> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/switch-infrastructure/config-manager/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/switch-infrastructure/config-manager/_mcp/server.

# Site Configuration Backup

The Site Configuration Backup workflow captures running configurations for every in-scope device at a site. It fans out one [Configuration Backup](/switch-infrastructure/config-manager/user-guides/configuration-deploy/configuration-backup) child workflow per device, aggregates the per-device results, and produces a consolidated report distinguishing successes, failures, and whether each backup changed the stored snapshot.

Use this workflow when you need a fresh site-wide backup outside the normal scheduled backup run—for example, before a maintenance window or broad configuration change. For a single device, use [Configuration Backup](/switch-infrastructure/config-manager/user-guides/configuration-deploy/configuration-backup) directly.

## Prerequisites

Before running, confirm the following are in place for the devices you expect to include:

* **Devices exist in Nautobot** with primary IPv4, platform, and managed status. The workflow resolves the device list from Nautobot using your site, role, status, and tenant filters.
* **Devices are reachable** from Config Manager on their management addresses, and credentials are current in the secrets store.
* **Intended configurations are available** in the [Config Store](/switch-infrastructure/config-manager/services/config-store/overview) when you want drift detection on each child backup. Each child compares running config against the device's rendered intended configuration from the Config Store.
* **Backup paths are configured** on device records so each child can record where the snapshot landed.
* **User attribution is present.** UI and CLI submissions populate the requesting user automatically; the workflow rejects requests with no user attached.

By default the workflow includes only devices with **backup enabled** in Nautobot. Uncheck **Backup enabled only** on the form to include all managed devices that match the other filters.

## Running the workflow

1. Navigate to the Config Manager URL for your environment.
2. Click the **+** in the top right and select **SiteBackupWorkflow**.
3. Fill in the form using the field reference below and submit.

![Site Configuration Backup workflow form](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/config-manager.docs.buildwithfern.com/3d96d569538a0e4032a71023dffca9ce6c219c0bada46f9d74f3889d0c267741/_dot_dot_/assets/images/workflows/backupworkflow-form.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260726%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260726T021223Z&X-Amz-Expires=604800&X-Amz-Signature=cd52515a4c1597ba11adc972e9762f3d95f419ea726a50cca06a1eb0edd39614&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

| Field                   | Description                                                                    | Required                 |
| :---------------------- | :----------------------------------------------------------------------------- | :----------------------- |
| **Site**                | The site whose devices should be backed up.                                    | Yes                      |
| **Roles**               | Device roles to include (multi-select). Leave empty to include all roles.      | No                       |
| **Device Status**       | Device statuses to include (multi-select). Defaults to Active and Provisioned. | Yes                      |
| **Tenant**              | Nautobot tenant filter.                                                        | No                       |
| **Backup enabled only** | When checked, only devices with backup enabled are included.                   | No (defaults to checked) |

After submission, a status page appears showing the three stages. The middle stage updates its display incrementally as child backups complete.

You can also start the workflow from the CLI. Authenticate first, then invoke `site-backup`. See [Temporal CLI](/switch-infrastructure/config-manager/services/temporal/cli-reference) for login and discovery details.

```bash
uv run workflow-cli login -H config-manager.example.com

uv run workflow-cli site-backup \
  -H config-manager.example.com \
  --site rno1 \
  --status Active,Provisioned \
  --backup-enabled-only true
```

## Execution stages

The workflow runs three stages. None require manual approval at the site level.

1. **`get_devices` — Resolve the device list from Nautobot.**

   Calls Nautobot with the supplied site, role, status, tenant, and backup-enabled filters. Supported platforms are Arista EOS, Cumulus Linux, and NV-OS. The stage display lists the devices that will be backed up.

2. **`perform_backups` — Fan out a child backup per device.**

   For each device, the workflow starts a [Configuration Backup](/switch-infrastructure/config-manager/user-guides/configuration-deploy/configuration-backup) child workflow with `trigger=WORKFLOW`. Children run in parallel; the stage display updates as each completes. A child that fails is recorded in the per-device result rather than stopping the run.

3. **`format_result` — Aggregate per-device results.**

   Combines all child outcomes into a markdown summary with success, failure, changed, and unchanged counts. Each entry includes a child-workflow link or workflow ID for follow-up.

## Result structure

The workflow returns a markdown summary. Each successful device entry notes whether the backup **changed** the stored snapshot (`changed`) or matched the previous backup (`unchanged`), plus a child-workflow link or workflow ID. Failed entries include the error message and a child-workflow link or workflow ID.

## Partial failures and re-runs

A child failure does not stop the rest of the site. To recover:

1. Open the consolidated result on the workflow status page and review failed devices.
2. Click through to each child workflow to read the underlying error.
3. Resolve per-device causes (reachability, missing intended config, credentials).
4. Re-run **Site Configuration Backup** with the same inputs, or run [Configuration Backup](/switch-infrastructure/config-manager/user-guides/configuration-deploy/configuration-backup) against individual devices.

Re-running the site workflow is safe. Devices that already have a current backup typically complete quickly with `unchanged` results.

## Common issues

**No devices found matching the specified filters.**

The site name, role, status, tenant, or backup-enabled filter excluded every device. Widen the filters or confirm devices are managed and on a supported platform.

**Many children fail with reachability errors.**

Management connectivity or credentials are wrong for part of the site. Fix reachability, then re-run or back up the failed devices individually.

**Drift alerts appear on child backups.**

The running configuration differs from the intended configuration in the Config Store. This is expected when devices have diverged; investigate drift on each child workflow before applying new changes.

**Missing user for backup attribution.**

The workflow was started without a user context. Submit through the UI or API with authenticated user attribution.

## Related guides

* [Configuration Backup](/switch-infrastructure/config-manager/user-guides/configuration-deploy/configuration-backup) — the per-device child workflow, also runnable directly.
* [Configuration Deploy](/switch-infrastructure/config-manager/user-guides/configuration-deploy/configuration-deploy) — apply intended changes after capturing a site baseline.
* [Controlling Running Workflows](/switch-infrastructure/config-manager/user-guides/controlling-running-workflows) — approve, retry, or terminate long-running site backups.