VIBs for simple PCs are much larger than for Windows Server

[flomp]

I am supporting a small setup consisting of 5 Windows 11 Pro PCs and a Server running 2 Windows 2022 VMs.

The VMs and the PCs are used daily by about 3-5 people doing "normal office work" on the PCs and running a special database application on the two VMs.

I noticed that the VIBs for the two VMs are normally between 0.5 to 2 GiBs each day. Sometimes it is more but not often. (Maybe Windows Updates)

The VIBs for all the PCs are much larger. About 5-10 GiB each day. This is quite a lot compared to the servers.

I also previously noticed in other setups, that VIBs for Windows PCs are quite large. Did anyone look into this already? I can't believe that a normal user modifies that much data on his machine by just using Word, Excel and browsing the internet...

[david.domask]

Hi flomp,

Almost certainly it's not actual user changes, but OS changes. Servers are fairly "inactive" but still will generate a larger amount of changed data at the OS level.

Few questions:

1. Are all the machines virtual machines or the PCs are physical workstations?
2. All machines are being backed up as VM backup jobs or some are backed up with Veeam Agent for Windows?

Keep in mind, with image/volume level backups, you're not dealing exclusively with total changed/new files, you're dealing with changed blocks. Even if a single bit in the block gets changed, the entire block needs to be returned by any change block tracking solution. This means OS changes to .ini's, temp folders/caches, and so on all contribute to the total changed blocks. With users actively working on the machines, I can easily see 5-10 GiB of changes just from normal user use on non-user data (read: OS and application data), as well as normal user data they might generate (intentionally or as part of other normal use). With the servers, the same changes are likely still there but without the user aspect influencing as heavily.

[flomp]

Hi David,

1. The PCs are physical workstations
2. The VMs are backed up as a VM backup job and the PCs are backed up using the Agent

Yes I know, every little change will immediately trigger the backup of 1 block (1 MiB). It was just interesting to see that a Server on which 3-5 people are working on daily (via Remote Desktop) produces significantly smaller VIBs than a normal PC and I was wondering what might be the reason. I rarely see VIBs of less than 4 GiB for Windows workstations - also in other installations.

[david.domask]

I think the main difference is how long they're working on it and what they're doing. I imagine the Workstations are doing a lot "more" that just triggers overall a lot of tiny changes due to normal activity, things like browsers, office suites, email clients, chat apps, etc, simple and fast tasks from the users, but far more going on, all of which needs a lot of local temporary resources, as opposed to a server with presumably a dedicated role where normal user activities like mentioned above simply aren't being done.

[Gostev]

I suppose you could try to understand this with Sysinternals tools - which apps are actively writing and making changes to the disk. From Veeam perspective there's no difference between workstations and servers, the same image-level backup logic is used to backup both: if anything in a 1MB disk block changes, the block will be picked up by the incremental backup.

[flomp]

Thanks @Gostev, that's a good idea. I will keep an eye on a few PCs and if I find one that creates large backups despite being used rarely, I will log activities using Procmon and try to find out which processes do a lot of disk I/O.

This is more something that made me curious - not an actual problem