iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers VPS plans with one-click OpenClaw, NVMe storage and a 14-day free trial.
Use OpenClaw’s native openclaw backup commands instead of copying its live files. Create a verified archive, restore it into a new empty staging directory, point OpenClaw at the restored state, and run openclaw doctor before restarting the Gateway. This preserves configuration, credentials, sessions, databases, and—when selected—workspace data without risking an inconsistent SQLite copy.
What an OpenClaw backup contains
OpenClaw’s full archive workflow is designed to capture the state needed to move an installation, roll back an update, recover from a reset, or rebuild a failed machine. A full archive can include:
- OpenClaw configuration
- Authentication profiles
- Provider and channel credentials
- Session history
- OpenClaw databases and their verified snapshots
- Workspace files when workspace inclusion is enabled
Because those records can contain credentials and conversation or session history, an archive is a sensitive security asset, not an ordinary application export. Protect the archive itself as well as the server where it is stored.
Choose the right backup method
The simplest choice is a full archive. Database-specific methods are useful when databases are large, recovery points must be frequent, or you need versioned history rather than repeated complete copies.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Method | Best use | Main trade-off |
|---|---|---|
| Full archive | One-off protection, updates, resets, uninstall preparation, and machine moves | Complete copies use more storage and re-upload all selected data |
| SQLite snapshot | Compact, verified recovery of OpenClaw database state | Does not include every configuration or workspace file |
| Git backup | Versioned, incremental database history | Requires a private repository and a deliberate policy for secrets |
Litestream or sqlite3_rsync |
Frequent or near-continuous database protection | Adds operational components and requires a tested restore plan |
For a normal workstation or a planned server migration, make a verified full archive first. Add SQLite, Git, or continuous replication when the recovery-point objective is shorter than your archive schedule or when database storage dominates the backup size.
Create a verified full archive
1. Preview the archive
Use a dry run to see what OpenClaw intends to include before writing an archive:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →openclaw backup create --dry-run --jsonThe JSON output is useful for automation and for confirming that the expected state directory, databases, credentials, and workspace paths are being selected. Review the result before a destructive operation such as an upgrade, reset, or uninstall.
2. Write the archive to a protected destination
openclaw backup create --output ~/BackupsOpenClaw writes a complete .tar.gz archive. The local file is plaintext unless you separately encrypt the destination or the file, so a storage service that encrypts uploaded bytes does not remove the need to secure the local copy created first.
3. Verify while creating the archive
openclaw backup create --verifyVerification checks the archive’s internal structure and recorded data before you rely on it. Keep the verified archive and its creation date together in your retention system. A backup that has never been verified should not be your only recovery copy.
4. Exclude workspaces when they are protected elsewhere
openclaw backup create --no-include-workspaceThis produces a smaller archive containing OpenClaw state without workspace files. Use it only when workspace data has its own known-good backup and you can restore that data to the same paths or update the corresponding configuration after recovery.
5. Save only configuration when repairing a broken file
openclaw backup create --only-config --output ~/Backups/openclaw --verifyA configuration-only archive saves the active JSON configuration before you edit or repair it. It does not parse or include files referenced through $include dependencies, so preserve those dependency files separately. After the configuration is repaired and OpenClaw starts correctly, create a new full archive.
6. Apply retention for an offsite destination
openclaw backup create --to offsite --keep-daily 7 --keep-weekly 4 --keep-monthly 12This example keeps seven daily, four weekly, and twelve monthly copies at the named offsite destination. Confirm that the destination is private and that its access policy matches the sensitivity of OpenClaw credentials and session records.
Never copy live SQLite files
Do not make a file-level copy of a running OpenClaw database. The official warning is explicit: never copy live .sqlite, -wal, -shm, or -journal files as a backup. These files can represent different points in a transaction and may produce an incomplete or corrupt restore.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Use OpenClaw’s snapshot or archive mechanisms, which coordinate the database state and verify the result. Stop services only when your operational plan requires it; stopping a process and copying files manually is not a substitute for a verified OpenClaw snapshot.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDatabase-focused protection
SQLite snapshots
SQLite snapshots are compact and suited to database-only recovery. For the global database, create a repository with:
openclaw backup sqlite create --global --repository ~/Backups/openclaw-sqliteFor the main agent database, use:
openclaw backup sqlite create --agent main --repository ~/Backups/openclaw-sqliteThese snapshots address database state, not every workspace or configuration file. Keep a full archive for machine moves and use snapshots to add more frequent database recovery points.
Git-backed history
A private Git repository can provide incremental, inspectable database history. Initialize a repository that is inaccessible to other users, then use OpenClaw’s Git backup commands to create snapshots, inspect history, verify a snapshot, and restore one when needed:
openclaw backup git create
openclaw backup git log
openclaw backup git verify
openclaw backup git restoreSecret handling needs special attention. A repository that is accidentally public or shared with an untrusted administrator can expose the same credentials and session records as a leaked archive. Define who can read the repository, how long history is retained, and how credentials are rotated before enabling it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Continuous and incremental options
OpenClaw documents Litestream and sqlite3_rsync as alternatives for higher-frequency protection. They can reduce the amount of data lost between scheduled snapshots, but they add another service or synchronization path to operate. Document where replicas are stored, how to promote one to a fresh database, and how you will verify schema, foreign keys, and application behavior after a failure.
Schedule backups and handle secrets
OpenClaw’s managed backup jobs support offsite archives and Git modes. The documented default interval is 24 hours. That interval is a starting point, not a guarantee that it meets your recovery requirements: a busy installation may need a shorter database recovery point, while an infrequently used installation may accept daily archives.
Pushed schedules redact credential-bearing tables and secret-prefixed machine-state rows by default. This makes a remote history safer to operate, but it also means the remote copy may not be sufficient for a full-fidelity rebuild. The --include-secrets option enables full-fidelity remote history only when the remote destination is private and trusted. Local non-push schedules retain full fidelity.
Before enabling secret-inclusive pushes, confirm all of the following:
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- The remote repository or object-storage destination is private.
- Access is limited to the operators who need recovery capability.
- Encryption is enabled in transit and at rest.
- Retention and deletion rules are documented.
- You can revoke and rotate credentials if the destination is exposed.
Restore a full archive safely
1. Select and verify a trusted archive
Start with an archive you created or one whose origin and integrity you can establish. Do not restore an unknown archive over a live state directory. A restore is a privileged operation because it can replace credentials, sessions, and configuration.
2. Extract into a new, empty staging directory
openclaw backup restore ARCHIVE.tar.gz --target ./restored-openclawThe target must be new and empty. OpenClaw refuses a non-empty target to prevent an archive from silently mixing with leftover files. Keep the staging directory outside the live OpenClaw state directory and outside configured agent directories.
The restore process checks archive structure, manifests, links, and database snapshots before writing. If extraction fails, incomplete output is cleaned up rather than left as a misleading partial restore.
3. Account for custom agent roots
If an installation uses custom agent roots, preserve those paths in the restored environment or update each configured agentDir to the new location. A restored state directory with stale agent paths can appear healthy while pointing to missing sessions or workspaces.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute4. Put the restored state into service
After inspecting the staged files, either move the restored state into the location OpenClaw normally uses or point OpenClaw at it with OPENCLAW_STATE_DIR. Make sure the service account can read and write the restored files and that directory permissions do not expose credentials to unrelated users.
5. Run the doctor check before restarting the Gateway
openclaw doctorRun the check while the restored state is staged or selected, before restarting the Gateway. Resolve reported paths, permissions, configuration, and database problems first. Restart only after the doctor check is clean enough for your deployment and you have recorded any intentional warnings.
Restore database snapshots without contaminating live data
Database restore commands also require a fresh target. Do not restore a snapshot over a directory that contains an existing database or its sidecar files. OpenClaw verifies database integrity, foreign keys, schema, and hashes during database restoration. Treat a failed verification as a recovery incident: retain the original target, select another known-good snapshot, and investigate rather than deleting evidence.
For Git-backed history, inspect the log first, verify the selected snapshot, and restore it to an empty destination. For SQLite snapshots, keep the restored database separate until the integrity checks pass, then update the state or agent configuration to use it. A database-only recovery does not recreate missing configuration, credentials, or workspace files; combine it with the appropriate full archive when those assets are also needed.
Move OpenClaw to a new server
- Create and verify a full archive on the original machine. Include workspaces unless they are protected and transferable through a separate tested process.
- Copy the archive to the new server using an encrypted transfer or a protected offsite destination.
- Install the same OpenClaw release family required by your deployment and confirm the service account and filesystem permissions.
- Restore the archive into a new empty staging directory with
openclaw backup restore. - Preserve custom agent roots or update every affected
agentDirpath. - Point
OPENCLAW_STATE_DIRat the restored state, or move the staged state into the expected location. - Run
openclaw doctorand correct path, permission, schema, or configuration findings. - Start the Gateway only after validation, then test authentication, provider and channel connections, session access, scheduled jobs, and workspace paths.
- Keep the original machine or its final archive unchanged until the new server has passed those tests.
Restoring into staging first gives you a rollback point: if the new server has a path or permission error, you can discard the staged target and repeat without damaging the original installation.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Security controls for local and offsite copies
Full archives may contain authentication profiles, provider and channel credentials, session history, database records, and machine-state secrets. Apply the same controls to a local archive as to an offsite copy:
- Encrypt archives at rest and use encrypted transport when moving them.
- Restrict directory and object-storage permissions to the OpenClaw operators who need recovery access.
- Keep at least one copy in a separate failure domain.
- Use an offline or disconnected external SSD for local archives when practical; reconnect it only for backup or restore operations.
- Record archive dates, verification results, and retention expiry.
- Rotate credentials promptly if an archive or destination may have been exposed.
- Destroy expired copies securely, including copies in staging directories and temporary transfer locations.
An external SSD for backups can provide a simple second destination, but its protection depends on encryption, physical control, and whether it remains connected to the machine. A disconnected drive helps limit ransomware and accidental deletion, while an offsite destination protects against loss of the local equipment. Use both when the data warrants separate failure domains.
Troubleshoot common backup and restore failures
The archive is larger than expected
Run the dry-run command with JSON output and inspect whether workspaces or multiple databases account for the size. If workspaces have an independent, tested backup, create a state-only archive with --no-include-workspace. Do not exclude credentials or databases merely to reduce size when they are required for recovery.
Restore refuses the target
The target is probably non-empty or overlaps the live state or an agent directory. Choose a new empty path outside both locations. Move or rename an old test directory rather than deleting it until you have confirmed that no recovery files are needed.
The restored service cannot find sessions or workspaces
Check custom agent roots and configured agentDir values. A state archive can be intact while the configuration still points to the old server’s paths. Correct the paths, rerun openclaw doctor, and test access before restarting the Gateway.
A database copy fails integrity checks
Do not substitute a manually copied .sqlite, -wal, -shm, or -journal set. Select a verified OpenClaw SQLite snapshot, Git snapshot, or full archive and restore it to a fresh target. If every available point fails, preserve the failed outputs and investigate the storage or replication system before attempting further writes.
A remote history lacks credentials
Pushed schedules redact credential-bearing tables and secret-prefixed machine-state rows by default. That behavior is intentional. If a trusted private remote must contain a full-fidelity recovery set, use --include-secrets only after reviewing access, encryption, retention, and credential-rotation procedures. Keep a protected local full archive as an additional recovery option.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A practical backup plan
- Before every upgrade, reset, or machine move: create a verified full archive.
- Daily: run the managed schedule or an equivalent full-archive policy, adjusting the documented 24-hour default to your recovery needs.
- More frequent database recovery: add SQLite snapshots, private Git history, Litestream, or
sqlite3_rsync. - Monthly or after major changes: perform a restore rehearsal into an isolated empty directory and run
openclaw doctor. - After a credential incident: revoke or rotate affected credentials and replace every archive that may contain them.
The most reliable plan combines a verified full archive for complete rebuilds, a separate protected destination, and a restore test that proves the files can become a working OpenClaw state rather than merely existing on disk.
The Bottom Line
Use openclaw backup create --verify for complete protection, never copy live SQLite files, and restore only into a new staging directory. After paths and permissions are corrected, run openclaw doctor before bringing the Gateway back online.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
