Security Advisor

Backup (Almost) Made Easy

Coming up with a good data recovery plan is no easy feat. That's where Microsoft's System Center Data Protection Manager comes in.

• By Joern Wettern
• 12/01/2008

Over the last few months, I've been working hard to simplify my network infrastructure by implementing Hyper-V to consolidate server functions on fewer physical machines. As I was doing this, it became increasingly obvious that I had no adequate protection against the two most dreaded sounds imaginable: the "oops" that's muttered seconds after accidentally deleting a crucial file; and the screeching, grinding noise of a hard drive dying a sudden death.

Sure, I have some protection in place. For example, Exchange lets users bring back deleted messages during a retention period you configure, and RAID arrays on my servers provide temporary protection against the loss of a single disk. But I had to admit to myself that my existing long-term protection was no longer adequate. A backup of my physical servers also protects the data on virtual machines (VMs) that are stopped, but backing up the files of an active VM could leave the VM in an inconsistent state. I could create scripts to shut down the VMs before the backup, but that would make them inaccessible during the backup.

Another problem I had was centralizing the process so I didn't have to back up each server separately. When I looked at DPM and the functionality added by Feature Pack 1, I figured it might be the solution I was looking for. DPM uses the Volume Shadow Service (VSS) of Windows to ensure that the data in the backup is consistent, and it can pass VSS requests to back up data in a consistent state to SQL Server, SharePoint and Exchange. The registry change described here adds VSS support for Hyper-V. Once I had made this change, I was ready to roll.

The Basics
DPM is designed as a central point in your network to back up data. DPM agents on each computer send data at regular intervals to the DPM server, which stores short-term copies of the data on disk or makes long-term copies on tape. You can schedule short-term snapshots of selected resources to be taken as frequently as every 15 minutes, letting you easily recover accidentally deleted data. DPM is smart enough to only back up changes from previous snapshots, reducing network traffic and disk usage to a minimum. Depending on the retention period you set, it's very easy to recover the version of a file someone deleted five minutes ago or the day before yesterday. DPM is primarily designed to secure data on servers, but you can also protect workstations.

This short-term protection has obvious benefits, but I was more interested in securing data for the long term by creating off-site copies of all server data. Here's where I hit the biggest snag. I wanted to store my backups on removable hard drives that I could rotate between my office and an offsite location. But DPM only lets you put these backups on tapes. Using my old tape drives was out of the question because of limited capacity, and the cost of a new, expensive tape library was not in the budget. Fortunately, there are a couple of software solutions that turn disks into virtual tape drives. The most affordable solution I found was Firestreamer-RM from Cristalink. Once installed, it made my external hard drive look like a tape library to DPM. First problem solved.

Implementing the Strategy
Once everything was in place, I was ready to implement my backup strategy. I decided to postpone short-term recovery goals and settled on weekly backups for my servers. I quickly realized that some data needed to be backed up more frequently. As a result, I created two protection groups: One protection group for servers holding data that doesn't change frequently; and the other that holds redundant data such as domain controllers. These servers are backed up weekly. Other servers, including my Exchange servers, are in a protection group that gets backed up nightly.

While setting this up, I ran into the next snag, namely that a full backup of an Exchange information store triggers a consistency check and deletes old log files. Instead of relying on Exchange to do this, DPM takes over the task itself, which requires that you copy the Exchange Eseutil tool to the DPM server. This part was easy enough, but then I realized that even though the DPM agent can pass VSS requests to freeze the data from the server to be backed up to both Hyper-V and Exchange, it currently can't combine these steps.

A VSS backup of the physical drive triggers the required VSS operations in the VM, but the guest OS doesn't inform Exchange that the information store needs to be backed up. Microsoft has a fix for this in the works, but for the time being I had to install the DPM agent in the VM with the Exchange server holding my information store, and then remove the directory containing the VM from the protection group for the physical servers, which also backed up the other VMs on that server.

Next Steps
Since implementing my long-term data-protection strategy using DPM, I sleep better at night. Data is stored on a series of inexpensive external drives, and DPM even tells me when it's safe to take each tape offsite. (Remember, DPM thinks that my disks are tapes, and I'm happy to let it operate under that illusion.)

However, there are some steps remaining. DPM lets you create multiple backup schedules, and I intend to create daily backups that will be stored on network-attached storage (NAS) while still moving the weekly backups off-site. I'm also looking into which data needs to be backed up on a local disk each hour, or even more frequently, so I can quickly recover data that has been accidentally deleted.

But the biggest task remaining is to make sure that everything works as planned if something goes wrong. I have confirmed that the data I backed up can be restored to a different location and that restored VMs start up correctly from there. However, I want to be able to restore a failed server as quickly as possible. With DPM's bare-metal recovery, I can restore the entire server without first installing and configuring the OS, simply by booting from a previously created CD that restores everything in a single procedure and in the shortest time possible. Once that's in place, I'll be in disaster-recovery heaven. If you want to join me there, and if your current backup solution holds you back, you should take a look at DPM, too.