Veeam and EMC Data Domain Retention Lock

[Grimnar]

I've setup a linux machine with NFS share and the script to version and run the fastcopies. The script fascopy.sh well documented in Dell whitepaper works well if I run it from the linux machine.
I've trusted the Veeam server to run ssh commands vs linux machine, and it is ok.
I can also run the command "ssh root@rhrlbr /home/pierpa/fastcopy.sh" from Veeam server to make the fastcopy on the dd through the linux "bridge".
I can also put the same command on a powershell script and it runs ok.
But if I use this powershell script as a post-command for a Veeam job, the ssh command hangs forever...

Hi, we manage to make it works and leverage the .vbm problem without fastcopy and using DDBoost.

[Andreas Neufert]

This is not supported and potentially after a while of processing your backup chain is marked as to be repaired and you can not continue with the backup. Restore would work. To continue with backup you would have to create a new active backup then. But again this is unsupported and you need to use the fastcopy approach until the Veeam integration is completed.

[Grimnar]

In our case we are only generating full backups .vbk. So removing the .vbm is not an issue and we are not going to corrupt the backup chain.

As veeam doesn't provide any way to avoid .vbm creation and doesn't support Retention Lock we have to make it works by ourselves as using Hardened repository isn't a cost effective and reliable solution.

So does it works : yes.
Does it is supported : Nope but it use only Veeam PowerShell Native commands and we doesn't modify a file manually. Just remove the .vbm that isn't nescessary when working with .vbk (full backups).

So as i said, we found a temporary solution that is working for us. Now, as everyone, we are waiting for Veeam to work on a supported and official solution to work with retention lock feature and/or implement Veeam retention lock for Datdomains Repository.

[Andreas Neufert]

You potentially still run into issues as you let Veeam run the retention processing (I am guessing).
I think a Veeam-ZIP fits your need more as Veeam does not expect to handle the backup chain. You run anyway "Active Fulls" ?

[pmichelli]

Hi Veeam Devs

Is there any plan to be able to use retention locking / fast copies on the Dell Data Domain in Veeam?

Currently I have to do it manually and it is cumbersome.

Login to DD
Create new mTree
Create fast copy of mTree (not enabling DDBoost)
Enable retention locking.

Would be really nice to have Veeam do this for us.

[Mildur]

Hello

Data Domain Retention Lock is not integrated with Veeam. But we count your comment as +1 for the FR.
Please check out this topic for workarounds.

Best,
Fabian

[gustavouehara]

Hello
Please count my vote for the Integration of DataDomain Retention Lock + Veeam.

thanks
Gustavo

[jmerchan]

+1

[simo77]

Veeam simply does not have a business relationship with Dell like we do with other companies, for example HPE, which in turn affects the prioritization of pending feature requests around Data Domain in particular... so purely business considerations, as opposed to "bad PMs" completely ignoring this need for 7 years now.

I mean, HPE resells hundreds of millions worth of Veeam, so anything we do around their storage helps our business. While Dell... well, let's just say they seem to have always seen us as their competitor. And in such circumstances, would you personally prioritize integrations with Dell storage, if you were with Veeam?

Hello Gostev, I understand the Veeam policy, but, it is passed 7 years, other backup software (Dell and Dell competitors) support DD retention lock and there are a lot of customers with Data Domain we want to use this feature without any external script (this is not integration, it's a problem for maintaining script and for debugging).
We have DD because is a very good backup storage and we use Veeam because it is a very good backup software. I think there is a lot of customer's Veeam like me, i think this integration can be a very useful and requested feature.

[Luca82]

Hi everyone, is Dell DD immutability supported by Veeam? As far as I know it is supported by StoreOnce (ISV mode) but I don t understand if also Data Domain can be managed by veeam for immutability.
thank you

[Mildur]

Hi Luca

I have moved your question to an existing topic
Please see the previous comments. We don‘t have an Integration with DataDomains Retention Lock.

Best,
Fabian

[stevekarra]

For those who do write a script to enable Fastcopy (basically snapshots) on the Data Domain to create your immutable copies, just remember that you have to include an additional script to clean them up after they have expired. The easiest way to do this is to include a timestamp in the directory name of the fastcopies (e.g. Veeam-Mtree-Fastcopy-2023-04-31) and have a script that periodically removes fastcopy directories older than a set time. The fastcopy script itself is only a few lines of code (BASH or PowerShell depending upon platform) to basically SSH into the Data Domain and run a command.

A fastcopy will enable you to make the metadata file (VBM) immutable which is something most other immutable solutions do not do.

[ronnmartin61]

Just noticed that this thread had not been updated post-VeeamON. Gostev announced upcoming support for PowerProtect DD RetentionLock. If you're interested check it out at 1:24:00 during the opening keynote - https://connect.veeam.com/flow/veeam/ve ... 962001bo44

[pmichelli]

What version of Veeam will introduce the data domain immutability? A 12.x patch or are we waiting for 13?

[foggy]

It will be Veeam B&R v12a.

[Thebackupqueen]

Is there a release date for Veeam v12a?

Veeam v12 testing with Data Domain retention lock shows Veeam is now aware of the Retention Lock functionality which is good in v11 we used to get generic error. I imagine to support RL applied direct to the primary mtree Veeam will need to use versioning on the vbm file.

[Andreas Neufert]

v12a release date is planned for Q4 2023

DataDomain retention lock will work with individual file retentions not a share/storage based retention.
Basically we will apply the same concept as with our Veeam Hardened Linux Repository and the HPE StoreOnce Catalyst Immutability integration.

[janezk]

+1! Very good news indeed!

[Dynamic]

+1
Can‘t wait for this native feature

[SteveK821]

Well, it's finally here. But it only works in if Retention Lock is configured in Compliance Mode (the stricter version of retention lock). You can't activate it in Veeam if the mTree is configured for RL Governance Mode. On older DDs compliance mode requires an additional license, and it also really locks down the DD. Make sure you know what you're doing, because switching on compliance mode is irreversible and disables a lot of other things involving deleting stuff (for obvious reasons).

https://helpcenter.veeam.com/docs/backu ... mutability

Dell DD Retention Lock FAQ:
https://www.dell.com/support/kbdoc/en-u ... aq?lang=en

[Andreas Neufert]

Yes, Veeam only works with Compliance mode as this is the only mode that makes sense to protect customers from Ransomware in case the admin accounts are compromised which is usually the case when hackers are involved.

[benthomas]

Yes, Veeam only works with Compliance mode as this is the only mode that makes sense to protect customers from Ransomware in case the admin accounts are compromised which is usually the case when hackers are involved.

Personally, I'd like to see Governance mode supported, as Compliance mode is potentially unavailable to some customers without the Dell Licence uplift.
There are also certain service provider scenarios, where governance mode makes sense, so that if need be, say the end customer goes out of business, the data can be cleaned up with the right access.
I believe that even in Governance mode, it's not just an admin account required to remove the data, but also a secadmin account. So it feels like there are mitigations available, and that Veeam could potentially just throw a warning dialog up if Governance mode is in use rather than actively blocking it and making it harder to access.

Surely people being able to use Governance mode are still in a better place, than no immutability at all.

[Andreas Neufert]

The only scenario where Governance mode might be acceptable is in a service provider scenario with Cloud Connect, as the customer has no access to the storage system at all. We need to operate in a situation where the whole set of computers is compromised. You type in secadmin once and the hacker will destroy your data. As well we have seen scenarios with social engineering where people faked the vendor support. As a customer I would not go with that. Do you have a feeling for the license price of such a license?

[Stabz]

Hello,

Veeam now supports RTL natively with DD. One of my customer was until now using the solution with a Linux Virtual machine with a script to applied the immuability.

Now they want to switch to the native solution with Veeam to avoid to maintain this VM and script.

Do you have an kb or procedure to follow to make this change ?

[Andreas Neufert]

Here is a good blog with a lot of screenshots:
https://www.starwindsoftware.com/blog/c ... ntion-lock

You might want to switch your script to a delete over time mode, to remove the immutable fast copies over time from the old system.

[benthomas]

The only scenario where Governance mode might be acceptable is in a service provider scenario with Cloud Connect, as the customer has no access to the storage system at all. We need to operate in a situation where the whole set of computers is compromised. You type in secadmin once and the hacker will destroy your data. As well we have seen scenarios with social engineering where people faked the vendor support. As a customer I would not go with that. Do you have a feeling for the license price of such a license?

Veeam now has a regkey for service providers to support governance mode for S3 repos, can we get a similar regkey added to enable this same functionality for data domain immutable repos?