VBAK BEST PRACTICES V3.0

Transcription

1 VBAK BEST PRACTICES V3.0

2 Table of Contents Important Note...2 File System Backup task...3 Microsoft SQL Backup Task...4 Microsoft Exchange DR Backup Task...5 Microsoft Exchange Mailbox Backup Task...6 Retentions...7 Schedules...8 Encryption...10 Upgrading The Vbak Agents...11 Open Transaction Manager vs. Open File manager...12 Important Note Please check the download website on a regular basis to ensure you are using the latest software. You will also be informed of any new software releases by means of a message header on the daily report, an example is shown below, these will be listed for a period of 30 days. Latest Agent Release (5.31) is now available for download from 2

3 File System Backup task When creating a file system backup, it is advisable to ensure that files and folders that are not required (i.e. not business critical), are excluded. 1. Exclude extensions that are not required, for example:- c:\*.tmp temporary files c:\*.lnk link files c:\*.cab windows install files c:\*.mp3 - music files c:\*.aac nokia music files c:\*.avi movie files It is worth visiting a web site that lists the latest extensions and ascertaining which extensions relate to which application. Obviously if some of these are required by the business, then they need backing up. 2. Exclude folders that are not required, for example:- c:\temp temp folder c:\recycler the recycle bin c:\system Volume Information system restore folder c:\winnt\system32\config 3. Exclude files that are not required, for example:- c:\pagefile.sys 4. Exclude any data/directories that are being backed up via a Plug-in, such as Exchange or SQL, for example:- c:\program Files\Exchange\Data - MS Exchange default location c:\program Files\MSSQL\Data - MS SQL default location 5. Certain system databases cannot be backed up whilst in use i.e. WINS and DHCP., for example:- C:\WINNT\System32\WINS\*.* C:\WINNT\System32\DHCP\*.* Exclude these folders from the file system backup and create a separate task (that also includes the System Sate/Service DB s) for just these folders. You would need to include a custom command in the schedule to run a batch file that stops/starts these services as required to ensure a consistent backup. Another alternative is to install the OTM/OFM option (licensed option) and backup as part of the file system backup 6. It is recommended to create a separate backup task for the system/services database and schedule this at a less frequent interval. 7. If Open File Manager (Windows) or Open Transaction Manager (Novell) are being used, stagger the backup tasks so they do not overlap each other. If one OFM/OTM task starts while another is running, both will fail due to the way in which OFM/OTM manage the cache. 3

4 Microsoft SQL Backup Task Flat File Backup or On-line backup via Plug-in It is possible to use SQL s own maintenance task to backup a database to a file and back this up using a normal file backup task. This has the advantage of the file being local on the server available for immediate restore. However, the disadvantage is that addition disk space is consumed on the server for this copy and that it is still required to be backed up off-site. We would recommend the use of a VBAK SQL Plug-in for the following reasons:- 1. It is an on-line backup, in that the SQL service does not need to be stopped. 2. The backup is transmitted immediately over the wire on off-site. 3. No local disk space is consumed by a database db. Default SQL Databases SQL has the following four default databases that are required for normal operation:- Master Model MSDB Tempdb These maintain configuration information about SQL and should be backed up at least once a moth or whenever they are known to have changed. For this reason create a specific task to include Master, Model & MSDB but exclude Tempdb. Customer Databases These should be backed up to suit the customer s requirements i.e. daily, weekly, monthly, etc. You can either create a separate task for each DB or include a number in the same task. NOTE: Please remember that whenever a new database is created in SQL that it is not automatically included and that you have to add it to a task or create a new one. Full or incremental The difference between Full and Incremental is that Full will backup the entire database, while Incremental will only backup the transaction log files. During a restoration, the log files will be played back to achieve the most up to date restore since the last (Full) backup. It is therefore recommended that if times permits, a Full backup is preformed. 4

5 Microsoft Exchange DR Backup Task Permissions The account being used to perform the backups must be a member of the following:- Administrators Domain Admins Domain Users Enterprise Admins Group Policy Creator Owners MS Exchange-DR There are a number of ways to backup MS Exchange. It can be backed up locally using NTBackup to create a flat file e.g. c:\exchange.bkf, this then can be backed up by VBAK or you can use the Exchange Agent/Plug-in backup option. With either option, it is worth excluding the area where MS Exchange is stored from any other backups i.e. c:\exchange. MS Exchange Agent/Plug-in The advantages of doing an MS Exchange Agent/Plug-in backup are a. Only one backup is done. b. The backup is usually performed out of hours and therefore doesn t impact on internet bandwidth when staff are present. c. There will a need to perform only one restore to recover the Exchange databases. The disadvantages of doing an MS Exchange Agent/Plug-in backup are a. Restores will have to done across the internet and could take longer. Are there any performance or sizing limitations with the Exchange DR plug-in? While there is no limit to the size or number of Exchange databases which can be captured by the plug-in, to improve backup and restore performance of larger Exchange servers, VBAK now supports parallel backups of Exchange storage groups with V5.30 of the VBAK Exchange DR plug-in. This allows separate storage groups to be backed up or restored simultaneously, should line bandwidth allow. With larger Exchange databases (>100GB), database administrators should consider organising the Exchange server into two or more storage groups and multiple databases. This configuration not only helps to speed up backups, but may also improve overall performance of the Exchange server. The option to truncate the transaction logs is only effective when backing up the Storage Groups on an exchange server, if you are backing up the individual databases, this option has no effect. Full or incremental backup? The backup type Full, using a Delta (changed data) technique, backs up and optimizes all the changes in a MS Exchange (.edb,.log, etc) that have occurred since the last backup. This data is added to the original safeset to complete the entire backup safeset. Using Full with the delta technique saves a great deal of time, as only changes are transmitted to the Vault. Incremental backups are transaction logs only. To produce a complete picture of the up-to-date MS Exchange database the incremental transaction logs are added to the safeset. Incremental backups take the least amount of time to perform. But during a restoration, the logs files will be played back to achieve the most up-to-date restore since the last backup. On MS Exchange 5.5 circular logging must be disabled for incremental backups to work. Depending on bandwidth, it is recommended that full backups are performed periodically. Ideally, if bandwidth permits, perform a Full every time. When backing up MS Exchange it is recommended not to use Open Transaction Manager or Open File Manager. The backup does not benefit from OTM or OFM, in this case. Also, using OTM or OFM slows down the backup. If using Open File Manager then exclude the MS Exchange folder. 5

6 Microsoft Exchange Mailbox Backup Task MS Exchange-MAPI Permissions 1. The account being used to perform the backups must be a member of the following:- Local Administrators Domain Admins Domain Users If connection to the Exchange server through MAPI still fails, the user may need to also be a member of one or all of the following groups:- Enterprise Admins Group Policy Creator Owners Schema Admins 2. The user must have the following assigned to it in Local Policies/User Rights Act As Part Of The Operating System Log On As A Service The account must have a mailbox and have received at least one ; it is recommended that you use Microsoft s Profman2 to create this mailbox; it must then be delegated Full Administrator access at the organisation level from the Exchange System Manager. If PST restore functionality is required, on a machine that has Outlook installed, search under C:\Program Files\Common Files\ for a file called mapisvc.inf. When the file has been located, copy it to C:\Windows\System32 on the Exchange server. If the file already exists, on the Exchange server, rename it and copy the new version from the Outlook machine. An important note regarding the Mailbox backup is that it takes 4 to 8 times longer per gigabyte to perform than a DR backup. This is primarily because Microsoft optimized the backup protocol for backing up the entire DB, not for performing backups at the mailbox or folder level. Also, for mailbox and folder level backups, a pre-scan is required which can slow the process. The pre-scan looks through the mailboxes for messages that have been sent to more than one recipient, so that only one copy of that mail message will be backed up. On smaller Exchange servers with less than 100 mailboxes, all mailboxes may be backed up with a single MAPI task. However for larger Exchange servers, it is recommended that MAPI backups are broken down between important users (Such as upper management), users who require frequent restoring of messages, and regular users. To ensure that backup and recovery times for mailbox backups remain reasonable, it is recommended that backups are limited to no more than 100 mailboxes or around 50GB of data. In the event that more than one mailbox backup task is created, these can be scheduled to either run after each other, or run at the same time. It should be noted that mailbox backups are very system intensive, so running more than one Mailbox backup simultaneously should only be attempted on Exchange servers with multiple processors and no less than 1GB of physical memory. In addition, since Mailbox backups can impact system performance, it is suggested that Mailbox backup tasks are done when there few or no users accessing the Exchange server. Due to this increase in the length of the backup and because the DR and MAPI cannot run together, careful scheduling of these tasks must be performed. 6

7 Retentions On the Agent Configuration window click on the Retentions tab to view, edit or create retention settings. Retention Name is the name given to the retention policy, Days Online is the number of days the minimum number of days the backups will be kept online and Copies Online specifies how many copies of the data will be held online at any one time. To mirror a tape based Monthly, Weekly, Daily backup rotation, the following retention policies below, can be used as a guideline: Name Retention (In Days) Online Copies Daily 7 1 Weekly 31 1 Monthly The above retention policy can be scheduled with a daily backup using the daily retention runs Monday to Thursday, with a weekly backup using the weekly retention, running every Friday. On the last Friday (Or last day of the month), a Monthly backup could run, using the Monthly retention. While in the above example, it looks like only 1 copy will be held online for each retention, data will not be expired until both the retention AND the copies criteria are both met. So for the daily retention, a backup done on the Monday will not be removed until it is 7 days old, a backup done on the Tuesday will also be kept for 7 days. So for the above retention settings on backups done Monday to Friday, the Monday to Thursday backups would be replaced each week, with each Friday s backup being kept for a month, with the month end backups would be kept online for a year. Customised retention settings can be created for individual tasks, as well as different schedules assigned to different VBAK agents, and can be configured for specific data retention needs 7

8 Schedules Select Backup, Synchronise or Custom Command from the Schedule wizard command window and click Next >. If either Backup or Synchronise ore selected, the Task List window is displayed Select a task and click Next >. If Backup was selected, then the retention window will appear to select the retention scheme, the next window allows you to set how long the backup will run once it has started, this can be in either hours or minutes. Checking the Disable deferring box will allow the backup to run until completion, regardless of how long it will take. The quick file scanning option only scans for new files and files that have changed since the last backup, un-checking this option will slow file scanning down, as each file that has changed will be read to find out how much data has changed. Once the backup window has been set, click Next >. If Custom Command was selected, clicking next takes you to the Custom Command window, where scripts can be scheduled to run before backups. The custom command should be entered here. Once completed, click Next >. There are 3 options for setting up schedules, Weekly, where you can specify which days of the week a backup will run, Monthly, where specific days of the month can be chosen and Custom, which is used when the backup cycle and days when the backup should run can vary. Daily The daily backup allows you to select the days of the week that the schedule will run, by checking or un-checking specific days of the week. The start time specifies when the schedule will start. Monthly The monthly backup uses a command window, where days of the month are listed. These are the days in the month that a backup should run, and can be a single date, a list of dates, or LAST to specify that the backup should run on the last day of the month. For example, entering 28 will make the backup run on the 28 th of the month, 1,7,21,28 will make the backup run on the 1 st, 7 th, 21 st and 28 th of the month. Custom To run a backup on, for example, the last Friday of the month, the custom schedule option must be used. This uses a command format similar to the CRON command format used in Unix. The command is broken up with a /, and the format is start minute/start hour/day/month/day of week. The permitted values are: Start Minute 0 to 59 Start Hour 0 to 23 Day 1 to 31 Month 1 to 12 Day of week 0 to 6 (Where 0=Sunday) Values such as day, month and day of week can be replaced with *, which means every time. LAST, as with the monthly backup, means the last day of the month. For example, to create a custom schedule starting the backup at 23:00 on the last Friday of the month, the format would be: 00/23/25-31/*/5 This will start a backup on any Friday falling between the dates of the 25 th and 31 st on any month at 23:00. Examples First Saturday of the month 0/23/1-7/*/6 0/23/ - 23:00 time backup task runs /1-7/ - first Saturday could fall on any day between 1 to 7 /*/ - month is set to all by using * /6 - Saturday is represented by day number 6 Last Saturday of the month 0/18/25-31/*/6 0/18/ - 18:00 time backup task runs /25-31/ - last Saturday could fall on any day between 25 to 31 /*/ - month is set to all by using * /6 - Saturday is represented by day number 6 8

9 Prioritising Schedules Schedules are prioritised by the order in which they appear in the schedule list. To give week end and month end schedules priority over the daily schedules, they must appear above the daily schedules in the list. To give a schedule a higher priority, select the schedule you want to prioritise, and click on the Move Up button on the right of the window. This will move the selected schedule one place up in the list. Continue clicking on the Move Up button until you have the schedule in the position you want in the list. If you find you have prioritised the selected schedule too high in the list, use the Move Down button to move the schedule further down the list. If you are running both DR (Database) and MAPI (Mailbox) tasks on an exchange server, it is advised that you prioritise the DR task schedules above the MAPI task schedules to ensure that DR backups take priority. In the case of a disaster, the DR backups will be required to get the Exchange server(s) back up and running as soon as possible. 9

10 Encryption There are 2 levels of encryption within VBAK, Over the wire encryption, where the line between the agent and the vault is encrypted, and file encryption, where the data itself is encrypted by the VBAK Agent. Both are optional, but over the wire encryption is enabled by default when the agent is registered with the vault, while file encryption has to be set up with each backup task. Encryption between the VBAK agent and the vault can be disabled on the vault registration wizard, or on the vault connection properties pages. However, this is enabled by default, so that there should always be a level of encryption on all backup tasks. It is strongly advised not to disable this, especially if the backups are running over the internet. The type and level of encryption can not be changed. The second level of encryption is set on the backup task, and encrypts the data itself. This requires an encryption key to be entered, and an encryption type to be selected. The types of encryption available are:- DES (56 bit) Blowfish (56 bit) TripleDES (112 bit) Blowfish (128 bit) AES (128 bit) AES (256 bit) While other backup systems offer higher encryption levels, such as AES (256 bit), these are generally slower to encrypt and can take up more processing power which impacts on backup times. For example, AES (256 bit) can be up to 3 times slower than AES (128 bit) when encrypting files. While this may not have much impact on a small backup task, larger backups, especially large database backups, will take longer to run. Unless there is a real need for higher encryption levels, AES (128 bit) is reported to be the best for both security and speed of encryption. When the backup tasks are encrypted, the encryption key is required every time you perform a restore, regardless of the size and type of file(s). As it is possible to have a different encryption key for each backup task on every server, it is important that any encryption keys are kept safe, as data can not be retrieved if the encryption key is lost. However, the encryption key does not affect the over the wire encryption between the agent and the vault. 10

11 Upgrading The Vbak Agents When a new version of the VBAK agent is released, the procedure for upgrading is quite simple. However, during any upgrade or maintenance task, there is always a small risk of losing information. In the case of the VBAK Agents, loss of the configuration and index files would mean that all backups would start again from scratch. To minimise the risk of this happening, the following procedure should be followed:- Locate the VBAK Agent installation directory on the server (C:/Program Files/VBAK/ on a default installation), this contains the agent executable files and sub-directories for each task defined on that agent. Copy the contents of the VBAK directory to another location on the server to create a backup of the current configuration. You can now run the Agent-Windows.exe file. As there is already a VBAK installation on the disk, the background screen should be green, if it is blue, the existing installation has not been detected, so before continuing, check that the installation directory still exists. If a cut and paste was done by accident, rather than a copy and paste, copy the backup directory back in to the original installation directory. With the background being green, follow the steps below:- On the welcome screen, click Next > On the VBAK Agent support note screen, click Next > On the options screen, select Modify, then click Next > On the Confirm Software Upgrade box, click OK, the agent is now being upgraded. Once complete, click Finish. All the agent components should now be upgraded to the latest version of the VBAK agent. To confirm that the upgrade was successful, run the VBAK Agent Console, right click on the agent that has been upgraded and select Properties. From within the Agent Properties window, click on Get Status, the Agent Status window will open, showing the currently installed agent version on that server. From within the VBAK Agent Console, expand the agent on the server that has been upgraded, and make sure the tasks and previous backed up safesets and logs are still present. If these are missing, copy the tasks directory from the previously backed up VBAK directory, to the live VBAK directory. Do not copy the entire VBAK directory, as this contains the earlier version of the VBAK agent and may cause errors with the new installation. Once you are happy that all the backup tasks are still there, the upgrade is complete. 11

12 Open Transaction Manager vs. Open File manager Overview Typically, Open Transaction Manager (OTM) is used on small to medium size servers, while Open File Manager (OFM) is used on large servers. OTM is an included option and is configured and installed as part of the agent install routine, and can be evaluated for 30 days before requiring a permanent license. OFM is an additional option and is a separate install, with its own configuration options. OTM has a single cache which is used to cache the entire drive, while OFM has a more flexible cache system, allowing individual files to be cached and released from cache early if required. This also allows multiple backup tasks to run concurrently, while OTM can only allow one backup task to run on a cached drive at once. OTM Features: Typically used on small to medium sized servers. Configured and installed through the Agent. Uses a single cache, with pre-allocated maximum size; caches all drives. Logs to the Agent Backup log. Only allows one backup at a time. Releases cached data at end of backup. OTM is product of Columbia Data Products (optional included in Windows Agent installation Kit) NB: Refer to VBAK Agent Console Guide PDF installed along with the agent OFM Features: Typically used on large servers. Separate install; configured through its own GUI. Has dynamic cache and its own log files. Displays its cache as a file; can select drives to cache; can release cache before end of backup. Caches individual files rather than the entire drive. Can run concurrent, multiple backups. OFM is product of St Bernard Software (available as a separate download/install) 12