Discussions specific to the Microsoft Hyper-V hypervisor
Post Reply
Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Copy-Only backup without credentials

Post by Alkochm » Oct 26, 2018 9:28 pm

Hello.
Is there any way to perform backup of VMs on copy-only mode without specifying credentials for guest OS?

In our case we provide VMs to our clients and doesn't have administrative access to every VM.
But we have to backup these VMs of course.

Without credentials, Guest Processing options in backup job cannot be configured, so backup is taken in default mode.
It breaks SQL server backup chain inside VM, because it writes last full backup information and truncate logs. So, we interrupt clients control over backup procedure.

Before that, we was able to use DPM for Hyper-V backup in copy-only mode without any credentials for guest OS
REG key on Hyper-V host: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft Data Protection Manager\Agent\2.0] "CopyBackupEnabled"=dword:00000001

So, if I understand things correctly, VSS_BACKUP_TYPE VSS_BT_COPY is set during the initialization of the backup procedure on the Hyper-V host level and passed through inside VMs VSS(using Hyper-V backup integration services) and to SQL VSS writer.
This interaction doesn't require direct guest OS access.

Can't this behavior be used in VBR? Am I missing something and there is option for that?

Rick.Vanover
Veeam Software
Posts: 594
Liked: 126 times
Joined: Nov 30, 2010 3:19 pm
Full Name: Rick Vanover
Location: Columbus, Ohio USA
Contact:

Re: Copy-Only backup without credentials

Post by Rick.Vanover » Oct 28, 2018 9:12 pm

Hi Alexey - welcome to the Veeam forums. For the guest OS - we can do a backup without guest credentials. This is by not filling out the application-aware image processing part of a backup job. The main thing that needs to be disclosed in this situation is that the backup of the VM is crash-consistent.

So - basically as long as you have the permissions on the host to A) install the Veeam services and B) do the backups - then you don't need anything on the guest OS.

As much as we advocate a lot for the application-aware image processing - many organizations (especially service providers) do not drop it in the backup job.

I read through your topics above, but I think it's just over complicating. Veeam is rather straightforward to use - and the situation you are seeking likely can be done without the guest credentials as I laid out.

Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Re: Copy-Only backup without credentials

Post by Alkochm » Oct 29, 2018 7:31 am

Looks like I wasn't clear, I will try to say in other words.
Yes, we can configure backup without application-aware settings configured. Yes, it works.
BUT in breaks the chain of SQL backups inside VM because backup of VM, taken from the host, Is Not Copy-Only.

For example, inside VM, client doing some work with SQL server. He set up some backup procedure with Full-Diff-Log backups schedule for SQL inside VM. Client wants to recover from these backup files sometime. He takes Full backup+Diff backup+Log backup files and restores from them later.

But, if we did a backup of the VM in the middle of this procedure, and this backup is not copy-only, than this backup is considered latest Full for SQL, so, the next Diff backup will be the diff between our backup of VM and that time, not the difference between the clients last Full backup and that time.
So, even if client wants to recover from their files from inside VM on the next day - he can't , because he needs full backup file from our backup of VM (because it is the latest one).

This occurs because of interaction between Hyper-V Host's backup integration services with VMs VSS provider, that interacts with SQL VSS writer.

This problem Is already solved in some other backup products with setting backup type of VMs on the host level to Copy-Only, so it is not interfering with backup of transactional applications inside VM.

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Copy-Only backup without credentials

Post by Mike Resseler » Oct 29, 2018 8:03 am

Hey Alexey,

I believe you are searching for this: https://helpcenter.veeam.com/docs/backu ... tml?ver=95

Can you look at it and see if this answers your need?

Thanks
Mike

Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Re: Copy-Only backup without credentials

Post by Alkochm » Oct 29, 2018 8:37 am

These settings require credentials and access to VMs guest OS. We have neither.

Clients VMs is completely isolated from backup or Hyper-V infrastructure in their own networks and we can't have administrative access inside clients VMs.

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Copy-Only backup without credentials

Post by Mike Resseler » Oct 29, 2018 9:02 am

Alexey,

I will need to verify and will ask around. What backup method are you using in Hyper-V? Hyper-V Guest Quiescence?

Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Re: Copy-Only backup without credentials

Post by Alkochm » Oct 29, 2018 9:05 am

Yes, Hyper-V Guest Quiescence is enabled.

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Copy-Only backup without credentials

Post by Mike Resseler » Oct 29, 2018 10:09 am

Hey Alexey,

I heard around. If you want to use Hyper-V Quiescence, then indeed those attributes will be changed. The only way to change this with Hyper-V quiescence is by changing a registry inside the VM (which probably won't work since you don't have access...)

Code: Select all

Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Virtualization\VssRequestor 
Name: BackupType 
Type: REG_DWORD 
Value: 0 or 1 
Change it to 1 to make sure that application backup is not affected through the VM backup.

Another possibility is to use crash-consistent backup only. That would also make sure there is nothing changed inside the VM

Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Re: Copy-Only backup without credentials

Post by Alkochm » Oct 29, 2018 10:14 am

Already tried this reg key.
Yes, inside guest OS.
No effect.
(Both Hyper-V and guest have september 2018 updates)

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Copy-Only backup without credentials

Post by Mike Resseler » Oct 29, 2018 10:18 am

It really should not truncate the logs at that moment. That seems very odd to be fair. Can you see in that guest (I assume you are using a test VM or something) that the logs are actually truncated? In that case, I think it is best to create a support call.

Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Re: Copy-Only backup without credentials

Post by Alkochm » Oct 29, 2018 10:49 am

To be really fair - that reg key never worked even with DPM.
The only thing that can make VSS backup to be copy only - is VSS_BT_COPY flag that is set in IVssBackupComponents::SetBackupState on the host level during backup initialization.
In other words - only application, that initalizes backups can control this behavior.
With DPM - we was able to do it, because DPM agent have reg key to enable copy-only backups.

From the SQL server side it looks like this:
"select backup_start_date, backup_finish_date, is_copy_only, type
from msdb.dbo.backupset
order by backup_start_date"

https://i.imgur.com/QDTdibZ.png

Here you can see the difference.
If Hyper-V Guest Quiescence is disabled - there is no record about backup inside VM.

What we trying to achieve here, is to configure similar with previous backup system behavior (application aware level of consistency).

Yes, I get that disabling Guest Quiescence kinda solves some part of the problem (and makes backups not so consistent) BUT we was able to achieve higher level of consistency with application-aware backups before with DPM without credentials and direct guest OS access.
It is strange that the same cannot be configured in Veeam.

Mike Resseler
Product Manager
Posts: 5695
Liked: 599 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: Copy-Only backup without credentials

Post by Mike Resseler » Oct 29, 2018 10:53 am 1 person likes this post

I'm afraid that this is the only way it will work with Veeam. But I will certainly pass it to the developer team to see if we can look into this. Not sure how this will be done without an agent though, but they will know better.

Alkochm
Novice
Posts: 8
Liked: never
Joined: Aug 02, 2016 3:30 pm
Full Name: Alexey
Contact:

Re: Copy-Only backup without credentials

Post by Alkochm » Oct 29, 2018 11:03 am

Thanks, will be waiting for updates.

About agentless behavior. As I mentioned before, backup with all the flags is initialized on the Hyper-V host level. If Hyper-V child partition shapshot is used, than it triggers VSS snapshot inside guest OS and flags are passed from the Hyper-V Host level. Than VSS inside guest os triggers snapshot through SQL VSS writer and passes all the flags further.

foggy
Veeam Software
Posts: 18037
Liked: 1533 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Copy-Only backup without credentials

Post by foggy » Oct 30, 2018 12:07 pm 1 person likes this post

Thanks Alexey, this does sound like a valid feature request and something we may consider for the following versions.

Post Reply

Who is online

Users browsing this forum: No registered users and 5 guests