What can you accurately audit from B&R reports on Read Data?

[joebranca]

Granted Veeam B&R is not the optimal application for this kind of analysis, but if we wanted to assess as best we can how much data on a given VM has been moved around, changed, added, or deleted on a given 24 hour cycle, will the job report's Read data tell us as much as we can know?

The job settings has "Exclude Deleted blocks" checked in Advanced settings, so does that mean that no deleted blocks are "read" as part of the Read blocks amount in the VM's backup because CBT has pointers for indicating which blocks have been deleted and can be skipped. Or does Veeam need to read those blocks to know they are deleted and so deleted data is included in the total Read amount?

Let's say on a given backup job a VM's Read data is an anamolous 200GB compared to other backups averaging around 10-12GB. I assume from B&R we cannot parse out how much existing data was changed vs how much data was added, is that correct we would need additional analysis tools to make that distinction?

[HannesK]

Hello,
it would be interesting to know what you like to do. Maybe there are alternatives.

Yes, the "data read" is what "changed". But it does not cover for example situations, where blocks that have changed multiple times.

The user guide says about "exclude deleted blocks" https://helpcenter.veeam.com/docs/backu ... ml?ver=100:

Veeam Backup & Replication does not read this data block from the source datastore.

I assume from B&R we cannot parse out how much existing data was changed vs how much data was added

I guess you are right... at least not with any documented or public available way.

Again, it would be interesting to hear what the goal is. For "all writes", Veeam ONE has a report https://helpcenter.veeam.com/docs/one/r ... ml?ver=100

Best regards,
Hannes