Is it possible to see/analyse contents of a backup file?

[pkelly_sts]

It's a bit of a long-shot but thought I'd ask.

I have a VM that, like clockwork, has a backup size of around 45Gb on a Monday and 25Gb on a tuesday, all other days are 2-5Gb. Not monstrous in the overall scheme of things but I'd /really/ love to know what's generating these changes as it implies that someone, somewhere, is updating a lot of info between these backups and searching for files on the fileserver with timestamps around these times doesn't reveal any candidates. There doesn't seem to be a defrag job either which I'd assume could also cause similar changes?

If I were backing up traditionally with BExec, I could start the process of a restore, navigate to the media for the day in question, then in the right-pane I could sort the "incremental" folders of that day into size order and thus find the largest amount of changed data.

So, I'm not asking for an equivalent facility, but is there any way at all of determining what is generating the most incremental backup data for a given restore point?

Paul

[veremin]

Hi, Paul.

The reason of such behaviour is the way two products work. Symantec is a file-level solution that requires an agent to be installed inside VM and that keeps track about changed files, meanwhile, VB&R is an image-based one, that cares only about blocks.

And it’s not possible to determine what specifically has led to that amount of changes, since sometimes changed blocks don’t necessarily mean changed files. For instance, some activities such as defragmentation, as well as, antivirus one that don’t literally change files, does affect seriously the number of changed block; so, please take a look whether there are any that are performed inside this VM.

In addition, I’m wondering whether this is an ordinary VM or VM that runs special applications (Exchange, SQL, etc.).

Thanks.

[Vitaliy S.]

Here is an existing thread with the similar query: Large VIB file on a small static server

[peterisis]

Hi,

i was wondering if it is possible somehow to identify which files in a VM correspond to the changed blocks veeam is backing up.

We back-up about 30 vm's using Veeam B&R for a few of our customers and some vm's have a large amount of changed blocks every day. One of these servers is a 'app server' on which we installed Symantec Enterprise Protection Manager' for example. This server has a backup transfer of 15 GB every day. I'm pretty sure that 90% of these changed blocks is caused by some kind of rotating log file or non-effeicient database service. So if i could find out the files corresponding to the changed blocks that would help me in finetuning our backup service.

I have tried 'Disk Pulse', which shows the files being altered. But that didn't help me.

Kind regards,

Peter

[Vitaliy S.]

Hi Peter,

As Vladimir has mentioned above it is not possible to correlate the blocks that have changed and the files inside the Guest OS, most likely these changes are caused by file scans/access time stamps.

Please search these forums for existing topics discussing reasons of large increments > http://forums.veeam.com/search.php?st=0 ... iles+large

Hope this helps!

[GL@MO]

Hi @all,

last night I experienced a high amount of data being backupped from our fileserver which is not normal (38GB instead of normally ~5GB)

is it possible to view what files have been backupped/changed with Veeam or does anybody have a hint how to do it with Windows (Fileserver) tools?

Many thanks to all

Guido

[foggy]

Guido, please review the thread above for an answer. Also, there are some hints given in the topic referred to by Vitaliy that might give you an idea of why such amount of data was backed up.

[fcmajor]

Hello

We are using veeam for our DC and file server.
Our backup is traditional incremental with a full backup on monday.
We have enabled guest file system indexing.

My question now can I see the only the data that is in one incremental backup?

When I try the restore option and select restore windows guest file and choose an incremental, is the data that I see everything (including the last full) or just the data of that incremental?

[foggy]

Jens, when selecting particular restore point, you see the entire file system of the VM at the state corresponding to the selected moment in time.

[fcmajor]

So for example:

When monday is my full backup and tuesday - sunday are incrementals.
When I choose the restore point friday it shows me everything from monday until friday or just the friday?

[Vitaliy S.]

When you click on the particular restore point, it shows you data that was present on the source VM disks on that day (the latest state).

[fcmajor]

But can we see only the delta between 2 backups?

[veremin]

No, you can't.

[foggy]

Since Veeam B&R is a block-level solution and grabs changed blocks only, there's no ability to correlate those blocks to the files inside the guest OS.

[AdrianHinton]

If VBR can identify changed blocks to perform the backup, can it not also log (in a readable way) what changes it identified and copied? Could you then begin to identify what has changed from there?

[foggy]

Those changes are just the IDs of vmdk blocks to be copied, not sure there's an easy way to match this data to the guest file system objects.

[Kira]

Hello,
We have a replication to our site. Incremental backup for one VM is growing up and we would like to reduce the replication.
Is there a way to check which files were backed up?
Thanks,
Kira

[Shestakov]

Hello Kira,

Since B&R is an image-based backup solution, it works with blocks. And it’s not possible to correlate the blocks that have changed and the files inside the Guest OS, most likely these changes are caused by file scans/access time stamps.

Also take a look at the answers provided above, and ask if additional help is needed.
Thanks.

[omg]

We have recently started using Veeam.
We have a VMware host with around 7 VMs.

All 7 VMs are windows machines.

They are hardly used and shouldn't have more than 200MB of new data every day.

When we use Veeam V8 to backup the entire VMware host ( 7 VMs) for forward incremental backup.
We have noticed that initial full backup file is around 150GB total size.
All the forward incremental backup files are around 15GB files.

Just wondering what that 15GB backup file contains. Even though 7 VMs are not used for one week.
All the forward incremental backup files are still around 15GB each.

Just curious to know:

1) Can we see what exactly is inside that 15GB backup file
2) Is there a report which shows the details as what has been backed up into that 15GB backup file.
3) For me it seems that 15GB forward incremental backup file everyday is a lot, especially when we are
planning to copy daily backup files to offsite location.
4) Any tips or tricks to cut down the size of the backup file, especially when we are planning to copy them offsite.

Thanks in advance

[foggy]

Please look through this thread for the answers to all of your questions. If you need additional explanation, feel free to ask here. Thanks.

[omg]

Not sure why Veeam experts are referring to this link whenever there is a discussion about
finding the details of the big incremental backup file.

They could just say, that's how Veeam works and there incremental backup files are always big. DO NOT compare
with other regular backup software.

Referring to this link is of no use, UN-necessarily users are going to other discussions like its because of antivirus,database,AD,DNS....file server changes.

Its the way Veeam works.

[foggy]

They could just say, that's how Veeam works and there incremental backup files are always big.

That's simply not true. Size of incremental files entirely depends on the amount of changes occurred inside guest OS since previous backup job run and the referred thread allows to get an idea on what can affect that. It could be a single block that has changed and backed up by Veeam B&R while file-level solution will backup the entire 1GB file this block belongs to.

[omg]

It could be a single block that has changed and backed up by Veeam B&R while file-level solution will backup the entire 1GB file this block belongs to.

Is there a way to find out which 1GB file block the change belongs to ?

[Vitaliy S.]

Is there a way to find out which 1GB file block the change belongs to ?

You can use one of these creative ways of detecting what files and folders have changed since the last backup restore > Large amount of data change every 28 days

[lowlander]

Hi,

is there a way to determine which files and folders has been changed during an Incremental backup interval ? This feature would be great to determine large incrementals suddenly occuring in a job type.

[Shestakov]

Hi,
since CBT keeps track of blocks rather than files/folders, it`s not possible to determine exact files that were changed.
Thanks!

[Gostev]

In some cases you can guess that by reviewing the VIB file content (just create a test job with disabled compression).

[Daniel N.]

We do daily incremental backups and we keep them for 45 days. The VBK has 400GB in size, the VRB medium size is 5GB. On saturday the generated VRB had 92GB despite anyone having worked, as far as I know. That caused backup compacting to fail which left a 330GB temporary file that filled up the remaining disk space.

Is there any way to review a history of backup sizes per job and per VM?

Is there any way to identify what files exactly caused the backup size to spike?

Ps: We backup our Hyper-V cluster with 8 VMs using one job.

[PTide]

Hi,

Is there any way to review a history of backup sizes per job and per VM?

It seems that this Veeam ONE report is exactly what you are looking for.

Is there any way to identify what files exactly caused the backup size to spike?

This one might be tricky.Veeam does not offer such report now. First I would check if deduplication or defrag is involved. You can also use some third-party software to compare files and folders sizes from the latest backup with those from the previous one. Just start FLR wizard to mount drives from the backup and run https://windirstat.net/ against it - it will show you the file tree with all sizes so you can compare it.

[foggy]

You can also find some other tips to verify the reasons of backup file size increase in the thread above.