Apply encryption to existing Backup Copy Job

[ifi-iok]

Can someone clarify what really happens when encryption is enabled for an existing backup copy job with archival fulls enabled?

I have understood that if I enable encryption for a "standard" job, a new full backup is performed and so I will have two full backups in the repository until the retention period for the non-encrypted one is expired.
But what about a copy job that stores a full backup and some incrementals, plus some full backups for archival purposes?
I can guess that a new full will be created to start a new incremental chain, so that I will have two full backups in the repository until the non-encrypted one expires, and the existing archive backups will stay unencrypted until they will expire while the new archive backups will be created with encryption.
Is this correct?

Thanks

[veremin]

What kind of GFS mode are you using? Synthetic or Active full one? Thanks.

[ifi-iok]

There's a "standard" Job, then a backup copy job linked to it.
The backup copy job runs every 7 days and keeps 8 restore points, then it is configured to keep 6 monthly backup for archival.
The archival backup mode is synthetic (the option for reading the restore point from the source backup is not selected).

However I would like to know if there is a different behaviour with synthetic and active full backups for archives.

[veremin]

However I would like to know if there is a different behaviour with synthetic and active full backups for archives.

Originally I thought that with active full GFS method, you wouldn't need to create new active full backup (as product would do that for you).

However, it turned out that there is a bug with the described behaviour - in case of scheduled active full GFS encryption settings do not apply.

So, regardless of used GFS method you will need to create an active full backup manually.

Thanks.

[ifi-iok]

I have read about this bug in an old forum post, but it was related to Veeam v8 if I'm not wrong...
So, you are telling me that there is still a bug in the latest Veeam B&R releases so that even if I enable encryption on an existing Copy Job, encryption is not actually enabled because a new chain, with a new full encrypted backup, is not actually started. And this does not happen for a "standard" Job, where a new chain is started when encryption is enabled.
This seems a very serious bug! I can't believe it is still there.
I think it's serious because after enabling encryption, looking at the backup job files, in Veeam B&R under Backups\Disk (copy), they are shown as encrypted, but this is not true! I would say that this is "dangerous"...
Should I open a support ticket to make Veeam fix the bug? Can you report it to the developer's team and press them for an urgent fix?

[veremin]

So, you are telling me that there is still a bug in the latest Veeam B&R releases so that even if I enable encryption on an existing Copy Job, encryption is not actually enabled because a new chain, with a new full encrypted backup, is not actually started. And this does not happen for a "standard" Job, where a new chain is started when encryption is enabled.

Nope, this is not what I'm telling you.

To apply encryption settings you have to create new active full backup manually (and you have always had to previously). Backup copy job will even notify you about that in its session log.

However, I was thinking that new (manual) active full backup wouldn't be needed in case of active full GFS method. Why? Because with such method in place active fulls backups are created automatically on a schedule that you've set (weekly, monthly, quarterly, etc.).

But it turned out that scheduled GFS active full backup does not enforce encryption settings. So, in other words, manual active full backup is still needed.

Thanks.

[ifi-iok]

Ok. I have seen that enabling encryption for the backup copy job a pop-up tells me "New settings will be applied with the next Active Full backup".
This warning does not seems related to the encryption, but rather "generic".
However since my jobs are configured for Synthetic Full Backups, I guess that a manual Active Full is needed.
But... I applied new encryption setting for a backup copy job on friday. Tonight the job has run and no new full backup has been created, as expected because of the Syntethic Full configuration. But in the session log there's a message saying that "Backup File Will be Encrypted".

So there's a quite generic warning after I modify Backup Copy Job settings to enable encryption, the session log shows that Backup File will be encrypted and B&R shows that encryption is enabled in Backups\Disk (copy) panel.

So excuse me if I'm writing again but I need to understand. Both B&R Disk (copy) panel and the session log are wrong and the files are actually not encrypted, right?
If that is true, I think there's a problem with B&R because it let me believe that files are encrypted while they are not.

Can you point me to some job log entry, or elsewhere, where I can verify that backup files are actually encrypted?

Thanks

[veremin]

New encryption settings will be applied, after you run active full backup manually.

If you think UI provides misleading information, kindly, open a support ticket and let our support team investigate that.

Thanks.

[davide.asts]

So, please let me understand.

I have many standard Backup Job with weekly Full Active; these jobs didn't have any encryption enabled.

I enabled them and I "thought" that, as highlighted by the popup, Veeam should have forced a new Active to be encrypted.

What does it mean? That even if I see in my repository the backup flagged with a key, the are NOT encrypted?

[veremin]

If you enable encryption for an existing backup job, during the next job session Veeam Backup & Replication will create a full backup file to apply encryption.

For backup copy job - you will need to create an active full manually.

Thanks!

[davide.asts]

Clear answer, thank you!

[redhorse]

Hi,

we have several backup and backup copy jobs without encryption enabled. Now, what happens to the existing backup chains if I enable the encryption on a backup job? Would it also have an effect on the still unencrypted backup copy jobs?

[Mildur]

You need to start an active full, before new restore points can be encrypted. Existing restore points will not be reprocessed.

I have read somewhere, that for backup jobs, the active full will automatically start at the next runtime, for backup copy jobs, you need todo it manually.
But I don‘t find the link anymore.

[Natalia Lupacheva]

Hi folks,

moved your posts to the existing thread, you can check the discussion here.

Thanks!

[redhorse]

You need to start an active full, before new restore points can be encrypted. Existing restore points will not be reprocessed.
I have read somewhere, that for backup jobs, the active full will automatically start at the next runtime, for backup copy jobs, you need todo it manually.

But if I just want to encrypt the backup job and not the backup copy job, do I just need to activate the encryption for the source job wait for (or manually start) the active full and the backup copy job still works as before?

Is it supported or recommended to activate the encryption on the storage level to avoid a new active full? We use Synology as primary storage on some remote sites and I can activate the encryption on OS level, is this fine from Veeam perspective?