.tmp,cache |
Exit codes
- 0 = All backups created and verified (or report found nothing wrong)
- 1 = Attention needed: a source folder is missing, or files changed while
- being read (archive kept, but review it)
- 2 = Script error, or a backup failed or did not verify
Testing steps
- Run it first with the mode set to report on one test account or small group. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report mode changes nothing. Apply mode adds new archives under the backup folder and deletes only this script's own archives that are past the retention period; deleted archives cannot be recovered, so raise --keep-days or --keep-min first if you need older copies. To remove a new backup, delete its .tar.gz (or .tar) and .sha256 files. To restore files from a backup, run tar -xzf ARCHIVE -C / as root.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |