Application-aware processing. Really necessary?

[pablonunes]

Hi all,

I don't have any of my jobs with application-aware image processing enabled, neither vmware tools quiescence. But, after reading the last veeam digest, this question came to my mind. I do need to enable it? (concerning the symantec buzz/windows 2k8 R2)

Text from the digest:

"However, it is important to understand that the issue causing this sits outside of VDP, and is actually quite old. In fact, it affects all backup solutions which leverage VMware VSS integration instead of providing their own. Veeam B&R has had proprietary VSS integration since version 2 (particularly due to lack of functionality and limitations of native VMware VSS intergration), so just be sure to enable application-aware processing enabled in Veeam job settings for it to be used. If instead you enable VMware Tools quiescence in the advanced job settings, you will be affected by the issue as well."

Thank you

[Vitaliy S.]

Hi Pablo,

Yes, it is, please see the details in our sticky F.A.Q. > Application-Aware Image Processing

Thanks!

[foggy]

Pablo, Veeam B&R provides two options for VSS-enabled backups: our own proprietary VSS integration that provides full application-awareness and VMware Tools quiescence that has a bunch of limitations around OS and hardware. If you do not select any of the options in your jobs, you are not affected by the described issue.

However, I would note that it's always better to use application-aware image processing to backup highly transactional VMs (such as Exchange, SQL Server, etc) if you want to have consistent backups. Without VSS quiescence, your backups will be crash-consistent, not application consistent.

[veremin]

In addition, if you’re willing to learn more about Windows VSS and all things related to it, please take a look at this article.

Probably, you'll find it useful.

Thanks.

[pablonunes]

Hi guys,

Thank you all for the informations, much appreciated. Now its very clear.

[tholyoak]

Is it possible to do anything more than a crash-consistent backup for a Linux-based virtual appliance?

[chrisdearden]

Is it possible to do anything more than a crash-consistent backup for a Linux-based virtual appliance?

Has that appliance got VMware tools installed? if so then you can utilise the VMware tools quiesce , even adding in your own prefreeze/post-thaw actions.

Without VMware tools installed though you are a little bit stuck.

[Vitaliy S.]

Yes, Chris is correct, VMware Tools for Linux is a way to go. Should more details be required, please search these forums for real-life examples of pre-freeze and post-thaw scripts usage.

[chadtandy]

Hi, we have a medium size environment with 280 VMs and ~10 vlans (way too many...), but for simplicity sake, we are only doing Veeam application aware image processing on SQL and Exchange servers. The remaining application servers we are just relying on VMWare Tools quiescence. Recently we've had a rash of service interruptions on servers causing short outages while snapshots are being taken or committed on servers where we're using just VMWare Tools quiescence. Does Veeam application aware processing take "gentle-er" snapshots? We'd been using the VMWare Tools quiescence for ~1 year with little issue until the last week or two.

Thanks,
-Chad

[Vitaliy S.]

Hi Chad,

Snapshot commit operation is performed in the same way no matter what you use Veeam AAIP, VMware Tools quiescence or nothing at all. Please take a look at the topic you've been merged to for more info on the difference between Veeam AAIP and VMWare Tools quiescence.

Thanks!

[sandsturm]

Hi all

I'm not sure if I have to enable application-aware processing on all our servers. As I understand it right, Application aware processing can just be used for a bunch of applications like Exchange, Sharepoint, Active Directory etc. I have thousands of servers with other applications then these and my question is: Is the backup process the same for servers without one of the listed applications if I have enabled the application aware processing or not? (Vmware Tools quiescense is disabled because we use DirectNFS). Background for this question is that i have to configure an account on every server with local administrator permissions if I enable Application aware processing and if not, I can do it without configuring this user on all servers. What is the "best practices" way of doing this? Do you create this account (or multiple accounts?) on all your servers and enable app-aware processing for all machines or not?

thx and regards
sandsturm

[Vitaliy S.]

Hi sandsturm,

Is the backup process the same for servers without one of the listed applications if I have enabled the application aware processing or not? (Vmware Tools quiescense is disabled because we use DirectNFS).

If your applications have VSS writers and providers, then enabling AAP is recommended for creating application-aware backups.

Background for this question is that i have to configure an account on every server with local administrator permissions if I enable Application aware processing and if not, I can do it without configuring this user on all servers. What is the "best practices" way of doing this? Do you create this account (or multiple accounts?) on all your servers and enable app-aware processing for all machines or not?

If you already have a service account created on these computers, you can use this one or create/use the same account across all VMs.

Thanks!

[GDLtechie01]

What happens if I backup a SQL server without selecting Application Aware processing? I understand it is 'crash-consistent' but perhaps we can elaborate a bit more on that. My understanding is that some transactions can be lost from the time of the backup because Veeam will not bother to quiesce the I/O going to the database - Is this correct? This may be related then, but how can Veeam backup SQL database files (.mdf) even though the database is mounted.

[PTide]

Hi,

'crash-consistent' basically means 'state of the machine as if someone had suddenly unplugged the server from its power source'. That is, some transaction might not be on the disk at the moment a snapshot was taken, although they have been finalized.

If you don't want to use AAIP (why though?) and have VMware Tools installed in the guest VM, then you can use VMware Tools quiescence instead:

Supported quiescence features differ depending on the type of the VM guest OS:

For VMs running Windows Vista and Windows 7, the VMware VSS component does not use application writers. As a result, the created VSS snapshots are file-system consistent.
For VMs running Microsoft Windows Server 2003, the VMware VSS component uses application VSS writers. As a result, the created VSS snapshots are application-consistent.
For VMs running Microsoft Windows Server 2008 and later, the VMware VSS component may or may not use application writers, depending on the VM platform and state. The created VSS snapshots can be file-system or application-consistent.

Thanks!

[sandsturm]

The reason to not use AAIP is the need for a service account, which is member of the local Administrators group on every server. Our security guys are not really amused with such requirements . We have about 1500 Windows server in differents security zones and probably I have to create a separate account for each zone. VMware tools quiescence is not an option in our case, because we're using DirectNFS.

[Vitaliy S.]

If you cannot use AAIP, then I would recommend using SureBackup jobs to verify recoverability for all your mission-critical VMs and applications.

[jhoughes]

The reason to not use AAIP is the need for a service account, which is member of the local Administrators group on every server. Our security guys are not really amused with such requirements . We have about 1500 Windows server in differents security zones and probably I have to create a separate account for each zone. VMware tools quiescence is not an option in our case, because we're using DirectNFS.

You would only need an account per server with access, rather than a single service account with access to every server, as these credentials could be specified for each object targeted in your backup.

This means that you could set specific credentials per job, if your jobs matched to your security zones; or you could also specify per VM/template, host/cluster, datastore, or tag depending on which object type you use for including VMs your backups.

If you tagged your VMs by zone and had your backups created with those tags being included, then you could specify security accounts per zone, but again some of this will depend on your VMware structure and ability to group your VMs based on needs for things like backup schedule/backup target/AAIP account/etc. and then tag accordingly.

It could take some effort to get there, so it's all dependent on your needs.

[sandsturm]

Thanks for your answer. Yes, all Backup jobs are tagged with a zone relevant tag, so it makes sense to have one account per zone or something. I'll think about it.

Thx,
sandsturm