Veeam Agent Backup - Large Incremental backup size

[mactech2020]

We are testing out Veeam agent backups for use with Windows PCs and deployed the agents to all our computers. We noticed we were having large incremental backup sizes (upwards of 40-50GB). We changed the backups from "Entire Computer" to file level based and excluded some problematic directories with no change in backup size. We ran a script to identify the daily file churn/modification and saw roughly 4-5GB of files changes and backups were still 40-50GB.

We also use SentinelOne and had the idea to temporarily disable snapshots and this immediately fixed the issue, backup file sizes back in the 4-10GB range. Some background: We all have 512GB hard drives with S1 bound to not use more than 10% of the drive for shadow copies, so we're thinking that the Veeam agent is backing up the shadows because the incremental size seems consistent with 10% of the drive + modified file size. Does anyone else use S1 and have this issue? Is there a better workaround than disabling snapshots? We don't have this issue with our current backup solution. I'm planning to reach out to both support teams but am anticipating that both sides won't have a solution since neither toolset is directly malfunctioning.

[Mildur]

Hello Ryan

Veeam Agent for Windows only protects changed blocks of your Windows PC. If the incremental has a size of 40-50GB, then there was a change detected by our change block tracking mechanism.

How does SentinelOne create a Snapshot? Are those snapshots VSS snapshots/shadow copies?

Best,
Fabian

[mactech2020]

Hi Fabian,

Thanks for the info, and yes, SentinelOne snapshots are VSS based. One thing I am trying is switching my backup license to a server to see if installing the CBT helps. I'll post an update here in a few days,

Thanks,
Ryan

[alippiatt]

Hi Ryan,

Me too. 250 GB storage on server drive, doing volume level backups. Our daily incremental backups used to size around 5-10 GB, now they're 40-50 GB after installing SentinelOne Agent. If you don't mind me asking, what script did you use to compare changes in incremental backups?

Thanks,
Aaron