Does veeam snapshot the VMs' memory?

[cekame9953]

Hello,

I recently configured a Veeam on my network.
If I understand correctly, Veeam backs up the entire VM in the initial backup. Aftre the initial backup - it takes snapshots of the VM and stores those.
I have two questions:
1. How far back does it save backups? Files that I had on the machine a month ago and were deleted can be recovered?
2. Does veeam snapshot the VMs' memory? How can I know? Does it depend on the quiescence option?

Thank you!

[Gostev]

Hello!

1. It depends on the retention policy you specify in the job settings. If your retention policy is over 1 month, then the answer is yes.

2. No, it does not snapshot memory. No, it does not depend on the quiescence option.

Thanks!

[cekame9953]

Thank you!

[Andreas Neufert]

Please allow me to add some additional thoughts.

A current state backup of a VM with memory dump is not a good idea in many ways. First the VM has a downtime because of it. Secondly the applications are in the mid of their processing and when you recover from that stage there could be problematic side effects.
The idea is... With our guest processing (like VSS) we let the application know that we want to do a backup and they go into a disk consistency mode. Then we preserve this stage in a snapshot and release the application for normal processing. The snapshot is then used to run incremental forever backups based on change block tracking technologies, so that the backups are very efficient.

With this guest processing the applications know that a backup happened and a restore will allow them to detect that this happened and for example start in application specific recovery logic modes. This is done automatically when you use our guest processing.

[cekame9953]

Got it. Thanks! It's very helpful.

[soncscy]

I recently configured a Veeam on my network.
If I understand correctly, Veeam backs up the entire VM in the initial backup. Aftre the initial backup - it takes snapshots of the VM and stores those.
I have two questions:
1. How far back does it save backups? Files that I had on the machine a month ago and were deleted can be recovered?
2. Does veeam snapshot the VMs' memory? How can I know? Does it depend on the quiescence option?

Maybe I'm the odd-ball out here, but since the green-posters didn't address it, I do want to comment on your understandings here.

Snapshot-based backups don't store the snapshot, they store incremental backups. These increments are dependent on the initial full backup, yes, but the subsequent increments are read from the actual VM disks and use CBT to transfer only changed data. The snapshot is what lets the VM keep running. So you don't have snapshot stored in the backups, you have every changed block since the last backup.

Looks like your first question was answered, but for your second question, I think you're thinking in terms of snapshots, and that's what backups are really for. Backups are meant to be atomic in that they're not tied to the VM state at the time of backup. If you backup a machine without application aware processing, you get a crash consistent backup point. If you use application aware processing, you get a transactionally consistent point where the applications flush their operations to disk before backup.

The whole point of backups is to get those static backup states, and it uses VMware APIs to tap CBT for fast backups.

[gollem]

I actually think snapshots with memory dumps (live state) could be beneficial and would love to take backups, lets says ones a week, in its running state. I have 2 reasons for this:

1. We had it a few times when a server got rebooted but could not be booted back and ended up in a blue screen (Had that on Win2008 machines https://www.bleepingcomputer.com/news/m ... 02-update/) going back in history before the update resulted also in boot failures as that patch was applied a longer time ago. If I was able to go back to the latest snapshot with live state I could have fixed the issue easier and faster.

2. We luckily never had a ransomware breakout, but from what I've been reading ransomware could be triggered at a certain time or when the system next boots. Ransomware could be lurking in the background for several months, again with live state there might be an alternative way out of the mayhem.

I believe that there is a use case for live state backups and it would be good if a user can decide if he/she wants to use that or not, same goes for a backup with all the vmware snapshots and not the latest state (usefull for VDI Gold images) although I also wonder if the API from VMWare has features to allow this

Yes, some things can be tested with SureBackup, is there anybody out there who actually uses this feature on a large scale for all of the vm's (for example if you have a couple hunderd vm's running)

[Andreas Neufert]

Hi thanks for the feedback.

As you said SureBackup and Secure Restore are actually invented to address this issue. SureBackup was actually invented 10 years ago and is the single reason I am with Veeam because I had ran into your described issue with my customers back in time. Secure Restore allow you to check with the latest antivirus state (you can use multiple software in parallel) for any issues.

There is no definition on the VMware side to leverage the Memory dump for backup as the system would have a downtime and the application would be in a state that would be undefined (from restore perspective). As well when I think about systems that depend on each others the downtime would be problematic and need to be handeled potentially manually in many cases. As well if you for example restore a system from the momory dump that is part of a multi server application (like Sharepoint) you would be in deep trouble.

The memory dump is helpful for debugging and forensic, not for backup.

[jmmarton]

To add to Andreas, since including the memory is more for debugging or forensic analysis, simply create manual snapshots with VM memory included when that's needed. I suggested this recently during a panel discussion on "what to do during the first 10 minutes of a ransomware attack."

Joe