Backup of select servers to external repository

[mortenr]

We currently back up our servers daily through a number of VMware and agent backups to onpremise scale-out repositories.
Backup copy jobs then copies them to a secondary offsite hardened repository.

Due to legal requirements, we need to start storing a weekly backup of financial systems on an external repository for five years, where we do not have access to alter data. We have gone with Veeam Data Cloud Vault to comply with these requirements.
But how do we best incorporate this in our existing backup process? We still want to keep our daily backup locally for normal operations.

To illustrate, say we have three VMs being backed up by job BackupJob01 to the primary repository. Then copied by CopyJob01 to the secondary repository.
VMs are managed by vSphere tags.
VM01, VM02, VM03 --- BackupJob01 --> PrimaryRepo --- CopyJob01 ---> SecondaryRepo

And we have three agent based machines, which are being backed up by BackupJob02 and then copied to the secondary repository by CopyJob02.
Machines are managed by protection groups based on AD groups
AG01, AG02, AG03 --- BackupJob02 --> PrimaryRepo --- CopyJob02 ---> SecondaryRepo

Now, we want to make a back up VM02 and AG03 to ExternalRepo once per week without impacting the current backup policies.
What are the best options here?

My initial thought was to create new Backup Copy jobs, run them on a schedule and pick the select machines, making the flow look something like this:
VM01, VM02, VM03 --- [BackupJob01] --> PrimaryRepo --- [CopyJob01] ---> SecondaryRepo --- [CopyJob03(VM02)] ---> ExternalRepo
AG01, AG02, AG03 --- [BackupJob02] --> PrimaryRepo --- [CopyJob02] ---> SecondaryRepo --- [CopyJob04(AG03)] ---> ExternalRepo
However, when creating a new Backup Copy job, I can not see any options to specify which objects to include. Only which objects to exclude, which is not practical in this case.

My other thought would be to create new backup jobs, specifying the target machine and run in parallel with the existing backups. Flow would look something like this:
VM01, VM02, VM03 --- [BackupJob01] --> PrimaryRepo --- [CopyJob01] ---> SecondaryRepo
AG01, AG02, AG03 --- [BackupJob02] --> PrimaryRepo --- [CopyJob02] ---> SecondaryRepo
VM02 --- [BackupJob03] --> ExternalRepo
AG03 --- [BackupJob04] --> ExternalRepo
We could then manage scopes by adding a new tag for the virtual machines and creating a new protection group for the agent based machines. Would this work without impacting the existing processes?

Are there any other options I have not thought of?

Thanks in advance

[Mildur]

Hello Morten,

Here’s a simpler option that will only require a single backup job for each machine:

Backup Jobs:

• BackupJob01 (include VMware tag, exclude "VM02") → PrimaryRepo

• BackupJob02 (AG01 + AG02) → PrimaryRepo

• BackupJob03 (VM02) → PrimaryRepo

• BackupJob04 (AG03) → PrimaryRepo

Copy Jobs:

• Immediate CopyJob01 (Source: BackupJob01, BackupJob02, BackupJob03, BackupJob04) → SecondaryRepo

• Periodic weekly CopyJob02 (Source: BackupJob03, BackupJob04) → ExternalRepo

I suggest considering daily or immediate copy jobs to the external repository. On object storage repositories, only changed or new backup data will be uploaded. Having an immutable daily copy may be much better than only a weekly copy of your financial systems. But that's a decision which depends on your business requirements on how much data you can loose. 1 week will be too much for most organizations.

Best,
Fabian

[mortenr]

Hi Fabian

Thanks for the input. Sound like a more elegant solution. May assign a new tag on these systems, which I exclude on the current job but use as scope for the new job. I prefer this to setting specific machines as targets.

Regarding schedule, we run daily backups to our local repository and keep those about 6 months, so that will be our primary source in for restore operations.
New legislation requires us to keep a weekly copy for 5 years. Not for recovery purposes, but for auditing. Due to the long retention, we don't want to store more data than necessary. So unless it literally amounts to the same amount of data, the plan is just to do the weekly backup.

Best regards
Morten