Backup and Recovery Best Practices with Symantec NetBackup on Tintri VMstores

TECHNICAL WHITE PAPER Backup and Recovery Best Practices with Symantec NetBackup on Tintri VMstores www.tintri.com

Table of Contents Intended Audience...3 Introduction...3 Consolidated List of Best Practices...6 Configuration...8 Adding NetBackup Storage Units...8 Adding vcenter Server Credentials In NetBackup...9 Creating NetBackup Backup Policies For VMware... 10 Backups... 13 VMware Backup Policies... 13 Guest Based Backup Policies... 16 Restores... 18 Tintri SnapVM, CloneVM, and ReplicateVM... 23 Protecting your application servers and file servers... 23 Protecting your virtualized NBU Master Server and NBU Media Server... 24 Conclusion... 27 References... 28 www.tintri.com 2

Intended Audience This document will discuss the best practices of protecting your virtual machines in VMware vsphere environments using Symantec NetBackup. This Tintri Best Practices Guide for backup and recovery will assist individuals who are responsible for the design and deployment of data protection and disaster recovery solutions for VMs deployed on Tintri VMstore appliances. This document will discuss the use of VADP (vstorage APIs for Data Protection) for backups and Tintri s CloneVM and ReplicateVM technologies for data protection and disaster recovery (DR) of virtual machines in a VMware environment. Introduction Tintri VMstores are purpose-built for virtual machines. IT administrators, virtualization administrators, and NetBackup (NBU) administrators with knowledge of virtualization can easily deploy and manage Tintri storage. When deploying Tintri storage as an ESX/ESXi datastore, storage LUN provisioning, HBA compatibility checks, SAN switch LUN zoning, and SAN switch management is a thing of the past. This is because deploying a Tintri VMstore is as easy as assigning IP addresses to the Tintri VMstore and NFS mounting the Tintri storage appliance. From a virtualization administrator point of view, a Tintri storage appliance is presented as a datastore that is mounted to an ESX/ESXi server via NFS mount. For example, HQTM-T880 is added to an ESXi server by mounting T880_FQDN:/tintri/vmware subfolder (see Figure 1: Adding Tintri VMstore to an ESX/ESXi server). Figure 1: Adding Tintri VMstore to an ESX/ESXI server After a Tintri VMstore is added to the ESX/ESXi server, the vsphere hypervisor manager is added to Tintri VMstore (see Figure 2: Adding VMware vsphere to Tintri VMstore). This completes the process of adding and configuring an ESX/ESXi datastore using a Tintri VMstore. It is just that simple. Figure 2: Adding VMware vsphere to Tintri VMstore Tintri VMstore delivers extreme performance, VM density, and a wide variety of powerful data management features, which are seamlessly integrated with vsphere. These examples of data www.tintri.com 3

management functionality include snapshots, clones, instant bottleneck visualization, and automatic virtual disk alignment. Tintri VMstore extends and simplifies the management of virtual machines (VMs) through intrinsic VM-awareness that reaches from the top of the computing stack, all the way down into the storage system. This best practice guide highlights the following when using Symantec NetBackup to protect VMs on a Tintri VMstore. Architecture overview of a VMware environment with Tintri VMstore and Symantec NetBackup components. Symantec NetBackup configuration settings when protecting VMs on a Tintri VMstore. The ease of protecting VMs and application-specific VMs such as Microsoft Exchange 2013 DAG on a Tintri VMstore. Using NetBackup Accelerator for VMware. Using Tintri s SnapVM, CloneVM, and ReplicateVM to protect a virtual NBU master and NBU media server. Figure 3: Architecture overview of a VMware environment with Tintri VMstore and Symantec NetBackup In figure 3, a NBU VMware backup host is the VMware proxy server. It is deployed as a virtual machine in this environment. Review the NetBackup for VMware Administrator s guide for additional information on resource requirements for deploying a VMware backup host, a NBU master server, and NBU media server(s) in a virtual environment. There are advantages and caveats in deploying NBU components as virtual machines. For example, a virtual NBU master server and a virtual media server allow important NetBackup components to be protected using Tintri VMstore features for high availability. However, as a virtual environment grows, possible shared resource contention can affect NBU performance. In such cases, it is recommended to deploy NBU components (s) that are physical servers to ensure that there is no resource contention for a protected NBU setup. In this configuration, a physical NBU media server is also deployed so that tape-out requirements can be fulfilled and additional backup copies can be made for data protection. www.tintri.com 4

DO: Deploy NBU components such as the NBU master server as a physical server in a large enterprise environment to ensure that data on virtual machines and physical servers can be properly protected with the same NetBackup infrastructure. A NetBackup media server can still be deployed as a virtual machine to take advantage of Tintri SnapVM and CloneVM features. DO: Deploy more than one VMware backup host in a large environment to take advantage of VADP transport modes. NetBackup supports Windows and Linux VMware backup host. However, NetBackup virtual machine instant recovery requires the restore host to be a supported Windows machine. Review the NetBackup for VMware Administrator s guide for additional details on restore host requirements. In this configuration, NetBackup Media Server Deduplication Pool (MSDP) storage units have been created to take advantage of NBU deduplication storage feature. It is also recommended to use other intelligent deduplication storage solution such as Symantec NetBackup Appliance 5200 series to take advantage of NBU s solution for VMware and guest-level backups. DO: Use NetBackup Storage Lifecycle Policy (SLP) with MSDP or Symantec NBU Appliance 5200 series to take advantage of NetBackup s suite of solution for protecting your virtual machine infrastructure. www.tintri.com 5

Consolidated List of Best Practices The table below includes the recommended practices in this document. Click the text in the Recommendation column or see the section later in the document that corresponds to each recommendation for additional information. DO: Deploy NBU components such as the NBU master server as a physical server in a large enterprise environment to ensure that data on virtual machines and physical servers can be properly protected with the same NetBackup infrastructure. A NetBackup media server can still be deployed as a virtual machine to take advantage of Tintri SnapVM and CloneVM features. DO: Deploy more than one VMware backup host in a large environment to take advantage of VADP transport modes. NetBackup supports Windows and Linux VMware backup host. However, NetBackup virtual machine instant recovery requires the restore host to be a supported Windows machine. Review the NetBackup for VMware Administrator s guide for additional details on restore host requirements. DO: Use NetBackup Storage Lifecycle Policy (SLP) with MSDP or Symantec NBU Appliance 5200 series to take advantage of NetBackup s suite of solution for protecting your virtual machine infrastructure. DO: Use MSDP, Symantec NetBackup Appliance 5200 series or OST storage servers for your NetBackup storage units. DO: Use NetBackup Storage Lifecycle Policy (SLP) to take advantage of backup image management and automated backup copy management. DO: Use alternate storage path for the deduplication database for MSDP storage units. DO: Use a specific network interface on the NBU media server, NBU clients, and NBU VMware backup host to separate application server I/O from backup I/O. DO: Use NBU Accelerator for VMs that do not experience a high rate of change. DO NOT: Move VM between NBU media servers for backups, if a VM to be backed up is moved between media servers, be aware that the NBU Accelerator can also be reset for the VM(s). DO NOT: Change the VM identifier of VMs in the VMware backup policy that is using NBU Accelerator, this could also reset the NBU Accelerator. DO NOT: Enable Expire after copy retention for any VMware backups using SLP with NBU Accelerator. The Expire after copy can cause images to expire during backups and result in the failure of full backup image synthetics. DO: Separate the virtualized NBU media server and the virtualized VMware backup host functionality in order to take advantage of Tintri s SnapVM, CloneVM, and ReplicateVM features to protect your virtualized NBU master server and NBU media server. DO: Ensure that the VMware backup host has access to the ESX/ESXi server and the Tintri VMstore so that VADP transport modes with HotAdd, NBD, and NBDSSL can be used for VMware VADP backups. DO: Use 10GigE network for backup I/O. Separate application I/O from backup I/O using VLANs. DO: Use NBD transport mode for VMware backups. Some virtual application servers or virtual file servers may experience long pauses during the snapshot removal phase of a backup using HotAdd transport mode. The symptoms of the pause of a virtual machine includes end user disconnects from the VM or ping request time out. This could also mean non-responsive applications during the backup process of the VM. It is Tintri s recommendation to use NBD transport mode for backups of these virtualized application servers or file servers if using VADP. The combination of NBU Accelerator for VMware and NBD transport mode should reduce VMware VADP backup time of the VMs. www.tintri.com 6

DO: Test the NetBackup VIP query and validate that all VMs that meets the query criteria is successfully discovered and included in the NBU VMware backup policy before attempting a backup. DO: Use Symantec s NetBackup VSS provider for application file-level consistent backups for VMware backups with application protection. DO: Fix all NetBackup Application State Capture errors before allowing an application protection enabled VMware backup job to continue. This will ensure that the application is successfully quiesced before a VM snapshot is attempted with VMware VADP backups. DO: Take advantage of NetBackup s multi-stream processing in any NetBackup supported backup policies. If a single backup policy consists of a single client with a single backup selection, that backup policy will not be able to take advantage of multi-streaming within the NetBackup job. There are clear benefits when it comes time to protect the application servers or file servers with data protection applications such as Symantec NetBackup. DO: Use NBD transport mode for restores of thin provisioned VMs if the alternate restore location is an ESX/ESXi SAN attached datastore. For thin provisioned VM restores to Tintri VMstores, use HotAdd, NBD, or NBDSSL for the transport modes. DO: Run Symantec NetBackup Pre-Recovery Check before finalizing the Symantec NetBackup VMware restore operation. DO: Create separate VMs for your VMware Backup Host virtual machines and your NBU media server virtual machine. DO: Create a NBU catalog backup policy to protect your NBU catalog, NBU backup policies, and NBU configuration. DO: Create multiple NBU backup copies of backup images rather than relying on a single primary backup copy. Create copies to other physical NBU media servers to ensure that more than one copy of any backup images is available using NBU SLP to protect your data with NBU deduplication storage such as MSDP and Symantec NBU appliances. DO: Use a virtualized NBU media server for efficient backups of your virtualized infrastructure. However, also take advantage of NBU s SLP and NBU AIR so that you can have DR copies of your backup in a different NBU domain. Use a virtualized NBU media server for shorter retention period but use either a physical NBU media server or a NBU Backup Appliance to create backup copies for longer retention periods. For example, any backup images that are to be retained for a period longer than 6 months, create backup copies to physical NBU media servers or NBU backup appliance or create copies to physical tape. www.tintri.com 7

Configuration Adding NetBackup Storage Units NetBackup for VMware supports backup to any storage unit types that can be configured on a NetBackup media server. However, it is recommended to use MSDP or any other NBU supported deduplication storage to take advantage of NBU optimized synthetic, NBU accelerator for VMware backup, and Auto Image Replication (AIR). The support of optimized synthetics, NBU accelerator for VMware backup, and NBU AIR are features of Symantec NBU. There are no additional licenses required from Tintri to support these features to protect your virtual infrastructure with NetBackup. Ensure that you have the NetBackup Data Protection Optimization Option license for support with MSDP storage units or any other NBU supported deduplication storage such as OST. In figure 4, an MSDP storage server is configured with a storage path and an alternate path for the deduplication database. It is Symantec best practice to use an alternate path for the deduplication database. In addition, a specific network interface is also specified so that the VMware image level backups using VADP can take advantage of a particular VLAN for the backup I/O. DO: Use MSDP, Symantec NetBackup Appliance 5200 series or OST storage servers for your NetBackup storage units. DO: Use NetBackup Storage Lifecycle Policy (SLP) to take advantage of backup image management and automated backup copy management. DO: Use alternate storage path for the deduplication database for MSDP storage units. DO: Use a specific network interface on the NBU media server, NBU clients, and NBU VMware backup host to separate application server I/O from backup I/O. Figure 4: Configuring MSDP Storage Server www.tintri.com 8

With MSDP storage servers, you can also take advantage of NBU s deduplication load balancing. This allows the load balancing of deduplication hash calculations to be shared between supported NBU media servers. Use NetBackup s Storage Lifecycle Policies (SLP) for managing your backup and backup copies. SLP simplifies data protection management by automating the lifecycle management of backups and backup copies. SLP also supports optimized duplication with supported deduplication storage units such as NBU MSDP (see figure 5). Figure 5: Configuring SLP with Backup and cascaded duplication Adding vcenter Server Credentials In NetBackup Figure 6 shows how to configure a vcenter server within NetBackup. Although configuring a vcenter server in NetBackup using IP addresses is supported, it is recommended to use the FQDN of the vcenter server for configuring with NetBackup. Ensure that the forward and reverse lookup for the vcenter server is correct from NetBackup. Figure 6: Configuring vcenter server with NetBackup The following window (figure 7) pops up after the vcenter credentials has been successfully validated and configured within NetBackup. www.tintri.com 9

Figure 7: vcenter credentials have been successfully validated within NetBackup NetBackup VMware backup policies can now be successfully created to protect your VMware virtual machines and application servers. Creating NetBackup Backup Policies For VMware Figure 8 shows a NetBackup VMware backup policy type. The Use Accelerator option is also selected in the example. NBU Accelerator for VMware is supported with NetBackup 7.6 or later and requires disk base storage unit such as Cloud storage, NBU MSDP, PureDisk Deduplication Option, OST, or Symantec NetBackup Appliance 5200 series. NBU Accelerator is supported with full and incremental backups but the full benefit of a VM backup with NBU Accelerator is realized with full backup types. Figure 8: VMware backup policy, Attributes tab NBU Accelerator takes advantage of VMware Change Block Tracking (CBT) to identify changes. Only unique blocks of data are sent to the media server to create a full NBU backup image of the complete VM files. With NBU Accelerator, full backup images are faster than traditional backup. DO: Use NBU Accelerator for VMs that do not experience a high rate of change. www.tintri.com 10

DO NOT: Move VM between NBU media servers for backups, if a VM to be backed up is moved between media servers, be aware that the NBU Accelerator can also be reset for the VM(s). DO NOT: Change the VM identifier of VMs in the VMware backup policy that is using NBU Accelerator, this could also reset the NBU Accelerator. DO NOT: Enable Expire after copy retention for any VMware backups using SLP with NBU Accelerator. The Expire after copy can cause images to expire during backups and result in the failure of full backup image synthetics. Figure 9 shows the VMware tab in the VMware backup policy. In the VMware tab, determine the VMware backup host (VMware backup proxy server) that will be used to backup the virtual machine(s) defined within the VMware backup policy. It is Tintri s recommendation to separate the NBU media server and the VMware backup host functionality so that Tintri s SnapVM, CloneVM, and ReplicateVM can be used to protect your NetBackup virtualized infrastructure (virtualized NBU master server, virtualized NBU media server). Review the Tintri s SnapVM, CloneVM, and ReplicationVM section for additional details on protecting your virtualized NBU infrastructure. DO: Separate the virtualized NBU media server and the virtualized VMware backup host functionality in order to take advantage of Tintri s SnapVM, CloneVM, and ReplicateVM features to protect your virtualized NBU master server and NBU media server. NOTE: Any virtual machine or physical machine that is installed with NetBackup client component can be configured as a VMware backup host. However, a physical NetBackup client cannot take advantage of HotAdd transport mode. It is recommended to use virtual machines as VMware backup host so that HotAdd transport mode can be used with VADP. DO: Ensure that the VMware backup host has access to the ESX/ESXi server and the Tintri VMstore so that VADP transport modes with HotAdd, NBD, and NBDSSL can be used for VMware VADP backups. DO: Use 10GigE network for backup I/O. Separate application I/O from backup I/O using VLANs. Tintri VMstores support HotAdd, NBD, and NBDSSL transport modes for VMware VADP backup and restore operations. However, an application server or a file server that is virtualized in a VMware environment may experience long pauses during a backup operation as described in the following VMware KB article: A snapshot removal can stop a virtual machine. If an application server or a file server is paused for a long time during a backup operation with HotAdd transport mode, change or create a new VMware backup policy for the application server, file server or virtual machine to use NBD transport mode. DO: Use NBD transport mode for VMware backups. Some virtual application servers or virtual file servers may experience long pauses during the snapshot removal phase of a backupwhen using HotAdd transport mode. The symptoms of the pause of a virtual machine includes end user disconnects from the VM or ping request time out. This could also mean non-responsive applications during the backup process of the VM. It is Tintri s recommendation to use NBD transport mode for www.tintri.com 11

backups of these virtualized application servers or file servers if using VADP. The combination of NBU Accelerator for VMware and NBD transport mode should reduce VMware VADP backup time of the VMs. An additional workaround for the long pauses of the VM is to backup the VMs using the particular application policy type. This is also known as guest based backups and the NetBackup agent is required to be installed on the application server or file server. This workaround may not be required for NBD transport mode. Figure 9: VMware backup policy, VMware tab Use the Primary VM identifier parameter to determine how VMs should be identified within a NBU VMware backup policy. This is important as the parameter directly affects the NetBackup VMware query. For example, if the VM hostname is defined as the primary VM identifier and the VM hostname of the virtual machine is not available, the virtual machine(s) will not be backed up. In the Clients tab, VMs that are to be protected with NetBackup can be selected manually or selected automatically using NetBackup s VMware Intelligent Policy (VIP). By building an SQL query using any of the available VMware fields, a NetBackup administrator can build a VIP query that will ensure new virtual machines are protected without having to constantly modify or create new backup policies (see figure 10). A simple process of copying an existing VMware backup policy, updating the VMware backup host to utilize for backups, and updating the policy storage to use for backups will ensure that all new virtual machines, application servers or files servers can be correctly protected and backed up with NetBackup. www.tintri.com 12

Figure 10: VMware backup policy, Clients tab It is Symantec NetBackup s recommendation to test the VIP query before attempting to run any backup jobs. This ensures that the VIP query is validated and the right VMs are protected within the same VMware backup policy. Figure 11 shows a successful NBU VIP query that discovered and selected the virtual machines to be backed up in the defined VMware backup policy that was created in figure 9. Figure 11: NetBackup VMware VIP DO: Test the NetBackup VIP query and validate that all VMs that meets the query criteria is successfully discovered and included in the NBU VMware backup policy before attempting a backup. Backups VMware Backup Policies To utilize application protection option for Microsoft Exchange servers, Microsoft SQL servers, or Microsoft SharePoint server farms, it is a NetBackup requirement that the VMware backup policy utilizes VIP to discover and select the virtual machines for backup. Symantec NetBackup does not support manual selection of application server VMs with NetBackup application protection option enabled in a backup policy; the VMware backup policy must use VIP for VMware selection. www.tintri.com 13

In a VMware backup policy with Microsoft Exchange DAG, you can include the Microsoft Exchange DAG witness server within the same VMware backup policy. Note that the NetBackup Application State Capture job (child job) for the Microsoft Exchange DAG witness server within the same VMware backup policy could generate a failure status. This is due to the fact that there is no Microsoft Exchange application installed in the Microsoft Exchange DAG witness server VM. An Exchange witness server is just a simple VM that provides quorum for the Microsoft Exchange DAG. The VMware backup job (child job) of the Microsoft Exchange DAG witness server will still execute and successfully protect the Microsoft Exchange DAG witness server VM. When an initial VMware backup job is created, it is possible to run into a VM snapshot failure during a backup job attempt (see figure 12). The following VMware KB article, Cannot create a quiesced snapshot, provides an explanation and resolution when 3 rd party backup agents are involved. Figure 12: VM quiesce failure in a VMware backup job Use the VMware KB resolution to fix the issue before attempting a VMware backup job. Although the default VMware VSS provider is supported with NetBackup, Symantec NetBackup recommends the use of Symantec s VSS provider for application file-level consistent backups. Figure 13 shows an initial full backup with NBU Accelerator for VMware enabled. The initial full backup will always show 0.0% optimization. Subsequent full backups will show the optimization with NBU Accelerator for VMware in terms of the unique bytes that are sent to create a full backup image of the VM(s). DO: Use Symantec s NetBackup VSS provider for application file-level consistent backups for VMware backups with application protection. www.tintri.com 14

Figure 13: NetBackup Job Details with NBU Accelerator enabled NOTE: Microsoft Exchange 2013 support requires Symantec NetBackup 7.6.0.3 or later. For support of Microsoft Exchange 2013 with Granular Recovery Technology (GRT) or any other Microsoft application servers with GRT, review the Symantec NetBackup s Administrator s Guide for the installed NetBackup version for additional details. Figure 14 shows a successful NetBackup Application State Capture (ASC) of a Microsoft Exchange Server with a VMware backup policy. If the NBU ASC job is not successful, fix the errors before allowing an application protection enabled backup job to continue. Correcting the error(s) ensures that the application that is installed in the VM is correctly quiesced and protected before the VM snapshot is created and backed up. Figure 14: VMware backup with NBU Application State Capture of an MS-Exchange server www.tintri.com 15

DO: Fix all NetBackup Application State Capture errors before allowing an application protection enabled VMware backup job to continue. This will ensure that the application is successfully quiesced before a VM snapshot is attempted with VMware VADP backups. NOTE: The use cases in this document were tested with NBU 7.6.0.3. At the time of this write-up, NBU 7.6.0.3 does not support GRT with Exchange 2013 servers. For support of GRT with additional Microsoft Application servers in a VMware environment, review the NetBackup Administrator s Guide for the NBU version installed in your data center. Guest Based Backup Policies Guest based backup policies require the use of NetBackup client installation in the virtual machines. Virtual machines that are application servers such as Microsoft Exchange servers or Microsoft SQL servers are backed up using traditional backups. Figure 15 shows the client properties of a Microsoft Exchange Server. The NetBackup client must be installed on all the Microsoft Exchange servers that are to be protected using NBU guest based backups. Review and provide valid input into the parameters in the Client Properties window to ensure that your Microsoft Exchange VMs are protected. Figure 15: NBU Client Properties of a Microsoft Exchange Server Complete the updates to the client properties for all the Microsoft Exchange servers to ensure that all Microsoft Exchange servers will be protected by the NBU backup policy. Figure 16 shows an example of a MS-Exchange-Server backup policy type. The NBU Accelerator option is greyed-out, as it is not supported with MS-Exchange-Server policy type. Review the NetBackup Administrator s Guide for supported policy types with NBU Accelerator option for the NBU version installed in your data center. Select Allow multiple data streams in the backup policy to take advantage of using multi-streaming rather than processing backup streams sequentially. This can help ensure that the backup bandwidth and NBU media server resource usage is optimized. www.tintri.com 16

Figure 16: Exchange Backup Policy, Attributes Figure 17, shows the backup selection for a NBU Microsoft Exchange 2013 backup policy. Determine the directive set for the Microsoft Exchange backup that is required and complete the process of creating your MS-Exchange-Server backup policy. Figure 17: MS-Exchange-Server Backup Policy, Backup Selections Guest based backups of a Microsoft Application server hosted on a Tintri VMstore should complete successfully when all required application specific requirements as detailed in the NetBackup Administrator s guide are correctly configured. Figure 18 shows a successful backup of a Microsoft Exchange 2013 Server in an Exchange DAG configuration. DO: Take advantage of NetBackup s multi-stream processing in any NetBackup supported backup policies. If a single backup policy consists of a single client with a single backup selection, that backup policy will not be able to take advantage of multi-streaming within the NetBackup job. There are clear benefits when it comes time to protect the application servers or file servers with data protection applications such as Symantec NetBackup. www.tintri.com 17

Figure 18: NBU MS-Exchange-Server Backup Job Details In addition, using deduplication storage such as NBU MSDP can help ensure that backups are more efficient and only unique changed blocks are backed up. Deduplication storage units are more effective and it also supports NBU advanced features such as NBU Accelerator and NBU Auto Image Replication (AIR) for DR purposes. Restores Restore operations within NetBackup are relatively simple and intuitive from the NetBackup Administration Console. To perform a restore operation for either a VMware backup policy or any other backup policy types, specify the source client, the destination client, and the policy type within the Backup, Archive, and Restore Window. NetBackup supports file level restore of VMware backup policies with the following methods: 1) One-stage restore process: Restoring individual files onto a VM that has NetBackup client installed. 2) Two-stage restore process: Restoring individual files onto a VM that has NetBackup client installed and copying the restored files to the final destination on a virtual machine. When performing restore operations, identify the source client for restore base on the client name specified in the backup policy. For example, figure 19 shows a Specify NetBackup Machines and Policy Type Window, the NBU backup policy that was successfully backed up has a NBU client name of DC- SmallVM. Therefore, in the restore operation, the Source client for restores is identified using the same client name: DC-SmallVM defined in the backup policy. www.tintri.com 18

Figure 19: Specify NetBackup Machines and Policy Type If the source client is identified using any other name (i.e. FQDN) that was not defined in the backup policy, you might not find any backup images associated to the NetBackup client that you are attempting to restore using the Backup, Archive, and Restore Window. In which case, a warning message such as the following (figure 20) will pop up stating that there is no backup images for the source client for restore. Figure 20: Specify NetBackup Machines and Policy Type With the source and client correctly identified for a VMware backup policy restore operation, identify the backup image from the NetBackup history to determine which backup image to restore from. The next step is to Select Restore Type that is being attempted. For example, if the intent is to restore a VM, select Restore from Virtual Machine Backup. If the intent is to perform file level restore from VMware backups, select Normal Backups to browse the backup images for the source client (see figure 21). www.tintri.com 19

Figure 21: Select Restore Type NetBackup is also rich in feature for VMware restore operations. The Virtual Machine Recovery Window allows the NBU Administrator to select the following restore destinations (see figure 22): Restore VM to original location Restore VM to alternate location Figure 22: Virtual Machine Recovery Wizard Window, Recovery Destination The next step in the restore process is to determine which NetBackup Recovery Hos to use, the Media Server, and the Transport modes for the restore operation. It is Tintri s recommendation to use NBD for thin provisioned disk restores especially if the destination ESX/ESXi datastore is a SAN attached datastore. The main reason for selecting NBD rather than SAN transport mode for thin provisioned disk restore is because of the round trips through the disk manager APIs, AllocateBlock, and ClearLazyZero processes that is required using SAN transport mode for SAN attached datastores. If the restore operation is to a Tintri VMstore, HotAdd, NBD, and NBDSSL transport modes are supported (see figure 23). Uncheck the SAN transport mode if the destination of the restore operation is to a Tintri VMstore. www.tintri.com 20

Figure 23: Virtual Machine Recovery Wizard Window, Recovery Options DO: Use NBD transport mode for restores of thin provisioned VMs if the alternate restore location is an ESX/ESXi SAN attached datastore. For thin provisioned VM restores to Tintri VMstores, use HotAdd, NBD, or NBDSSL for the transport modes. Within the Virtual Machine Recovery Wizard Window, the virtual machine restore options are also rich in features such as the ability to restore the VM with the original BIOS UUID or Retain original hardware version (see figure 24). Before executing the restore operation, it is Symantec s recommendation to Run Pre-Recovery Check. The purpose of the pre-recovery check validates the following before the restore operation: vsphere server credential Datacenter path Folder path Unsupported non-ascii characters VM overwrite exists Disk space on the target datastore VMware connectivity Figure 24: Virtual Machine Recovery Wizard Window, Virtual Machine Options DO: Run Symantec NetBackup Pre-Recovery Check before finalizing the Symantec NetBackup VMware restore operation. With a NetBackup VMware restore operation, the restore job could complete or fail with a warning in the NetBackup restore job detail (see figure 25). This is documented in the Symantec NetBackup KB article NetBackup Restore of Virtual Machine (VMware) fails with a status code 1 when utilizing SAN or HotAdd. Note that the restore job warning or restore job failure with HotAdd refers to Symantec NetBackup version that are older than 7.6.0.3. www.tintri.com 21

Figure 25: VM Restore Job Details With regards to restores of guest-based backups, the restore operation also requires the correct source client, a valid destination client and the correct policy type to be identified. For example, figure 26 shows the selected backup image for a restore of a Microsoft Exchange Server database. Click on the Action menu and select Restore from the drop-down menu to initiate the restore operation. Figure 26: NetBackup Microsoft Exchange Server Restore NOTE: Tintri VMstores are hybrid storage appliances; this means that cold data are stored on HDD. Active blocks of data are pulled into flash storage as required and all active blocks of data are always hosted on flash storage. With regards to restore operations, bpverify, or duplication jobs of backup www.tintri.com 22

images that are older on media servers that are virtualized on a Tintri VMstore, there is a temporary effect on the latency and flash hit ratio during these read operations that are related to backup data. Tintri SnapVM, CloneVM, and ReplicateVM Protecting your application servers and file servers Use Tintri s technology to protect your application servers and file servers. The use of Tintri s SnapVM ensures that you have a point-in-time snapshot of your virtual application server or file server. This process allows for quick DR testing and for patch testing purposes before deploying application updates or OS patch updates into a live production environment. Figure 27 shows the SnapVM options that are available on any Tintri VMstore. It is recommended to use Tintri VMstore crash-consistent snapshots. If you are using VM-consistent snapshots that rely on VMware tools for VM quiesce, be aware that VMware recommends between 2-3 snapshots in a chain on a per VM basis. Tintri s SnapVM combined with ReplicateVM in the Tintri VMstore Protect feature ensures that your application servers and file servers can be protected locally and replicated offsite for DR purposes. Additionally, the retention period for local and remote snapshot retention is independent of each other. This means that for short-term requirements, the snapshots can be stored locally for quick DR testing while a replicated copy of the VM can be protected offsite for longer DR retention purposes. Figure 27: Tintri VMstore snapshot Tintri s ReplicateVM technology is also very effective and efficient as blocks of data is deduplicated, compressed, and only unique data blocks are sent over LAN/WAN for replication (see figure 28). www.tintri.com 23

Figure 28: Tintri ReplicateVM Therefore, if a possible block of data already belongs to VM B on Tintri VMstore2 but that same block of data is applicable to VM A, only the unique blocks of data is sent from Tintri VMstore 1 to create VM A replica at the target replica site. This replication efficiency can help reduce WAN utilization by up to 95 percent for creating DR copies offsite. Protecting your virtualized NBU Master Server and NBU Media Server If a virtualized NBU media server is configured on a Tintri VMstore, it is Tintri s recommendation to deploy separate VMs as the VMware Backup Host and the NetBackup media server. The reason is due to the fact that the VMware Backup Host will use HotAdd transport mode. During a backup operation, the VMDK of the virtual machines being backed up will HotAdd to the NetBackup VMware Backup Host. During this backup process, if the VMware Backup Host is the NBU media server virtual machine, the NetBackup media server cannot be successfully snapped using Tintri s SnapVM functionality because of the non-persistent target VMDK(s) that is attached to the NBU media server. If this occurs, an alert on the Tintri VMstore can be generated. The alert would be similar to the following in figure 29: Figure 29: Tintri SnapVM failure alerts Therefore, create a separate VMware Backup Host so that HotAdd can be utilized for attaching your target VM for backup while allowing your virtualized NBU media server to be protected using Tintri s SnapVM, CloneVM, and ReplicateVM functionalities. DO: Create separate VMs for your VMware Backup Host virtual machines and your NBU media server virtual machine. Regardless of whether you have physical or virtual NBU master server and NBU media servers, it is Symantec s NBU recommendation to always create a NBU catalog backup policy to protect your NBU catalog, NBU backup policies, and NBU configuration. www.tintri.com 24

DO: Create a NBU catalog backup policy to protect your NBU catalog, NBU backup policies, and NBU configuration. DO: Create multiple NBU backup copies of backup images rather than relying on a single primary backup copy. Create copies to other physical NBU media servers to ensure that more than one copy of any backup images is available using NBU SLP to protect your data with NBU deduplication storage such as MSDP and Symantec NBU appliances. When attempting a NBU DR using Tintri s SnapVM and CloneVM to bring back your virtualized NBU master server and NBU media server(s), run the NBU Restore NetBackup Catalog to recover your NetBackup Disaster Recovery file (see figure 30). DO: Use a virtualized NBU media server for efficient backups of your virtualized infrastructure. However, also take advantage of NBU s SLP and NBU AIR so that you can have DR copies of your backup in a different NBU domain. Use a virtualized NBU media server for shorter retention period but use either a physical NBU media server or a NBU Backup Appliance to create backup copies for longer retention periods. For example, any backup images that are to be retained for a period longer than 6 months, create backup copies to physical NBU media servers or NBU backup appliance or create copies to physical tape. Figure 30: NBU Catalog Recovery Wizard Complete the process by recovering your entire NetBackup catalog per Symantec NetBackup s recommendation. Close and reopen the NBU Administration console if you have just recovered your virtualized NetBackup master server, you may have to restart NetBackup services. When the NBU Administration Console is available, attempt to verify all the backup images in the NBU catalog. Also run import (phase 1 and phase 2) on the NBU media servers and storage units to ensure that all backup images are accounted within the NetBackup catalog. Figure 31 also shows some orphaned image fragments within the NetBackup import phase. www.tintri.com 25

Figure 31: Tintri SnapVM failure alerts When the import (phase 2) is completed, attempt to look up these backup images in the NBU catalog and use NetBackup s bpverify function to validate that these backup images are readable from NetBackup. For example, the first orphaned image fragment within the import job is dcexchange1d2.dcad2.local_1412113906. Run bpverify to validate if the backup image is still intact and readable (see figure 32). Figure 32: NetBackup Job Overview, bpverify of backup image dcexchange1d2.dcad2.local_1412113906 www.tintri.com 26

Figure 33 shows the job detail of the successful bpverify on the backup image dcexchange1d2.dcad2.local_1412113906. It is Tintri s recommendation to have more than 1 backup copy that resides on a physical NetBackup media server so that you can take advantage of NetBackup s duplicate to tape for longer retention periods and for archiving purposes. Figure 33: NetBackup Detailed Status: successful bpverify of backup image dcexchange1d2.dcad2.local_1412113906 With a virtualized NBU master server and a virtualized NBU media server, you can replicate the NBU components to another Tintri VMstore so that you can take advantage of another NBU domain that has physical tape libraries attached. Being able to use Tintri s SnapVM and ReplicateVM allows a NetBackup administrator to clone the virtualized NBU master server and NBU media server for copying the backup images to physical tape located in another offsite location. This is one of the many advantages and flexibilities of using Tintri VMstores to host and protect your virtual infrastructure. Conclusion Tintri s VMstores are designed from the ground-up with virtualization in mind. This includes the ease of installing and configuring your Tintri VMstores, efficiently deploy virtual machines, and protecting your virtual infrastructure. The combination of Symantec NetBackup and Tintri VMstores provides a data protection strategy that works to protect both your virtual infrastructure and your virtualized NetBackup infrastructure. On Tintri VMstores, daily troubleshooting of resources and bottlenecks that used to take hours can be completed within a shorter cycle, greatly reducing overall effort required to maintain a virtualized data center. Figure 34 shows how easy it is to troubleshoot issues at the virtual machine and VMDK level of each virtual machine. Just by highlighting any virtual machine that is deployed on a Tintri VMstore, an administrator can instantly visualize resource usage, IOPS on a per virtual machine level, change in MB/day on a per VM or even the latency on a per VM basis. www.tintri.com 27

Figure 34: Tintri VMstore virtual machine view Managing virtual machines are the tasks of virtualization experts and the daily troubleshooting with resources and bottlenecks that used to take hours can be completed within a shorter cycle. Use Symantec NetBackup to protect your virtualization infrastructure when longer retention periods are required to meet government or corporate requirements, while leveraging Tintri VMstore s SnapVM, CloneVM, and ReplicateVM functionalities to protect your application servers and the application server dependencies. Follow Symantec NetBackup s recommendation to protect your NBU infrastructure and investment. Also combine the Symantec NetBackup strategies with Tintri s VMstore technology to complete your data protection strategy for local and offsite DR purposes. References Tintri VMstore Overview Managing VM Data with Tintri Backup and Recovery Best Practices Symantec NetBackup Administrator s Guide Symantec NetBackup Restore utilizing SAN or HotAdd KB Symantec NetBackup Features of NetBackup for Exchange VMware Cannot create a quiesced snapshot KB VMware Snapshot removal can stop a virtual machine for a long time KB Tintri, Tintri VMstore, the Tintri Logo and FlashFirst are trademarks or registered trademarks of Tintri, Inc. All other trademarks or service marks are the property of their respective holders and are hereby acknowledged. 2014 Tintri, Inc. All rights reserved. 140904T10122 www.tintri.com 28 303 Ravendale Dr., Mt. View CA 94043 +1 650.810.8200 info@tintri.com