Is support for data immutability on HPE Storeonce on the Veeam roadmap?

[DPatDSG]

Hi Veeam Team.

The HPE Storeonce line of deduplication storage arrays offer time-lock data immutability (i.e. the ability to prevent the backup product from being able to change data is has written to the Storeonce for set duration) but only with backup products that support the feature.

Do Veeam plan to support this feature for the HPE storeonce devices?

[HannesK]

Hello,
and welcome to the forums.

HPE is a very important Veeam alliance partner. Especially the StoreOnce systems are always a part of our joint improvements. Right now it is to early for details. But of course, we are looking at such features.

Best regards,
Hannes

[DPatDSG]

Thankyou for the information

This feature (offline backups) is presently being sought by many government agencies in response to The Australian Signals Directorate Essential Eight security initiative. (see https://www.cyber.gov.au/publications/e ... -explained). As such I expect the feature is becoming an important requirement for government when selecting backup products

[bc-109]

Hi all,

+1 for data immutability on hpe StoreOnce.

As a service provider, we are currently investigating about immutable storage to add an additional layer of security for our customer's data. We are already using hpe servers and StoreOnce virtual appliances. Then, this would be a "natural" upgrade path for us.

Thank you in advance. Kind regards.

[mdmd]

Same here, we already have storeonce and would love this feature! Also can’t wait to read more about v11 and immutability

[HannesK]

Hello,
as I didn't answer for quite some time... your votes are heard & counted. So keep it coming.

With V11 we will include immutability with the "Hardened Repository" feature. "Hardened Repository" runs on any Linux (requirements will be in the user guide. but nothing special here). In combination with XFS it allows a fast and cost effective immutable alternative to deduplication appliances in general.

For StoreOnce immutability support: it did not make it into V11. For any version beyond V11 it is too early to talk about.

Best regards,
Hannes

[Florent Foulquier]

Hi HannesK

Even so hardened repo with linux that brings V11 is a really nice feature to have. we have together HPE and VEEAM a large install base with StoreOnce and VEEAM and this will increase in the futur as we are working together to have a better and better integration.

Regarding StoreOnce Data Immutability it is a MUST HAVE feature availble on StoreOnce for some years now and we cannot afford to wait too long in the actual situation where Cyver Attackl are increasing and the first thnig they try is to delete backups before putting a cryptolocker.

I know it requires a rework from your side but we really need to accelerate. Any thing we could do to help, just ask.

Regards

Florent

[HannesK]

Hello Florent,
the same question came up yesterday internally and and our product manager responsible for alliances mentioned that HPE needs to change things first. So we are currently waiting for HPE.

Best regards,
Hannes

[CLDonohoe]

Florent, thank you for continuing to make clear the need for StoreOnce immutability. I fully agree this will be a valuable feature to help protect against ransomware and active attackers. As Hannes said in an earlier post, your votes are heard and counted, so keep them coming.

While we acknowledge the value of the feature, we are also in an awkward position of commenting on a V12 feature set when we just released V11 last week.

Please continue commenting in forums regarding features you deem most valuable for our mutual HPE+Veeam customers. We value feedback from the field very highly!

[LDEFCOF]

+1 for this MUST HAVE feature. As soon as possible, in an update of the current version.

Mandatory to use it in PCI DSS environment for us. Now, we can not change our current N******* architecture due to this lack of immutability.

[Andreas Neufert]

Hello, thanks for the huge interest in this feature. We are currently waiting for some HPE API enhancements that would allow us to use the HPE StoreOnce Immutability.

[Gostev]

All, if you have nothing to say besides +1, then please use the LIKE button on the original post to show your support for the feature request.

We will clean up this topic a bit later leaving only the useful payload, to make it more easily consumable.

For example, the latest material status update is now hidden on the previous page due to all the recently added +1s.
Which in turn results in even more useless +1s from people no longer seeing the current state of the feature request.

Thanks for understanding!

[krodowa]

I'd love to see this feature as well. Any chance you can provide an update on if this is being worked on of if there is an ETA on when this feature?

[Gostev]

Unfortunately, we cannot make comments or provide ETA for any future functionality. Especially so when we're dependent on another vendor implementing some required capabilities, before we can even start the implementation on our end...

[astruill]

+1
Data immutability is a key point nowadays. It is pity not to benefit from it espacially given the investment made around Veeam backup software and Storeonce appliances.
A clear roadmap is really required to move forward in order to confirm the strategy around backups and ransomware prevention.
Veeam team, your clarification is required!

Kind regards.

[Gostev]

Reading the thread before posting is likewise required please see the latest update from Andreas.

[Florent Foulquier]

Hi All,

Just an update for everybody in the thread.

I come with a good news for you. HPE just provided the beta firmware with the Catalyst API enhancement request by Veeam.

This enhancement will permit to set the Data immutability period at the VEEAM level with the granularity of the jobs instead of the whole catalyst store.
Even so we all know it will take some time for Veeam to develop the integration and that Veeam cannot comment about a deadline, we are on the good way!

Regards

Florent

[mike_stewart]

Hello,
Glad to ear that. Great news.
Do you expect to have the immutability integration within Veeam and StoreOnce per Job this year?
Thanks.

Regards,
Sergio Alves

[Andreas Neufert]

This is unlikely just by the fact that the next possible version where we could add it is v12. We have major releases once a year and v11 was released in February.
But remember we are depending on the right timing of HPE as well.

[Florent Foulquier]

Hi Mike,

As Andreas mention we will have to wait for V12. The only thing we could expect by the end of the year is a Beta or preview version since I heard that HPE/VEEAM work is going ahead.

Regards,

Florent

[VirtualJosh]

+1
I would add... given the state of Ransomeware through all industries this feature might warrant a release ahead of v12.

[Gostev]

I agree with a concern but why not implement one of many other options for immutable backups that Veeam provides for many years now?
I'm sure you understand we can't change the release schedule over a feature for a storage device used by just a few % of our customers...

[mike_stewart]

Hi Gostev,
Right now, there is no option for immutable backups (per Job) between HPE StoreOnce and Veeam.
That's why this is a feature that many costumers want to have in our days.

[foggy]

I believe here Anton is referring to other functionality ensuring data immutability that Veeam B&R provides: e.g. tape, S3 with Object Lock or Hardened Repository.

[Florent Foulquier]

Hi All,

I can understand the frustration since we are all impatient to see StoreOnce Data Immutability supported on StoreOnce.

Whatever if it will not be before V12, we have never been so close since the VEEAM and HPE R&D are really focused on it.

So we hope to have a preview/beta release before the end of the year so that some partners could start to test it. Maybe Anton could give a comment on that.

That means that if everything is going ok during the testing period we could expect to have it on H1 CY22...

Regards

Florent

[crackocain]

Hello, i want to ask why right now immutability not work with Storeonce?

Which part is not compatible for Veeam? Because we could enable 7 days immutability in Storeonce settings and in Veeam 30 days backup retention and weekly full. Right now backup jobs not fail. So i want to ask which part we see fail alert. Thank you.

Day 1: Full
Day 2: Incremental
Day 3: Incremental
Day 4: Incremental
Day 5: Incremental
Day 6: Incremental
Day 7: Incremental
Day 8: Full

[Andreas Neufert]

In general it is not about the backup chain.
Remember we store our metadata within the backup files and in additional files.
So an overwrite of the metadata when needed can not be done with the immutability enabled.
As well we are monitoring the backup chain and when we can not perform something like a delete, we will mark the backup chain for "repair" and try to repair it before we store new data. Basically Veeam thinks that something is wrong with the storage and will not write new data to it.
Immutability on storage level is as well not aware of file dependencies and could lead into situation where customer could end up in some files protected but some not but all depend on each other and therefore no restore posible.
These three are only examples that are simple to understand, there is much more under the hod.

Today there are 2 options. Use Immutability that is transparent of Veeam (Immutable Snapshots for example) or we have to integrate and ask the vendors for object/file level immutability options that Veeam can control and enhance the protection time as needed. The second one is here needed with StoreOnce. Based on this project there are several additional enhancements to the StoreOnce Immutability engine that addresses additional attack vectors. So you will get a market leading implementation deeply integrated into StoreOnce.

[mike_stewart]

Good morning,
As far as I know, it's possible to get Immutability per Store in StoreOnce. If we have multiple Veeam Jobs in one Store we could only get one Global Immutability configuration.
The integration we are talking about is getting the Immutability Per Job in Veeam to send the data to HPE StoreOnce with the correct "flags" for immutability.
I know that are other tehcnologies like Linux Repository or S3 with Object Lock, but for that it would have to change the current architecture and it involves additional costs, since we currently have two HPE StoreOnces.

I hope that in version 12 you take into account this integration that will definitely please many customers, especially these days.

Regards,
SSA

[Andreas Neufert]

As you said the Immutability is today at Catalys Store level.
What HPE and we are implementing today is that Veeam can control the immutability per file. So we can extent the protection time as needed (when a backup chain is at risk or customer define higher immutability) while our temporary data is not protected and we can delete things as needed.

[opedro]

Hi, +1 we also need to have a immutability on catalyst Storeonce, hope that HPE and Veeam implement this feature on the next version V12 or Storoence V4.
we need it ASAP, without it Veeam and HPE will lose costumers, to other players.