Veeam fails to delete Storage snapshots when "Volume Protection" is enabled on IBM storage

[dkvello]

I just found out that I had a bunch of Flash Copy's of a production volume on a customers new FS5100 (recently migrated).
I could see in the backup-logs that Veeam failed to remove the storage snapshots at the cleanup part of the job.

I logged in to the FS5100 and tried to delete the volumes manually, but got a "NO!" because Volume Protection was enabled.
This requires a 15 minute (default) "No I/O" pause on the specific volume before allowing any deletions.
So, I've disabled the Volume Protection feature for now.

Is there any way for Veeam to have a Chat with IBM about a workaround/feature in the storage integration to allow for Volume Protection to be generally enabled, but allow for Snapshot removals ?

[vmtech123]

I disabled this feature as well for the same reason.
Veeam SHOULDN"T be able to remove snapshot that is active within the specified time frame, or the Volume Protection wouldn't be working.
It's the same as buying immutable storage, but then asking for the option to delete it whenever you want.

[soncscy]

Have to agree with Scott -- why should there be a by-pass to a protection feature?

Just from my perspective, I want to know for certain that if there is some sort of protection feature, nothing can violate it, even if I want to. If it creates an inconvenience for me, then I take that as a cue I need to revisit whether I want the protection here or not.

If anything, it sounds like IBM would need to build out some logic to accommodate for backups, not the other way around. I cannot feasibly imagine how a backup application could handle this situation in a stable way.

[dkvello]

Well, I agree that there shoudn't be a bypass to deleting the active production volume, but it should be possible to create non-protected snapshots for f.eks. backup purposes like in Veeam.
The consequences are:
a) You end up with a big mess with snapshots on the storage system because they can't be deleted after use or
b) You end up deactivating the whole volume protection feature.

I don't want to do either one.
I have not checked with IBM yet, if there is an option to creating non-protected snapshots. But if not, I will ask for this to be a feature.

[vmtech123]

That is true.

It would be nice to have the feature, not for ransomware, but to not be able to protect the volume from accidental deletion.

Before using storage snaps for backups, I'd have the protection set to a few hours, storage vMotion my vm's off of that datastore, remove the datastore and wait. When I unmounted the volume and removed it on the SAN several hours later I would KNOW 100% I didn't have an active volume. That was one reason I suppose it would be nice to bypass it.

In all honesty though, backing up with storage snaps > volume protection in my case so I just disabled it. Nothing like coming in and having to manually remove 100's of snaps after a weekend.