General Best Practice Veeam Backup Questions

[robns]

Hi,

I use Veeam community and enterprise edition extensively in my new job in an MSP where we back up physical servers, VMWare and Hyper-V VMs. Sometimes the Veeam backup server is a dedicated physical or a VMWare virtual server, or in a few cases it's a single site server running Veeam backing up itself and running various network roles. I'd like to know what the best practices are for approaching different backup scenarios.

Questions
Is Veeam best run on a separate server or is it still perfectly fine backing itself up as an 'Entire Computer' or 'Volume Level Backup'?

If I create a backup job by selecting > Backup > Windows Computer, I get the following options:

- Entire computer.
- Volume level backup.
- File Level Backup.

If I'm doing an Entire computer or Volume backup of, say for example the C drive, what about those small system and recovery drives Windows always adds when you install Windows? Entire computer backup will account for them? I assume volume level won't. That would mean having to rebuild a clean server then restore the volume to it?

VM restore to either ESXi or Hyper-V. Does it just insert the entire VM back into the Host as a new VM or does it overwrite the current VM? I assume it's possible to restore a VM into an entirely new host?

I have a server that is using Veeam back up itself, it's also got a Hyper-V VM on it and running as a domain controller. Can this effectively do a Windows Agent backup of itself as an 'Entire Computer' backup with a Hyper-V VM on it? Or is it better to do, for example, a volume level backup of the C drive and a separate Hyper-V backup of the VM?

In the guest processing section of a backup job, is 'Application aware processing' specifically necessary for SQL? When else should it be specifically used, practically speaking? And what about the next option, guest file system indexing?

Thanks very much.

[Mildur]

Hello Robns

Here my comments about each question.

I use Veeam community and enterprise edition extensively in my new job in an MSP where we back up physical servers, VMWare and Hyper-V VMs.

Please note, providing services as an MSP with the community edition would violate our end user license agreement (EULA):
https://www.veeam.com/legal/eula.html (2.0: Prohibited Use + 4.0: Free Licenses and Community Edition Licenses)

If you are using the community edition to provide services to a third party, please contact your regional Sales team to discuss rental licensing. You must license all customers who you provide managed services. Managed services: support, maintain or provide any assistance for existing or new deployments of any Veeam product.

Additionally, using a backup server with community edition and a licensed backup server to protect the same environment is also against our license policy.

Questions
Is Veeam best run on a separate server or is it still perfectly fine backing itself up as an 'Entire Computer' or 'Volume Level Backup'?

Veeam Backup & Replication should be on a dedicated hardware when ever possible. Assume your production environment gets successfully attacked. The attacker would also have access to the entire backup configuration and backup files. Immutable or airgapped backups are mandatory in such situation or you will loose anything. Production Data and Backups.

If I create a backup job by selecting > Backup > Windows Computer, I get the following options:

- Entire computer.
- Volume level backup.
- File Level Backup.

If I'm doing an Entire computer or Volume backup of, say for example the C drive, what about those small system and recovery drives Windows always adds when you install Windows? Entire computer backup will account for them? I assume volume level won't. That would mean having to rebuild a clean server then restore the volume to it?

I would use entire computer whenever possible. But as explained in our userguide, with volume level when you select the operating system drive, all neccessary partitions will be included automatically: https://helpcenter.veeam.com/docs/backu ... ml?ver=120

"If you include a system volume in the volume-level backup, Veeam Agent for Microsoft Windows automatically includes the System Reserved/UEFI or other system partitions in the backup too."

VM restore to either ESXi or Hyper-V. Does it just insert the entire VM back into the Host as a new VM or does it overwrite the current VM? I assume it's possible to restore a VM into an entirely new host?

If you have created VM backups, then you need to decide if you want to restore it as a new VM or replace the original one. The restore wizard will ask you for a decision.
For backups created by our agent, you need to use Instant Recovery. In that case it will be a new VM.
A VM can always be restored to a new Hypervisor Host.

I have a server that is using Veeam back up itself, it's also got a Hyper-V VM on it and running as a domain controller.

Please consider to deploy a dedicated VM for Veeam Backup & Replication and one dedicated VM for the domain controller. Running the backup server on the domain controller or in production domain is considered as really bad practice.
Additionally, installing Veeam Backup & Replication on the HyperV server is not supported. Either install Veeam Backup & Replication on a dedicated VM or dedicated physical machine.

Can this effectively do a Windows Agent backup of itself as an 'Entire Computer' backup with a Hyper-V VM on it? Or is it better to do, for example, a volume level backup of the C drive and a separate Hyper-V backup of the VM?

Yes. But why using an Agent and a VM backup job? Just use a VM backup job. Agents for VMs are only recommended in some special use cases.

In the guest processing section of a backup job, is 'Application aware processing' specifically necessary for SQL? When else should it be specifically used, practically speaking?

Yes, if you want to make sure to have application consistent backups and to truncate SQL transaction logs after the backup has finished. You should enable it whenever possible.

And what about the next option, guest file system indexing?

Guest indexing is only required to be able to search in Enterprise Manager for files in all your restore points or if you enable Guest Index Scan in Veeam Backup & Replication.

To conclude my comments:
- To not use community edition to provide services to your customer
- Deploy Veeam Backup & Replication to a dedicated machine or at least a dedicated VM
- Do not install Veeam Backup & Replication directly the HyperV operating system. Not supported!
- Backup whenever possible Hyper-V VMs with a VM backup job (not agents)
- With Veeam Agent backup jobs, use Entire Computer to make sure to have protected everything
- Use immutable or air-gapped backup targets
- Use application aware processing
- Use guest indexing only when you have Enterprise Manager or guest index scan enabled

To learn more about our best practices, read our Veeam Backup & Replication Best Practice guide:
https://bp.veeam.com/vbr/

Best,
Fabian

[robns]

Hi,

Thanks for your detailed response. I'm new to the position so I will look into the community versus enterprise editions, I might be mistaken.

I'm not sure how you airgap a backup server yet still backup other computers on a network, they must have access to the LAN.

"Running the backup server on the domain controller or in production domain is considered as really bad practice."
- I absolutely agree with this and would never recommend such a setup. Unfortunately, customers can't be told when $ are involved.

Thank you very much for the time you have taken to answer my questions.

[Mildur]

Hi Rob

You're welcome.

I'm not sure how you airgap a backup server yet still backup other computers on a network, they must have access to the LAN.

It's not the backup server which needs to be air-gapped. The backup target (backup repository) should be air-gapped or immutable.

With our products, you can choose from a wide range of supported types of backup target:
Immutable:
- Hardened Repositories
- Object Storage
- HPE StoreOnce
- Dell Data Domain

Air-Gapped:
- External USB Disks (Backup Repositories with Rotated Drives)
- Tape (only for secondary copies of backups)

Insider Protection:
As a Service provider you can also deploy Veeam Cloud Connect in your datacenter. Customer will be able to send backup data to a cloud connect repository (called cloud repository). For this Cloud repository, you can enable Insider Protection. If an attacker deletes backups on the customer backup server, backup files in this cloud repository will be moved to a recycle bin for a specific amount of days instead of being deleted right away.

Best,
Fabian

[robns]

Does Cloud Connect also have a DRaas option for high availability? The service we are currently using is seriously letting us down.

[tyler.jurgens]

Cloud Connect definitely has a DRaaS option, but I'm not sure what you mean for "high availability". Are you looking to make the Cloud Connect server highly available, or are you looking to replicate your VMs to a Cloud Connect provider for disaster recovery?

[robns]

We want DRaas, so if the customer's server falls over, the DRaas located server is switched on and local services are pointed to it until the local server is rebuilt, hence high availability.

[robns]

I'm wondering if you might be able to help with this as I've gotten no responses to it in another thread.

I'm often getting backup failures with VSS related errors when running Veeam backups at night, 'VSS_E_SNAPSHOT_SET_IN_PROGRESS. Code:0x80042316'. The reason is that the Volume Shadow Copy service is already running when backups start. Something is using it. This service is set to manual in Services.msc and only runs when it is required, but whatever is using it is not stopping it when finished.

At this stage, I'm having to run a scheduled task with 'net stop vss' just before backup on the problem servers, but this should not be required. How else can I diagnose or identify what is causing it to run, what's using it, why it's not turning off.

Thanks.

[Mildur]

Hi Rob

This is not a support forum and we cannot investigate technical issues over forum posts.
Please contact our customer support team if you want to troubleshoot such issues.
Our forum rules were provided in red letters when you created this topic:

POSTING AN ERROR OR TECHNICAL ISSUE?
You must include Veeam support case ID, or your post will be removed (learn more)

Best,
Fabian