# All flows have disappeared on AWS hosted system

**URL:** <https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569>\
**Category:** General\
**Created:** [10 December 2023 10:02 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569 "2023-12-10T10:02:55Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![JonT](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@JonT](https://discourse.nodered.org/u/JonT)\
**Post date:** [10 December 2023 10:02 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/1 "2023-12-10T10:02:56Z")

</div>

I have been running a dashboard with some quite complex flows and nodes to show various environmental monitors passing data via MQTT. Node-red is installed on an AWS Ubuntu instance. This morning the dashboard UI is showing "Welcome to the Node Red dashboard" and no content. Accessing Node Red gives me the normal workspace but with no flows visible. The AWS instance has been stable and has not restarted. I have no idea what might have happened for me to have lost all of my content. Does anyone have any pointers of where I should start the journey to trying to recover my system? I'm pretty new to all of this and would be gutted if I had lost all of my work somehow.

Thanks,

Jon

---

<div class="post-metadata">

**Author:** ![jodelkoenig](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jodelkoenig/32/44645_2.png) [@jodelkoenig](https://discourse.nodered.org/u/jodelkoenig)\
**Post date:** [10 December 2023 10:30 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/2 "2023-12-10T10:30:17Z")

</div>

How do you expose your AWS Ubuntu instance to the internet?

It might be related:

> [@All flows gone after fresh install](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/1):
>
> Hello, i did a search first , but didnt find the answer. I was trying to setup a reverse proxy and all of a sudden my flows where deleted. I did a fresh install of OS, reinstalled nodered and mqtt. made sure all updates where done imported my back up and insured i had all the proper nodes inplace and re set up. i came in today and noticed i had no dashboard so i went into the editor. and there is no flows again. how do i see if there is a conflict causing my flows to be erased or what is c…

> [@Flows disappear after a few hours!](https://discourse.nodered.org/t/flows-disappear-after-a-few-hours/82458):
>
> I'm very bad at this. Have managed to install Node-Red and a MQTT on my ROCK 4 SE card with Debian 11. The installation took place in January 2023. Got nice Flows connected to my IOTs. Everything has worked great until now. My Flows just disappeared. Putting them back, import and then after about 24 hours they are gone again. Nothing else stops working but only Flows in Node-Red disappear. Node-Red works fine but is missing all my constructed Flows. Tried to search and read and somewhere they…

As for recovery. Does AWS do backups or snapshots for instances?

---

<div class="post-metadata">

**Author:** ![JonT](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@JonT](https://discourse.nodered.org/u/JonT)\
**Post date:** [10 December 2023 10:41 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/3 "2023-12-10T10:41:17Z")

</div>

A public IP address is linked to the UBUNTU instance. Accessing this is where I am seeing the problem. I have since rebooted the server which has changed the IP address but the problem persists.

I will take a look at the posts that you kindly posted. It's a year ago since I installed all of this I need to refresh my memory on how the AWS install works.

In terms of backups etc. If I look in ~/.node-red I can see a flows.json file which has a lot of content, but I'm not sure whether it is my content or not. It may be the default flows file I suppose.

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [10 December 2023 11:16 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/4 "2023-12-10T11:16:28Z")

</div>

In newer versions of Node-RED, there is an entry in ` ~/.node-red/settings.js` that tells the instance where the flows should be found. Without this, Node-RED will look for `flows_<hostname>.json` and therefore, if the hostname is dynamic, node-red will not find a flows file.

In short, set a definite flows file using the setting `flowFile: 'flows.json`

From the docs:

> `flowFile`  
> the file used to store the flows. Default: `flows_<hostname>.json`

See here for more info: [Configuration : Node-RED](https://nodered.org/docs/user-guide/runtime/configuration)

---

<div class="post-metadata">

**Author:** ![JonT](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@JonT](https://discourse.nodered.org/u/JonT)\
**Post date:** [10 December 2023 11:31 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/5 "2023-12-10T11:31:07Z")

</div>

Thanks Steve.

Looking in settings.js I can see the line

flowFile: 'flows.json'

So I am guessing that any change in hostname will not have had an impact. The flows.json file itself has a timestamp of 5am this morning. I am starting to think that I have possibly been hacked. The flows.json file that I can see just seems to be a collection of "exec" nodes, but I have no idea whether that is unusual or not.

Jon

---

<div class="post-metadata">

**Author:** ![cymplecy](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/cymplecy/32/2773_2.png) [@cymplecy](https://discourse.nodered.org/u/cymplecy)\
**Post date:** [10 December 2023 11:53 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/6 "2023-12-10T11:53:01Z")

</div>

> [@JonT](#):
>
> The flows.json file that I can see just seems to be a collection of "exec" nodes

99.99% you've been hacked ☹

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [10 December 2023 11:58 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/7 "2023-12-10T11:58:44Z")

</div>

Any node-red accessible from the internet without requiring credentials to get in is liable to be hacked. There are bots out there looking for them. You will have to rebuild the whole system I am sorry to say, and put it down to a learning exercise.

Then read this FAQ post for advice on how to safely access node-red over the internet.

> [@Safely accessing Node-RED over the Internet](https://discourse.nodered.org/t/safely-accessing-node-red-over-the-internet/45024):
>
> Update 2025-02-19 The best advice for most people doing home automation is still: Don't expose Node-RED to the outside world! Where you really have to have some outside access, keep it as hands-off and restricted as possible. For example, using a Telegram bot. Also keep it as minimal as possible, e.g. Don't expose the Editor - EVER! If you want to provide remote control of your heating or the precious plants in your greenhouse, provide explicit controls with strong limits. Don't expose ever…

---

<div class="post-metadata">

**Author:** ![JonT](https://avatars.discourse-cdn.com/v4/letter/j/5daacb/32.png) [@JonT](https://discourse.nodered.org/u/JonT)\
**Post date:** [10 December 2023 13:00 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/8 "2023-12-10T13:00:38Z")

</div>

Yep. I think you are all correct. And being new to AWS I had not set up a robust backup strategy (I have these everywhere else annoyingly).

So, back to the drawing board for the flows and back to school on security and backups.

Thanks for all the input folks.

Jon

---

<div class="post-metadata">

**Author:** ![Colin](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/colin/32/17040_2.png) [@Colin](https://discourse.nodered.org/u/Colin)\
**Post date:** [10 December 2023 14:01 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/9 "2023-12-10T14:01:15Z")

</div>

The file .flows.json.backup might have a previous copy of your flows file. Inspect carefully before trying it though, in case it has been infected.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [8 February 2024 14:02 UTC](https://discourse.nodered.org/t/all-flows-have-disappeared-on-aws-hosted-system/83569/10 "2024-02-08T14:02:02Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.