Can we achieve immutability on a SAP database running on an AIX system?

[dimaslan]

We are looking for a way to have primary or at least secondary immutable backups for an Oracle SAP database running on an AIX system.
On the specs for the Veeam Hardened repository, it's mentioned that the immutability feature is supported for image-level backups only.
You can use a hardened repository to store NAS backups, transaction backups, RMAN/SAP HANA/SAP on Oracle backups, but you cannot use the immutability feature to protect these backups.
Taking into consideration that, VEEAM (and not only VEEAM) cannot support immutability for SAP and Oracle Databases.
Would it be possible to do image-level backups of the whole server to the Hardened repo? Would these be considered image-level and therefore trigger immutability?

[HannesK]

Hello,
The Veeam agent for AIX backups are supported for immutability, right. But then you would need to dump it to the local server... not sure how much sense that makes. It does not even need to be the whole server. Any Veeam Agent for AIX job works.

Also if you dump the database backups to a machine that is then backed up to a hardened repository, that would work, yes.

Best regards,
Hannes

PS: we are working on improving the situation

[PTide]

It's not clear to me what exactly you are looking for.

If you are looking for BMR capabilities so that you could back up the whole AIX server and send it to a Hardened Repo, then yes, it will be possible soon.

If you are looking for sending AIX backups to a Hardened Repo, then you can already do that today.

If the question was 'whether Veeam AIX agent will provide built-in AAIP for SAP capabilities?', then the answer would be 'it's not on our short-term roadmap'.

Thanks!

[dimaslan]

Basically, the actual question from the customer is:

"It is possible to take an image backup all AIX System or Linux machine that hold Oracle and store it in an immutable storage, not only the databases? I want to remind here that we have ΑΙΧ version 7.1 system with partitions and VIOS".

They were looking for some way to store these backups to the Hardened repo but they need them to be immutable. They are also looking for other options like vendors with hardware immutability.

[HannesK]

Hello,
for AIX: if you select "/" with the Veeam Agent for AIX, then you get backup of everything and it's possible to do that to a hardened repository. But I would not do that with an Oracle database (well, except you are backing up a dump of the DB). For the database (RMAN backups), I already mentioned that we are working on the immutability topic.

for VIOS: installation of the Veeam Agent for AIX is unsupported for virtual I/O servers

for Linux on Power: currently unsupported for Veeam Agent for Linux. It would be interesting to hear which Linux the customer is using on Power

Best regards,
Hannes

PS: "hardware immutability" backup solutions are also just software running on pre-configured hardware configurations instead of hardware choice of the customer. In the end, it's all software

[dimaslan]

@hannesK thanks for your reply.
As indicated by the customer, they do have the server on VIOS. That would mean we cannot just backup the whole server I guess.
The thing is, some backup vendors advertise immutability on the "hardware" level, stating that even if you have full access to their device you won't be able to delete / purge backups or wipe the whole device in any way.

[HannesK]

yes, the VIOS manages the hardware, that's okay. Normally there is no need to back that up (that would be like backing up the ESXi hypervisor).

I created a picture based on "AIX 7.2, PowerVM – Unix Virtualization and Security: Page 34" by Sebastian Biedron




Same like VMware: you can back up the VMs, but not the host itself.

And I'm pretty sure, that is something the customer does not really want anyway. That would be like backing up Oracle databases without application consistency. I see SAP in the title... I cannot imagine, that this kind of backup would make the SAP admin happy

stating that even if you have full access to their device you won't be able to delete

that's marketing the reason they can do that is that they don't offer full access (except for their support sometimes). I think the closest one to "hardware" is Netapp which has some firmware features on their hard disks for SnapLock. But the backup appliance vendors just lock out the root user out of their (Linux) systems. That approach is okay for a hardware vendor, totally fine. All software vendors like us (there are many WORM software vendors out there) have to rely on that somebody takes of hardware and operating system.