Retention policy and backup storage space

[Daniel S]

My question is around best practice for retention policies. We want to be able to restore files with:

• Daily granularity for the last 14 days
  Weekly granularity for the last 4 weeks
  Monthly granularity for the last 12 months
  Yearly granularity for the last 10 years

So far I have simply set up my reverse continuous incremental job to keep thousands of dailies, but obviously this is not ideal. Restoring a file from 2 years ago would require restore to go through 730 dailies and would use a lot more storage space than would be necessary if incrementals were rolled up into weekly/monthly/yearly. I know reverse continual incremental is no longer suggested, but if I do forward incremental, it means restore would need to go through 10x365 daily backups to restore yesterday's file if oldest item in chain is 10 years old? I don't need the granularity of choosing to restore a file from 700 vs 701 days ago. If my restore points are 365 days or 730 days ago, that's fine.

I was happy to see GFS retention available in Veeam 11 for backup jobs (previously only available for backup copy jobs), however, I read it only applies to FULL backups, which means, my retention requirements would require us to have something like 20x the size of our backed up data as backup storage (for each full backup), minus of course compression. I was hoping there would be GFS ability within the same backup chain to alleviate the need for multiple full backups, but appears not?

I have about 100TB to back up. Would I really need to provision 2 PB of backup storage in order to have 10 years retention? Or do I just continue with dailies? Change rate is low, so 365 x 10 incrementals would use considerably less space than (10+12) x full copies. Multiple full backups seem inefficient, but so does having 10x 365 dailies. Or maybe 365 dailies, and annual fulls, but this still requires 10x copies of my data, which seems wasteful when my change rate is low.

I was hoping old incrementals could be rolled up into weeklies, monthlies, yearlies, etc. without requiring a new full backup chain.

Any thoughts, recommendations, best practice advice?

[Mildur]

Hi Daniel

If you plan to buy new backup Storage for this project, go with windows and refs filesystem or with Linux hardened repo with xfs Filesystem.

This way, you can leverage the FastClone technology. A synthetic full will not need the entire space of a fullbackup. Only the changed blockd will be stored on disk. You won‘t have the issue to buy a 2PB Storage.
Use the calculator to get an estimation how much storage you need with refs/xfs:
https://rps.dewin.me/

Veeam FastClone Guide

I was happy to see GFS retention available in Veeam 11 for backup jobs (previously only available for backup copy jobs)

This was a feature in V10 already

[Mildur]

One thing else, you should think about a second backup copy. A single copy is not enough. There can be accidentally deleted backups, ransomware attacks, hardware fault or even software bugs (very very rare, but always possible) which could lead to data loss.
You need to protect your backups from such events.

[Daniel S]

Great, thanks for advice. We will use FastClone. This will require newly formatted storage though since current is not ReFS nor XFS.

Yes, we do have secondary backup copies offsite.

What we do lack, however, is air-gapped offline copies and not sure how to do this with 100TB of data: was considering 2x identical backup repository servers and manually moving a single network cable between the two so that one always stays offline, perhaps. Alternatively, I think we may just implement immutable hardened Linux repositories: not air-gapped, but at least it sounds like it should offer sufficient protection against malicious backup deletion attempts. It looks like the hardened repository is compatible with Veeam FastClone you mentioned above.

[Mildur]

Hi Daniel

Your welcome.
Yes. linux hardened Repo is a good solution. Veeam has achieved compliance regulations with this feature. A really good thing and many companies are using it already from what I read. And it‘s fully compatible to FastClone.
Veeam Backup & Replication Compliance assessment report

It should be a physical server with local attached disk. Have a look at HPE Apollo devices.
And do not forget to disable SSH and ILO Remote access.
Only physical access should be allowed, or a hacker can use the root user to format the volume with the backups or remove the immutable flags from the backup files.