Where Does T-Pot Store Configs and Logs?
Where self hosted T-Pot keeps configs and logs on Linux servers. Exact folders are covered below. More below.
Last updated
T-Pot is honeypot platform with server storage. The config plus data volumes hold honeypot states and attacker logs. Each honeypot writes to the shared store.
Same config plus data means same sensors. Exact paths vary by ISO versus Docker installs. Keep backups of config plus data together. One without the other restores sensors without history. For moves, stop services first to avoid partial writes during copies. Screenshots of settings help when support asks for reproduction steps later. Check the in app storage readout when sizes look wrong on different releases.
Where T-Pot Honeypot stores this, by platform
/var/lib/t-pot (config plus data, paths vary by install)
Sensors live in config plus data volumes on your server. Back up both together stopped. Match releases before restore. Attack logs follow the database.
Frequently asked questions
How do I migrate T-Pot to a new server?
Back up the T-Pot config plus data volumes with services stopped, then install the same release on the new server before restore. Honeypot events follow the database. Mixed releases can refuse old schemas, so match versions first.
Does T-Pot back up attack history?
Yes, in the server database per honeypot with event history attached. The host holds a working copy plus log cache. Views rebuild after restore. Export JSON events from the dashboard for records, since the data directory alone is working state.
Notice an outdated path? Let us know.