To CBT or not-CBT, that is the question

[F182]

We are somewhat new to Veeam. We manage many servers, at many sites, at different clients, with different systems. These ESXi/vCenter hosts range from ESXi 5.5 all the way through 6.5. A quick search of these forums and a search on Google for vmware CBT bug, and we found case after case of bugs that cause data corruption in backups when using CBT. Even more recently there is a CBT bug that even surebackup doesn't seem to catch! So we have disabled it for now to be safe.

As a result, the backups are now much slower than the backup product we used to use (shadow protect). Incrementals that used to take 2-5 minutes in ShadowProtect are now taking 45minutes in Veeam. We still love the power and feature-full ability of Veeam, but we find ourselves yearning for the fast backups that come with using CBT.

What is your stance on enabling CBT? If you are enabling it, what steps have you taken to ENSURE that the CBT bug is not present in your system and that the data backed up is safe.

Thanks in advance

[Gostev]

Well, ShadowProtect uses their own CBT, so you're not comparing apples to oranges when comparing one against Veeam with CBT disabled. Also, one may wonder why do you trust CBT logic from much smaller SMB vendor (ShadowProtect), but yet don't trust one from enterprise vendor (VMware). Seems counter intuitive! Anyhow, any software has bugs and brings new ones with updates - so no particular product is magically protected against having CBT bugs.

But answering your question - simply put, no one runs Veeam with CBT disabled. What makes it particularly safe is the immense Veeam customer base (rougly half of all VMware customers use Veeam), so any newly introduced CBT bug usually shows up in our support very quickly. Thus, the only thing you want to do to make sure you're extra safe is don't jump new vSphere releases the day they appear. Which is the best practice in any seasoned IT shop anyway.

Another important comment: SureBackup is able to catch ANY data corruption at all - it's just the matter of the complexity of your application's test script.

[F182]

Thanks Goastev. This sounds logical.

Is there a list of known "safe to use CBT" versions of ESXi (version/build numbers)? This would be very helpful. Since, following your advice, I could update our client environments to ESXi 6.5 (latest build), but is the latest build safe? Updating also creates difficult downtime, and I would prefer to not upgrade client host infrastructure that don't need updating (if their version/build isn't affected by a CBT bug).

It would be very nice to have a table with known version/builds that are safe, and version/builds that are not safe for CBT.

[Gostev]

Both 6.5 U1, as well as the latest updates of all previous vSphere versions still supported by VMware are solid with VMFS. A few vSphere releases had some CBT bugs in the initial builds (again proving my point of extra risk of using those), but they were all quickly detected and hotfixed in the subsequent updates.

[F182]

Thank you Gostev. Is that 6.5 U1 build 5969303? Or is it 6.5 U1 build 6765664 (which has express patch 4). See vmware build list: https://kb.vmware.com/s/article/2143832

[Gostev]

Neither has known CBT bugs with VMFS, but I guess from a common sense perspective you always want to be using the latest available build (which is currently ESXi 6.5 U1g 7967591) due to it including the latest security patches.