Retention and Repository with Rotated Drives

[Killian]

I'm currently running Veeam B&R 11 backing up a HyperV Cluster and I'm very conscious that all my existing backup solution entails 'online' systems.

A quick overview is I use Veeam to backup the 3 node cluster to it's own local storage, I then use a Backup Copy job to get that data to an offsite NAS for longer term retention. I'm looking to implement a 'cheap' solution as a last ditch safety mechanism from Ransomware using an airgapped solution like external HDDs. I have several 10TB HDDs and I've set up a copy job to write my backups there too with the plan of disconnecting one and sticking it in a safe for upwards of a year (and then rotating the others monthly so I always have an external HDD going back atleast a few months should we get struck with ransomware).

My query really revolves around the retention for a repo using rotated disks. They are not compatible with GFS so I'm wondering if I set my retention to say 90 days, get a VBK for each 'job' on a HDD and disconnect it for several months, can I use that to restore if I plug it in again in say 180 days later or would Veeam remove it before I could? Would I need to disable the job and run the restore? Ideally I just want to get a 'backup' of everything onto a HDD that I can forget about for a year and now it's there should the worst happen. The following rotating drives will be used as another insurance policy but just getting some form of offline backup I can leave aside for a year would put my mind at ease.

I understand that Tape systems or Cloud storage are much more suitable alternatives but we're a secondary school so funds are unavailable and this is the only way I can think to create any kind of air gapped backup using existing equipment for an absolute worst case.

If I can get this working I'll effectively have a 3-2-1 system with 3 backups, on 2 mediums and 1 offsite so aslong as we don't get hit with Ransomware AND the building burnt down at the same time we'd be as safe as we can be with what we have available.

[Dima P.]

Hello Daniel,

Yes, you can use restore backup files from rotated media any time you need. Once drives are disconnected you can import that backups back to Veeam B&R anytime you need. It's not required to disable the job - you can just mount disk to another location, create a new repository and import those backups. Cheers!

[Killian]

Ah that makes sense Dima. Can I assume that if I "didn't" mount it to another location and instead gave it the same drive letter that Veeam would then delete any points outside of the retention period set for that particular job when it next syncs? Just so we're crystal clear; so long as I have the VBK and the VBM I can import them in the future?

On a slightly related note I haven't set any maintenance windows to disconnect the HDDs as it could be something I have to do on different days at different times so I was just planning to disable the jobs, swap the drives, remount and then enable them again. Is that likely to cause issues? I'm just assuming this would atleast prevent any attempts to 'sync' whilst I'm between drives (or even as I go to disconnect them).

[Dima P.]

Can I assume that if I "didn't" mount it to another location and instead gave it the same drive letter that Veeam would then delete any points outside of the retention period set for that particular job when it next syncs?

Job wont delete such backups. It will start new backup chain next to it with a new full backup.

Just so we're crystal clear; so long as I have the VBK and the VBM I can import them in the future?

Yup, if you have all the needed files you can perform restore anytime you need (backup files are fully portable). For instance, you can even use brand new Veeam B&R server without any data to perform a recovery. Worth mentioning that recovery does not require any license to be installed

On a slightly related note I haven't set any maintenance windows to disconnect the HDDs as it could be something I have to do on different days at different times so I was just planning to disable the jobs, swap the drives, remount and then enable them again. Is that likely to cause issues?

Sounds good, just make sure that new drive is mounted to the same repository folder (to avoid possible repository reconfiguartion).

[Killian]

"Job wont delete such backups. It will start new backup chain next to it with a new full backup. "

Ah, sounds like I've misunderstood the fundamental difference with Rotating Drives then. It was my understanding that when a previously introduced drive is re-introduced it would use the previous incrimental and generate a new incremental from that to keep the backup chain live). I'm sure that's what the literature says too unless I've misread it?

I've set the retention as 90 days for now so will continue to monitor. I have all the VBKs for my entire infrastructure on there now so will disconnect this one and then start rotating drives monthly and monitor.

[foggy]

Hi Daniel, your understanding is correct. Backup copy job to a Windows-based repository is able to maintain retention on each rotated drive normally, so even when you introduce a drive that has been resting in safe for a year, it will continue the incremental chain according to the configured retention. Just be more careful with retention in days.

[Killian]

Thank you for confirming foggy. I'll likely play with the retention policies, it was more just to get an air gapped backup done cheaply. I've taken out the one drive now and swapped it and can see my job creating the new chains which is great.

For arguments sake; In terms of it using the previous incremental on a HDD that's been in a safe for a year, if the retention were set to 90 'days' would look to erase the year old vbk and create a new one to give the 90 days retention or would it see that 365 day old VBK as essential to the chain and keep it live (in which case what would be the point in any retention settings)? That's the bit I'm not quite understanding yet. The same applies if it were 90 points I guess, would it merge the vbk and all increments up until it reaches the retention settings?

[foggy]

That's why I mentioned the retention in days and shared the link to the user guide section going into the details on how it works. It will keep at least 3 restore points even in case you've just described - when all the 90 restore points fall out of the configured retention. That's not the case for the retention based on the number of restore points though - it will just continue the chain maintaining the specified number.