Tape Protection Questions

[Minker17]

Our tapes are automatically becoming protected after jobs finish. I'm new to veeam and coming in after some of these jobs were created, so I'm trying to gain clarification.

The new, empty tape is in a free pool. It will get assigned to a Media Pool automatically, then the job will run. Per the job settings, we have retention set for a week. So once the job is done, the tape locks itself to prevent being overwritten. Do I have this process correct?

Further, the tape is an 800gb tape. What if the job is only 100gb or something small, leaving a large amount of space available still? We have a handful of tapes that are part of pools, that are protected with over 500gb free. Can I set a rule that doesn't lock the tape until it reaches a low amount of free space?

[Dima P.]

Hi Minker17,

So once the job is done, the tape locks itself to prevent being overwritten. Do I have this process correct?

Sounds good. One provocative question though, when you say protected are you referring to protecting tapes prior exporting to the vault (it’s a separate option you could use and its not related to tape retention mechanism – check offline media tracking part here)?

What if the job is only 100gb or something small, leaving a large amount of space available still? We have a handful of tapes that are part of pools, that are protected with over 500gb free. Can I set a rule that doesn't lock the tape until it reaches a low amount of free space?

Please clarify how the media set creation option is configured in the Media Pool's settings? Thanks

[Minker17]

It's set up like this picture, but with 1 week. Yes, it appears to be protected before going into a vault.

http://helpcenter.veeam.com/backup/80/v ... ention.png

Media set is set up as "Do not create, always continue using current media set"

[Dima P.]

If the protection is enabled prior export to the vault then tape has to be manually unprotected once its imported back – otherwise it’s not going to be automatically overwritten by tape job due this safety trigger being enabled.

Media set is set up as "Do not create, always continue using current media set"

That’s the correct option. It forces tape job to continue the previously started tape media.

[Minker17]

Ok, so the way it's set up now, just to clarify.

New, empty, tape. Gets assigned to a media pool. From there, a backup job is ran and completes. If the job contains multiple VMs, then it will continue to backup to that specific tape per the media set options. Once the entire backup job completes, it gets locked and will stay locked until after I add it back into veeam at a later date.

It does all of this regardless of the overall backup job size. If the job is 1 vm that is 100gb, then it will finish the job and lock the tape regardless of free space available. If the job is multiple VMs totaling 500gb, it will act the same.

I feel like I understand, but also that I'm missing something.

[Dima P.]

Before I answer to this onу, please, check and let me know if tape export is configured in tape job options (under options > export > days). Thanks

[Minker17]

Eject media once job completes is checked, export current media set once job finishes is not.

[Minker17]

Also, is there a way to know when I need to move the tapes from the veeam vault to my physical safe? At this point, I had no real indication when I need to do it. I've just been doing it based off of tape capacity.

[Shestakov]

Hello,
We have Veeam ONE report called Tape Media Retention Period showing tape protection status.
We are also planning to add in the upcoming version a report showing which tapes were exported. Should be helpful for you.
Thanks!

[Dima P.]

Hi Minker17,
Thanks for the clarification – here is what is happening according to your current setup:

1.Tape job starts. It picks the tape from Free media pool and starts to write the data and if more tapes needed (source files are larger than one tape) another tape is taken from Free media pool
2.Job finishes and tape got ejected
3.Next tape job run will pick a new tape and start it from scratch

To limit the tape overrun you could set the export option in the tape Job options not to export tape media every day (maybe once or twice a week).

Additionally I would uncheck Protect tapes in this vault option under existing Vault: its used for archiving, however if you are rotating tapes with 1 week cycle it will prevent your tapes being automatically overwritten when the time comes (you must unprotect these tapes manually before overwriting them).

[Minker17]

Bumping again.

I've got all of this figured out and it's all making sense to me. But, I'm still struggling with one thing.

Why are some tapes becoming automatically protected (software write protected) when the job completes and others aren't?

I set a new job up the same as the others and tested it. The job ran, pulled a tape, and when it was done, the tape was not software write protected. Yet other jobs are ending that way.

[veremin]

If media pool is configured, so that offline tapes are automatically taken to vault, and vault has "automatically protect tapes" option enabled, all tapes exported after job's end should be automatically protected.

Or you're just talking about media set retention that is not applied to some tapes?

Thanks.

[Minker17]

That is how it's set up, but I don't have the jobs set to automatically export. When I manually pull the tapes they go offline and are moved to the vault automatically.

I'm talking about the job itself finishing and the tape becoming protected without the tape being exported or going offline.

Furthermore, I have 4 tapes that were not protected yesterday and are now protected this morning. No additional data has been written to them. It doesn't appear that any other jobs were run to them. Media set was on 8/31 and it seems as though nothing additional has been done with them and then sometime in the last ~12 hours it decided to become protected.

[veremin]

The situation with a backup server making random tapes protected looks unexpected. So, kindly, open a ticket with our support team and let them investigate it directly. Thanks.