Back up a CIFS Share

[foggy]

Here are a couple of hints. If nothing helps, I recommend asking support team's assistance.

[fondazionetls]

Hi,
Any news for backup CIFs share?

thks

[Vitaliy S.]

H2 this year

[scottc9]

ok, so now its 2020. any news on when i can backup from a cifs share?

[Mildur]

ok, so now its 2020. any news on when i can backup from a cifs share?

It will be out in a few days. Launch Event is on 18th February.

RTM is already released. NAS Backup is working perfectly in our test environment with the RTM Release for me.

[Dima P.]

Mildur,

Thank you for the kind words! Can you please share the configuration of you test environment and rough size of your data? Cheers!

[Samba222]

"NAS Backup is working perfectly" ... I think we're still a long way from perfect.

(1) If the inheritance is interrupted NO warning or similar will pop up. The Folder/File will be ignored. How can I be sure that all data is backed up?
(2) No selection option for Active Full is offered?!
(3) No option for NAS-backup to Disk to Tape? According to veeam, tape is indispensable in today's world. (Please don't offer File2Tape or NDMP2Tape as workaround, they are not related to the NAS-Backup-Chain)

... ok, its a new feature but it is not a free addon but it should cost us 30k per year

So, I'm not so happy about it.
Ronald

[Gostev]

Nothing is ever perfect - there will be always something that is missing. I mean, it's not like we don't have customers submitting walls of missing feature requests for our v10 VMware backup and remember, this is v1 NAS backup. And most beta testers thought it was actually pretty damn good for v1.

As for your comments:

1. Could you please clarify this point? We do log skipped folders and files in the job action log, and we provide link to full list of skipped files and folders in the email notification.

2. Actually, there is such capability - a bit hidden out of the way, because should not be needed outside of troubleshooting situation. May I ask what is your case for active fulls with true file-level backup though?

3. Since we already provide F2T and NDMP2T, with NAS backup we decided to focus on a more modern storage technologies (archiving to object storage). May I ask why our existing file to tape backup technologies are insufficient for your needs?

[Samba222]

Hello Gostev,
thx for you reply ... i agree with you - but then I'm not willing to spend that kind of money on a first release! But take it easy for now...

to your questions:

1. We use a Netapp Filer and of course Access-Based Enumeration: Enabled (i think it's standard today, also with a Windows File Server) so users can only see the directories with their own rights. The "global" admin account for the shares has now the problem that he can't see broken inheritance because he don't see the folder or files. No log entry or Warning will be shown and there will be no backup data -> horrible, i can't be sure that ALL data has been backed up. -> tested
Just for Tests i switched off Access-Based Enumeration -> now a notice will pop up in job action log but with green color?? Not a warning in yellow? I dont understand it. It's essential to recognize such breaks. But it doesn't matter - turn off Access-Based Enumeration is definitiv no option. This is the challenge to backup a share from the "top" vs. "bottom" (e.g. NDMP). But I thought after this time of development , Veeam would have solved it more "intelligently".

2. We use this feature since first time. AF saved our ... in bad times with CBT errors and we also want to protect us against bit errors. It's a philosophy, also to discuss. But sometimes (weekly, monthly) have a "fresh" 1to1 AF Copy is very calming and this is a real copy without a possibly dragged error. So yes, please put it back to have a choice in gui.

3. LTO7+ is a modern storage technologie We need our File Data also daily on Tape. First: I won't have the backup impact twice in the primary storage (NAS Backup + F2T) - for LTO7+ it is much better to read from a B2D Device for a steady data stream (data buffer, in best case already packed and compressed...) totally simple, like the existing CopyJob2Tape, great feature! Second: I won't have two catalogs for file indexing one for NAS-Backup and one for F2T - i want to search for files in a common gui whether they are still on B2D Device (e.g. first 30 days) or only available on tape. (e.g. next 60 days) Third: as i wrote, the jobs should belong together, it couldn't be the ambition to maintain 2 independent jobs. (access rights, logging and so on...)
... and NDMP2T? Not a choice, one of the most loveless implemented features - no file catalog, no disk buffer, only volumes (backup & restore) ...

So yes, for me it's not THE great shot for which I have been waiting a long time! - I have to explain myself again why other big player can do it better. Ok, maybe not better but they can do it!

Ronald

[Dima P.]

Hello Ronald,

Thank you for your feedback!

The "global" admin account for the shares has now the problem that he can't see broken inheritance because he don't see the folder or files.

Can you please clarify how, in your case, inheritance for the admin account was broken? I believe this could happen only if inheritance was not enabled or admin account was some how removed from the access to the child folder (which can be achieved only via NetApp admin account).

now a notice will pop up in job action log but with green color?? Not a warning in yellow? I dont understand it.

With such notification logic we are addressing multiple problems with file locks. The deal is: there is no difference between locked file and inaccessible file from the error handling standpoint, both report 'access denied' error code. Since there is no way to deal with file locks for most of the file shares i.e. there is no snapshot capabilities, we keep such events as info. Right now we've made a special csv file that is stored in the backup job log location and the path to the file is automatically included in the job email report. However, I'd agree with you that, in case of integration with storage vendors, notification logic could be improved.

AF saved our ... in bad times with CBT errors and we also want to protect us against bit errors. It's a philosophy, also to discuss. But sometimes (weekly, monthly) have a "fresh" 1to1 AF Copy is very calming and this is a real copy without a possibly dragged error. So yes, please put it back to have a choice in gui.

Mind me asking if storage consumption with periodic active full backups enabled is a problem for you? Are you planning the deduplication storage as a target for your nas backup?

We need our File Data also daily on Tape.

Thanks for the details, just one thing to clarify - would it be enough for you to tier of the portion files stored in nas backup (i.e. archive to tape only the oldest file versions) or the only option for you would be to make a 1 to 1 copy from disk to tape? Thank you!

[Gostev]

1. Indeed, file-level backup requires that the backup account has permission to access and read the file. And you cannot make a copy of a file if the backup account is unable to even see the file! So, I'm not sure how this can be solved even in theory, as it's not like permissions system can be bypassed - that would be a critical vulnerability! The only "intelligence" possible here is using some zero-day exploit to circumvent the permission system or NOT doing file level backup (but instead some tricks with NDMP).

2. There's no CBT with file-level backup, and for bit rot there's health check process that scrubs backup for any corruptions, which is arguably more reliable than just making a "fresh copy" instead (as you cannot be sure fresh copy is not immediately hit by bit rot and recoverable). Anyway, doing a "fresh start" every week or month is already a possibility with v10, if you prefer to do so.

3. I guess I just didn't understand why you want to do both F2T and F2D at the same time. If I used tape for file backups, I would do F2T (and consider it primary backup) and NDMP2T (secondary backup, just in case primary backups fails to me). Our NAS backup in v10, we built for people who don't have tape - only disk.

[Samba222]

Hello Dima,

thx for your comment.

Can you please clarify how, in your case, inheritance for the admin account was broken? I believe this could happen only if inheritance was not enabled or admin account was some how removed from the access to the child folder (which can be achieved only via NetApp admin account).

Yes, it's a 10+ years grown Filer and at some point in time it was necessary so set up exclusive directories (e.g. finance, human ress.) not up to date but historically grown and difficult to find and correct. In times of NDMP no problem also without "hacks" or "tricks" But yes, it was intentionally broken manually.

With such notification logic we are addressing multiple problems with file locks. The deal is: there is no difference between locked file and inaccessible file from the error handling standpoint, both report 'access denied' error code. Since there is no way to deal with file locks for most of the file shares i.e. there is no snapshot capabilities, we keep such events as info. Right now we've made a special csv file that is stored in the backup job log location and the path to the file is automatically included in the job email report. However, I'd agree with you that, in case of integration with storage vendors, notification logic could be improved.

The Link in E-Mail and the csv file is fine. But i don't have a E-Mail Report enabled with notify on success. That would be a little too much information at all. When i receive a Warning or Error i will start acting e.g. looking in an E-Mail or Log-Report - not for a success message. It is like it is - we might have a different opinion about that. BUT it is absolutely inconsistent! When i integrate the same share in a F2T Job an the job can't read a file or Dir then a yellow Warning will appear also in conjunction with a E-Mail Warning. So, yepp, i fail to see the point.

Mind me asking if storage consumption with periodic active full backups enabled is a problem for you? Are you planning the deduplication storage as a target for your nas backup?

No, it's not a problem. I understand the technical and the unnecessary in your opinion but it should be the users choice like in all other Veeam Jobs. Deduplication storage is a good question. Now that we know that all our deduped Netapp Filer Data (min. 2:1) will be stored without dedup on the NAS-Backup 2 Disk Device i'm starting to frown. Ok it is probably related to V1.

Thanks for the details, just one thing to clarify - would it be enough for you to tier of the portion files stored in nas backup (i.e. archive to tape only the oldest file versions) or the only option for you would be to make a 1 to 1 copy from disk to tape? Thank you!

The only option is (as usual from all other jobs) a 1to1 copy. Tiering is not an option. Maybe we have special customers or requirements but we need our data according to the 3-2-1 rule identical with 3 Copies and 2 technologies (Disk & Tape in our Case) and this daily. We store 1-2 weeks on disk (fast restore) and up to 10 weeks on tape (slower, but with index-catalog!) in some cases longer up to 4 years (G-F-S) - and we would like to apply exactly the same procedure to NAS-Backup Data. In both cases, Disk and Tape, FLR (with Catalog) is mandatory. I don't think that makes us the only ones and it's also good strategy in the present time with encryption malware etc.


@Gostev
also thx for your comment i highly appreciate your opinion!
But to Point (3) ... I can't understand why you don't understand - maybe my explanations above will help to better understand why and how we do this.
And I repeat myself F2T (no GFS, no disk-buffer, confusing KEEP Option in FLR different DB and GUI for searching) or NDMP2T (no file-index-catalog for searching, no disk-buffer, no FLR ...) are no options.

Thank you for your interest and commitment!

Ronald

[DerOest]

Hello Anton and Samba222

1. Indeed, file-level backup requires that the backup account has permission to access and read the file. And you cannot make a copy of a file if the backup account is unable to even see the file! So, I'm not sure how this can be solved even in theory, as it's not like permissions system can be bypassed. The only "intelligence" possible here is using some zero-day exploit to circumvent the permission system or NOT doing file level backup (but instead some tricks with NDMP).

That's what the backup operator role exists for, right?
See SeBackupPrivilege and SeRestorePrivilege
https://docs.microsoft.com/en-us/window ... -constants

and also available on Netapp CIFS Share:
https://docs.netapp.com/ontap-9/index.j ... A2F22.html
SeBackupPrivilege BUILTIN\Administrators, BUILTIN\Backup Operators Back up files and directories, overriding any ACLs
SeRestorePrivilege BUILTIN\Administrators, BUILTIN\Backup Operators Restore files and directories, overriding any ACLs. Set any valid user or group SID as the file owner

In theory, you add the backup user to the Netapp BUILTIN\Backup Operators, and it should back up everything WITHOUT having NTFS permissions.

[DerOest]

3. I guess I just didn't understand why you want to do both F2T and F2D at the same time. If I used tape for file backups, I would do F2T (and consider it primary backup) and NDMP2T (secondary backup, just in case primary backups fails to me). Our NAS backup in v10, we built for people who don't have tape - only disk.

first off: I really like Veeam, but sometimes i am just disappointed, because we expect better


Hello Anton,

no tape support for NAS backups is a feature killer (not a killer feature)...
Or maybe not, but we need that data (20+ million files) on tape at least weekly.

F2T simply does not work for that, as performance is just FUBAR (enumerating takes ages)
We expected(!) that the NAS feature would include Tape support and were waiting for it...

Those fileservers are VMs, which we currently back up like any other VM.
But we need the NAS feature for better search/restore, Enterprise Manager Search is just awfully slow, really unusable.

That would mean double licensing and disk storage (normal VM backup + NAS feature backup).
What is official guidiance on backing up fileserver VMs? Because we need the instant recovery etc. too!
(i did not read anything about this case in the pre-release documentation)


There are more hard edges with this first NAS release, we'll wait until v2 or v3 of the feature drops...
~450k objects in one backup cause the metadata files to be ~1GB on the repo - PER RUN!
So having a year worth of backups (20m files, 3+ incrementals each day) will also cause terabytes of metadata files...
But just for the kicks i tested something...they compress down to ~30MB - why not directly store them in a compressed way?

And is the database actually used for storing/searching the NAS metadata?

[Samba222]

no tape support for NAS backups is a feature killer (not a killer feature)...
Or maybe not, but we need that data (20+ million files) on tape at least weekly.

F2T simply does not work for that, as performance is just FUBAR (enumerating takes ages)
We expected(!) that the NAS feature would include Tape support and were waiting for it...

made my weekend @DerOest ... i'm not alone

We have exactly the same problems and challenges and i can only agree with you about F2T. I retested F2T as a possible workaround (Netapp FAS9000, CIFS Share 5TB, 2m Files, 16GB FC Infra, phys. Proxy 2x16C, E-Series B2D Device) ... and what shall i say? We cannot speak of performance, it is rather the total destruction of LTO7 (ff.) Drives. The same behaviour as years ago - it is unfortunately not an alternative.

A very interesting approach about your reference to backup operator role - i'll have a look at it and i'm curious what the engineers have to say.

Ronald

[Gostev]

Thanks guys, good feedback. Just to be clear, it is not impossible that we will add tape offload for our NAS backup in the later versions... it is just that in general, our focus for this functionality is D2D backup. For example, we're building some really cool recovery capabilities for NAS backup in v11 which are simply impossible with tape (with all my love and respect for tape).

[ics]

v10: I tested File Share backup today.
I think great, I can do a file backup to a veeam repository and the do a Tape Backup from repository....

But that does not work. Why?


br

Ralph

[Dima P.]

Hello Ralph,

Thank you for the feedback! Backup to tape jobs do not support backup files produced by nas job. The workarounds are: to use file share as a source for file to tape job to tape out files directly from the share or NDMP backup to tape if it's support by your filer. Cheers!

[Fredo]

Does these workarounds support multiple tape drives?

[Dima P.]

Fredo,

No, there is no parallel processing in file to tape jobs. As a workaround you can split descried folders across several file to tape jobs and schedule these jobs to run at the same time. Cheers!

[ics]

Moin

That is no a workaround, because file to tape can not use GFS pools. So I need an extra pool!

br

Ralph

[Dima P.]

Hello Ralph,

Thanks for your feedback! File to tape job, indeed, does not support GFS media pool as a target. Counted as a feature request!

[aart]

Thanks guys, good feedback. Just to be clear, it is not impossible that we will add tape offload for our NAS backup in the later versions... it is just that in general, our focus for this functionality is D2D backup. For example, we're building some really cool recovery capabilities for NAS backup in v11 which are simply impossible with tape (with all my love and respect for tape).

Hi Gostev,

I do understand that you're more flexible when backups are on spinning disks to add awesome features.
However our healthcare market is requiring PB's in backup and then costs come into play. In addition, the air gap that protects us from ransomware is also a nice bonus.
I can go into more detail offline. I informed our account manager as well.

Thanks in advance,

[claf]

Hello all,

Jumping on the bandwagon here - I just opened a ticket with Veeam support and the person gave me the link to this thread, but I had already seen in before. Like Samba222, I'd like to have Files to disk THEN File to tape, using the backup I created on my disk as the source, as I don't want the backup impact on my source twice.

I was thinking of doing the File to disk job, then doing a File to tape job with the folders in my veeam backup repository where there are the folders "File backup cache" and "<mybackupname>", but she told me that wasn't a good way of achieving what I want.

This is really important to us, and as much as I love Veeam, I don't understand what it hasn't been implemented yet. Any update on that subject, or a solution/workaround ?

Thanks

[Gostev]

We're currently prototyping this, with the goal to ship this functionality in v12 if all goes well. This is not a simple task indeed, as this will require a major re-write of File to Tape jobs to make them scale to our NAS backup levels. They were simply not built for this scale originally (I would not recommend going over 10M files with them today).

[barresi]

Hello all,
our customer also need the tape out for NAS Shares (several NAS Solution with 30 to 150TB capacity - Dell Unity and Netapp)

Is it possible to prefer the nas tape out solution? Due to security, we also need media break in the NAS environment - the Veeam 3-2-1 role....

Kind regards Matze

[Dima P.]

Hello Matthias,

With v11 you can backup file share to disk via nas backup job and backup file share to tape via file to tape job, but sending nas backup files to tape is currently not supported. I'll add your vote to this feature request. Cheers!

[Samba222]

again vote +++

[gutitrade]

i also vote +++ for file backup to tape...

[Dima P.]

Hello gutitrade,

Thanks for the feedback! Can you please clarify how much data you need to backup to tape? File to tape jobs exist today and you can include file share as a source.