Backup Exec 2012 Agent for VMware and Hyper-V

Backup Exec 2012 Agent for VMware and Hyper-V Technical Feature Brief

This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2011 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Contents Introduction ............................................................................................................................................................ 3 Business Value ........................................................................................................................................................ 4 Underlying Backup Principles ................................................................................................................................. 8 Virtualized Application Protection ........................................................................................................................ 17 Virtual Machine Recovery Options ....................................................................................................................... 20 Licensing Considerations....................................................................................................................................... 23 The Agent for VMware and Hyper-V and Other Backup Exec Agents and Options ............................................. 26 Backup Exec Management Plug-in for VMware ................................................................................................... 29 Example Configurations ........................................................................................................................................ 33 Performance Recommendations .......................................................................................................................... 36 Notes and Best Practices ...................................................................................................................................... 38 For More Information ........................................................................................................................................... 40


Introduction This technical feature brief is intended to assist partners and service providers as they design and implement Backup Exec 2012 and the Agent for VMware and Hyper-V and make related decisions. The business value and licensing of the Agent for VMware and Hyper-V will be touched upon lightly in this feature brief. This technical feature brief will help partners and service providers as they make design and implementation decisions for Backup Exec 2012 and the Agent for VMware and Hyper-V through the exploration of the following topics: • • • • • •

Business Value of the Agent for VMware and Hyper-V Underlying Principles and Technology Licensing Considerations Example Configurations Performance factors Best practices

For step by step instructions for installing and managing Backup Exec 2012 and the Agent for VMware and Hyper-V, please refer to the Backup Exec Administrator’s Guide. Note: The Agent for VMware and Hyper-V will be commonly referred to as the Virtual Agent in this document.


Business Value Virtualization technology has been widely adopted by organizations of all sizes to optimize critical IT assets, such as data and application servers. As a result of this virtualization trend, companies are looking for efficient and effective ways to backup and recover their virtual servers. This includes the virtual machines themselves as well as the critical applications that many of these virtual machines host, such as Microsoft Exchange®, SQL Server®, SharePoint®, and Active Directory®. Because virtual host servers are used by many companies to virtualize production servers, the loss of a production virtual host can be even more costly to an organization as losing a standalone physical server, since a single virtual host can be responsible for multiple virtual servers. A lost virtual host can impact productivity for hours or even days while the IT administrator struggles to recover or repair the virtualization infrastructure. Market leaders among virtualization technology include the VMware vSphere platform and the Microsoft Hyper-V platform. Modern backup and recovery solutions designed specifically for VMware and Hyper-V environments are critical to helping organizations quickly recover in the event of a disaster, whether it occurs at the virtual host level, the virtual machine level, the application level, or the file/folder level. The Need for Backup Solutions Designed for Virtual Environments Administrators responsible for the backup and recovery of virtualized environments understand the frustration and difficulty associated with backup technologies that are not specifically designed to protect virtual infrastructures. Administrators who rely upon legacy, misfit solutions to protect their virtual resources face several challenges, such as the following: 

Impacts to overall performance when agent-based backups inside virtual machines fight for resources



Downtime problems resulting from having to shut down virtual machines in order to protect them completely



Slow file-by-file backups that capture redundant data in each virtual machine over and over



Lengthy restore processes of an entire virtual machine in order to recover a single file



Separate backups for virtualized applications like Microsoft SQL, Active Directory, SharePoint, and Exchange



Lack of ability to leverage different data transport paths depending upon the needs of an environment



Storage management problems from storing backups of large virtual disk files, such as VHD and VMDK

Backup Exec 2012 and the Virtual Agent are designed specifically to protect VMware and Hyper-V environments and solve each of the problems listed above. Integration with the Latest Virtualization Technology A significant advantage of Backup Exec 2012 and the Virtual Agent is direct integration with both of the key virtualization platforms found in the market today, VMware vSphere and Microsoft Hyper-V . This integration enables advanced functionality built specifically for the proper and optimized protection of these virtual environments. VMware vSphere Integration Backup Exec 2012’s Virtual Agent integrates with VMware’s vStorage APIs for Data Protection (VADP) to eliminate important challenges associated with the backup of VMware virtual machines and to provide faster backup performance with less overall storage consumption. This is accomplished through the following: VMware “Ready” Certified Integration with VMware vStorage APIs for Data Protection

• •

Enables backup of all virtual machines In SAN environments, supports image-level, off-host backups of virtual machines


• •

Provides backup of VMware virtual machines over SAN infrastructures Eliminates the shutting down of virtual machines in order to protect them

vSphere Changed Block Tracking for Incremental and Differential Backups

• •

Differential backups: backup of only what has changed since the last full backup Incremental backups: backup of only what has changed since the last backup

Block Optimization Support

• •

Intelligent skipping of unused blocks within a virtual disk file Greatly reducing backup sizes and increasing backup speed

Integrated V-Ray Granular Recovery Technology From a single-pass backup of a virtual machine, recover:

• • • •

Entire virtual machine Individual files and folders* Entire applications* Granular application objects* * For a list of supported platforms and applications, please refer to the Backup Exec Software SCL

Advanced V-Ray Data Deduplication Support

• •

VMDK Stream Handler enables increased deduplication efficiency Significant reduction of storage requirements for backup

Improved Microsoft VSS Integration

• •

Proper protection of applications such as Exchange, SQL, SharePoint and Active Directory Application quiescence and log truncation

Microsoft Hyper-V Integration Backup Exec 2012’s Virtual Agent also includes integration with the Microsoft Hyper-V platform to help eliminate these same challenges in Hyper-V environments. This is accomplished through the following: Full Hyper-V Environment Protection • Supports protection of Windows 2008 R2 Hyper-V host servers • Supports protection of Hyper-V virtual machines • Supports Cluster Shared Volume (CSV) configurations or legacy LUN configurations Online Protection of Hyper-V Environments

• • •

Enables backup of all virtual machines Supports image-level backups of virtual machines In most cases, eliminates the shutting down of virtual machines in order to protect

Hyper-V Incremental and Differential Backups

• •

Differential backups: backup of only what has changed since the last full backup Incremental backups: backup of only what has changed since the last backup

Block Optimization Support

•

Intelligent skipping of unused blocks within a virtual disk file


•

Greatly reducing backup sizes and increasing backup speed

Integrated V-Ray Granular Recovery Technology From a single-pass backup of a virtual machine, recover: • Entire virtual machine • Individual files and folders* • Entire applications* • Granular application objects* * For a list of supported platforms and applications, please refer to the Backup Exec Software SCL

Advanced V-Ray Data Deduplication Support • VHD Stream Handler enables increased deduplication efficiency • Significant reduction of storage requirements for backup Integration with Microsoft’s VSS API • Proper protection of applications such as Exchange, SQL, SharePoint and Active Directory • Application quiescence and log truncation

Complete Virtual and Physical Protection in a Single Solution Backup Exec 2012 and the Virtual Agent deliver cost effective and state-of-the-art solutions for the protection for growing vSphere and Hyper-V virtual environments. This includes the following:       

One agent delivers image-level protection to an unlimited number of VMware or Hyper-V virtual machines on a single host Comprehensive backup support for both virtual systems and legacy physical systems in one backup solution Support for both disk and tape storage devices Integration with VMware’s vStorage APIs for Data Protection (VADP) to maximize backup and recovery performance of VMware environments Integration with the Microsoft Hyper-V platform to ensure optimized backup and recovery of Hyper-V environments Granular application and data recovery for virtual Infrastructures to save time and lower cost Storage savings from the deduplication of all backups from an environment, including virtual and physical backups


Figure 1: Protection for Physical and Virtual Environments

SAN Offhost Backups of VMware Virtual Environments When used in VMware environments leveraging a SAN infrastructure, Backup Exec 2012 and the Virtual Agent offer the important benefit of off-host backups. In SAN environments, off-host backups alleviate the burden of backup-related I/O operations from the vSphere server hosting production virtual machines and transfer it to the Backup Exec server. This represents a significant advantage of Backup Exec 2012 and the Virtual Agent when compared to many legacy backup products, which commonly protect virtual machines as if they were standalone physical systems. These legacy backup solutions process backups through locally installed agents in each virtual machine, forcing the VMware hypervisor to bear the full processing burden of backup operations while each virtual machine fights for host resources. This can affect performance of production virtual machines on the hypervisor, and slow down backup operations.


Underlying Backup Principles Discovering Virtual Machines to Protect VMware Resource Discovery When configuring Backup Exec 2012 to protect VMware resources using the Virtual Agent, vSphere hosts and their virtual machines can be discovered in either of the following two ways: 

Entering the vSphere hostname or IP address into the Backup Exec interface



Connecting to an available vCenter server for the discovery of multiple vSphere hosts and their associated virtual machines

Backup Exec 2012 uses VMware Web Services for most communications with vCenter servers for vSphere host and virtual machine discovery operations. The VMware vSphere Web Services SDK was specifically designed to allow management applications to integrate with the vSphere platform.

Figure 2: VMware Virtual Machine Discovery Diagram

Hyper-V Resource Discovery When configuring Backup Exec 2012 and the Virtual Agent to protect Hyper-V resources, the discovery of Hyper-V hosts and their virtual machines is achieved through the process of deploying the Agent for Windows Systems (AWS) to the Hyper-V host server. After the AWS agent has been deployed to the Hyper-V server and the Virtual Agent has been enabled, both the Hyper-V host itself and the virtual machines can be selected for protection in the Backup Exec interface.


Figure 3: Hyper-V Virtual Machine Discovery Diagram

Dynamic Inclusion The dynamic inclusion feature of Backup Exec 2012 allows new virtual machines to be automatically discovered and protected by Backup Exec without requiring the administrator to manually adjust existing backup jobs to include new virtual machines. New virtual machines are discovered at job run time and are automatically protected. This dynamic inclusion capability applies to all new virtual machines that are added to a VMware or Hyper-V host after one or more Backup Exec jobs have been configured to protect virtual machines on that VMware or Hyper-V host, regardless of the platform the virtual machine is running. Administrators that do not want certain new virtual machines to be protected by Backup Exec or by a specific backup job can exclude those virtual machines by using the Backup Exec console to edit the corresponding backup job. Virtual Machine Backup Methods When protecting VMware or Hyper-V virtual environments with Backup Exec 2012 and the Vitual Agent, partners and customers have the option to protect virtual machines using any of the following methods: •

Image-level Backups - capture entire snapshots of virtual machines associated with the virtual host; enables full virtual machine recovery and granular file and folder recovery

•

Agent-assisted Backups (recommended) - a form of image-level backup that includes additional application protection and recovery functionality, including full application recovery and granular application recovery; this is enabled by the Agent for Windows Systems (AWS) being installed into the virtual machine; an agent-assisted backup is not an agent-based backup—backups are still image-level

•

Agent-based Backups – legacy backup method; backups are captured by a local agent installed to a virtual machine; essentially treats the virtual machine as if it were a standalone physical server; recommended only in situations where image-level backups are not optimal, such as when protecting virtual machines configured with Physical Compatibility Mode RDM disks

Image-level, agent-assisted, and agent-based backups can be mixed and matched to meet the needs of an environment. For example, a parter or customer may choose to protect all Windows virtual machines using image-level, agent-assisted backups while protecting Linux-based virtual machines using agent-based backups. Image-level Backups of VMware vSphere Virtual Machines When protecting virtual machines on a VMware vSphere host using the Virtual Agent, image-level backups are captured. This is done via integration with VMware’s vStorage APIs for Data Protection (VADP) and communication with the This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

vSphere host. No Backup Exec agent is installed to the vSphere host itself. To ensure security in these configurations, it is recommended that SSL be enabled on the vSphere host to ensure communication traffic between the vSphere host and the Backup Exec server remains secure. The AWS agent can be installed into VMware virtual machines to enable additional backup and recovery functionality. Even in situations where the AWS agent has been installed to a virtual machine, image-level backups are supported. The additional functionality available when the Agent for Windows Systems is present in the protected virtual machine will be discussed later. Image-level Backups of Hyper-V Virtual Machines When protecting virtual machines on a Hyper-V host using the Virtual Agent, image-level backups are captured. A snapshot of the virtual machine is captured on the Hyper-V host, and all virtual machine files from that snapshot, including all VHD files, are transported over the network to the Backup Exec server for storage. In this configuration, the AWS agent is installed to the Hyper-V host and controls transmission of image-level backups from the Hyper-V host to the Backup Exec server. TSL/SSL encryption secures communication between the AWS agent on the Hyper-V host and the Backup Exec server, and a trust relationship is established. In addition, the AWS agent can be installed into Hyper-V virtual machines to enable additional backup and recovery functionality. Even in situations where the AWS agent has been installed to a Hyper-V virtual machine, image-level backups are supported. The additional functionality available when the Agent for Windows Systems is present in the protected virtual machine will be discussed later. Agent-assisted (Form of Image-level) Backups of VMware and Hyper-V Virtual Machines An agent-assisted backup is an image-based backup (described previously) with the AWS agent also installed to the protected virtual machine. This method is recommended for potecting virtualized application servers. Using this backup method, additional application backup and restore functionality is enabled. Within this technical feaeture brief, we will refer to this configuration as an agent-assisted backup. In an agent-assisted configuration, the AWS agent is installed within a virtual machine hosting an application and works hand-in-hand with the image-level backup process to enable additional backup and recovery functionality. The backup is still image-based, but the inclusion of the AWS agent within the virtual machine unlocks other capabilities, such as the following: 

Automatic discovery of applications inside of a virtual machine



Full application recovery (requires Agent for Applications and Databases license)



Application granular recovery (requires Agent for Applications and Databases license) o Exchange o SQL o SharePoint o Active Directory



Ability to directly recover files and folders directly back to a virtual machine

Agent-assisted backups are the recommended backup method for protecting virtualized application servers, as this offers the greatest level of protection and recovery for virtual machines while maintaining the optimization of imagelevel backups. Agent-based Backups of VMware and Hyper-V Virtual Machines


While in most VMware and Hyper-V environments image-based backups are optimal, agent-based backups are still supported. An agent-based backup uses the AWS agent installed to a virtual machine to fully control the capture and transmission of backup data from a virtual machine to the Backup Exec server. This process relies upon resources directly allocated to that virtual machine, and is essentially the same backup method used for standalone physical systems. When protecting virtual machines using agent-based backups, TSL/SSL encryption is used and a trust relationship is required between the AWS agent within the virtual machine and Backup Exec server. Backup Data Transport Modes VMware Backup Data Transport Modes When capturing backups of VMware virtual machines, Backup Exec 2012 leverages integration with the VMware vStorage APIs for Data Protection (VADP), enabling the utilization of “advanced transport mode”. This means that for each virtual machine that is protected by Backup Exec, VMware will determine all the available ways through which the requested backup data could be transported from the vSphere host to the Backup Exec server. After a data request has been made by Backup Exec, the VADP returns a list of transport modes (SAN, NBD, HOTADD, etc) that are supported and available. Based on this list, along with the selections supplied by the user, a transport mode is selected. For SAN environments, it’s important to note that if Backup Exec is unable to acess the SAN at the time of a backup operation, it will revert to other available data paths (e.g. ethernet) in order to complete the job successfully. A transport mode is the physical data path used for moving backup data from the source vSphere server to the Backup Exec server. The following transport modes are supported by Backup Exec: • • • •

SAN – Uses iSCSI or Fiber Channel shared storage for data transfers HOTADD – Uses a virtualized Backup Exec server that exists as a virtual machine NBD – Uses the LAN/ethernet for data transfers NBDSSL – Uses the encrypted LAN/ethernet for data transfers

Ultimately, transport mode selection is determined through a combination of Backup Exec and VMware. When selecting a transport mode, Backup Exec submits a prioritized list (preferred modes first) of the modes we would like to use for the backup job to VMware, and VMware decides what it will use based on the return call from the VMware API. If incorrect or unexpected transport modes are being used for backup or recovery, it may be helpful to disable all transport modes except the desired transport mode as a troubleshooting step. This can be done under Options > Settings > VMware in the Backup Exec interface. If the job fails, review job logs for a better understanding of the root cause. VMware Backup Data Transport Mode Options Users can select one or more transport modes from a list within the Backup Execm 2012 interface and adjust which modes are tried first (move up/move down in screenshot below). The transport mode options can be found by editing the virtual machine backup job and navigating to the ‘Virtual Machines’ option on the left pane:


Figure 4: VMware Transport Mode Options

Hyper-V Backup Data Transport Modes The only transport mode available for Hyper-V backups using the Virtual Agent is the network (LAN). Regardless of the backup method selected, Hyper-V virtual machine backup data is transferred from the Hyper-V host through the locally installed AWS agent to the Backup Exec server. TSL/SSL encryption secures communication between the AWS agent on the Hyper-V host and the Backup Exec server, and a trust relationship is established. Virtual Platform Integration Integration with the VMware vStorage APIs for Data Protection (VADP) The Backup Exec 2012 Virtual Agent fully integrates the latest version of VMware’s vStorage APIs for Data Protection (VADP) and provides a number of new capabilities, including the following: • • • • • •

High overall backup performance, particularly in SAN-based environments Changed-block tracking for fast block-level incremental or differential backups Block optimization, for the ignoring of unused blocks within a virtual disk, improving performance and lowering backup storage requirements Backup and recovery support of both thin and thick-provisioned virtual disks Template virtual machine backup SAN-based backup of virtual machines

The Backup Exec 2012 Virtual Agent supports the protection of vSphere 4.0 (including vSphere 4.0 Update1), vSphere 4.1, and vSphere 5.0 virtual machines. No Proxy Server Required A proxy server is not required for the protection of either VMware or Hyper-V virtual machines using the Virtual Agent. Backup data moves directly to the Backup Exec server for storage, without a proxy server in the middle. Elimination of the Proxy Server in VMware Environments The VMware vStorage APIs for Data Protection (VADP) eliminate the need for a proxy server to mediate between a vSphere host and the Backup Exec server. Symantec and VMware have worked closely together to ensure that performance impacts during backup are minimal. As a result, customers using Backup Exec 2012 can expect a significant performance improvement over VCB in both CPU and I/O impacts during backups. Typical CPU utilization ranges between 1-4% throughout the duration of the backup while maintaining constant I/O rates. Backups are based on temporary snapshots, which are low-impact and low in disk-space consumption. This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Storage Optimization Features Backup Exec 2012 includes a number of storage optimization technologies that offer tremendous benefits to partners and customers looking to control storage costs. These include Block Optimization, Differential and Incremental backups, and Data Deduplication. When used together, backup data requires only a small fraction of disk storage space of what it would require without these optimization technologies. These storage optimization features apply to both VMware virtual machine backups as well as Hyper-V virtual machine backups. Block Optimization Virtual disks, like physical disks, always contain some amount of empty space. The amount of empty space within a virtual disk can vary, and in the case of some virtual machines a significant percentage of the disk may be empty or unused. When protecting virtual machines, backing up a virtual disk without intelligence against what parts of the disk are used and which are unused results in the capturing of needless empty space as if it were actual data. This lengthens backup windows and requires larger amounts of backup storage space to accommodate. The Backup Exec 2012 Virtual Agent includes block optimization technology, which enables the intelligent identification of empty space within a virtual disk file and the protection of only used portions of the virtual disk. For example, if a virtual disk file was 40 GB in total capacity but only contained 15 GB of actual data, Backup Exec will only capture 15 GB of data during a full backup job. This block optimization speeds up backup windows and reduces backup storage requirements.

Figure 5: Block Optimization Diagram

Block optimization is supported for both VMware vSphere and Microsoft Hyper-V virtual machines. Incremental and Differential Backups Backup Exec 2012 and the Virtual Agent also include changed block tracking (CBT) capabilities. This means that Backup Exec can track what changes have occurred against a virtual machine since the last backup operation at the block level, and only capture the block level changes since the last backup (incremental) or since the last full backup (differential). Differential and incremental backups capture significantly less data than full backups. As a result, incremental and differential backups significantly reduce backup windows and required backup storage when protecting VMware and Hyper-V virtual machines.


Figure 6: Changed Block Tracking

Incremental and differential backups are supported for both VMware vSphere and Microsoft Hyper-V virtual machines. Data Deduplication Backup Exec 2012 also supports combining the Data Deduplication Option with the Virtual Agent which further reduces storage requirements for virtual machine backup purposes. The Data Deduplication Option enables block-level deduplication of all backups stored to a Backup Exec Deduplication Storage Folder, resulting in a 9-to-1 or greater reduction in storage consumption for backup data. The Deduplication Option includes intelligent stream handlers for both VMware virtual disk files (VMDK) and Hyper-V virtual disk files (VHD) allowing for V-Ray visibility and further storage savings when using both the Virtual Agent and the Deduplication Option together. The Deduplication Option and associated virtual disk stream handler technology will be discussed in further detail later in this document. Support of Virtual Platform Advanced Storage and High Availability Features VMware Storage Distributed Resource Scheduling The Backup Exec 2012 Virtual Agent supports several new features offered in the latest release of the VMware vSphere platform, vSphere 5.0. This includes support for hardware version 8 and Storage Distributed Resource Scheduling (SDRS). The SDRS capabilities of vSphere 5.0 allow virtual administrators to simplify management of datastores through the introduction of datastore clusters, also referred to as pods. In addition, depending upon settings defined by the administrator, SDRS has the capability to automatically move virtual machine disk files to different datastores within a cluster to optimize performance, without interrupting virtual machine operation. This feature works hand in hand with other VMware technologies, such as vMotion.


Figure 7: VMware Storage Distributed Resource Scheduling Diagram

Backup Exec 2012 and the Virtual Agent fully support virtual machines located within a datastore cluster and enabled for SDRS. If a virtual machine is being actively backed up by Backup Exec or is having data restored to it at the time an SDRS event for that virtual machine occurs, Backup Exec places a temporary lock on the virtual machine delaying the SDRS event until after the operation has completed and the associated virtual machine snapshot has been removed. Once the backup is complete, the virtual machine is unlocked and the SDRS event proceeds normally. Backup Exec does not remove SDRS attributes from a virtual machine during backup or restore operations. In addition, new restore features have been added allowing administrators to restore virtual machines to the cluster level or to specific datastores within a cluster. Microsoft Hyper-V and Cluster Shared Volumes (Windows 2008 R2) A new technology introduced by Microsoft for their Windows 2008 R2 Server platforms is Cluster Shared Volumes. A cluster shared volume is an NTFS volume that can be accessed by all the nodes in a cluster at the same time. One of the prime use cases of a cluster shared volume is to host Hyper-V virtual disk files (VHD files). This new clustering technology from Microsoft allows VHD files to migrate or fail over to other nodes in the cluster during failover situations more quickly, while avoiding volume ownership problems.

Figure 8: Hyper-V Cluster Shared Volume Diagram This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Backup Exec 2012 and the Virtual Agent support the protection of Cluster Shared Volume nodes, as well as highly available virtual machines in a Cluster Shared Volume configuration. Hyper-V Live Migration Support The Backup Exec 2012 Virtual Agent fully supports Live Migration between Hyper-V hosts. As a result, each Hyper-V host system must be licensed with a separate Virtual Agent license as any of the hosts may be used to process the backup or restore request.


Virtualized Application Protection Application Protection in a VMware vSphere Environment The Backup Exec 2012 Agent for Applications and Databases plays a critical role in the protection of virtualized applications. This agent is licensed separately from the Virtual Agent, and one license of the Agent for Applications and Databases is required for each virtualized application in an environment for which advanced protection and recovery capabilities are desired. Virtual Machine-level Application Protection through VSS in a VMware Environment The Virtual Agent provides online backups of VMware virtual machines that host Microsoft applications and which utilize the Microsoft VSS framework. VSS-aware applications such as these are protected as part of a normal image-level backup of the entire virtual machine. This process leverages VSS to capture a consistent snapshot of the virtual machine and the VSS-aware applications that it hosts. This VSS snapshot process also automatically truncates transaction logs for Exchange and Active Directory. These virtual machines are not taken offline during this process; normal operations continue. Note: In order for online backups of virtual machines to be possible, VMware Tools must be installed to the virtual machines hosting applications for enhanced VSS provider support. Note: Without adding a license for the Agent for Applications and Databases, and without installing AWS into the virtual machine hosting the VSS-ware application, the virtual machine is still protected using VSS, and the application inside the virtual machine will still be backed up in a consistent state. However, recovery options are limited to restoring the entire virtual machine or granular files and folders. Advanced Application Protection and Recovery in a VMware Environment Advanced protection and recovery of applications that have been virtualized in a VMware environment can be enabled by combining the Agent for Applications and Databases with the Virtual Agent. When these agents are combined, the AWS agent should be installed to each virtual machine hosting a virtualized application to enable advanced protection and recovery capabilities. This agent-assisted configuration continues to provide single-pass, image-based backup protection of the virtual machines hosting applications in a VMware environment. This agent-assisted combination also allows for additional application protection capabilities to be enabled, such as automatic virtualized application discovery and granular application object recovery capabilities. Because of these critical additional features enabled by the Agent for Applications and Databases, it is highly recommended that this agent be used alongside the Virtual Agent when protecting virtualized applications in a VMware environment. Without the addition of the Agent for Applications and Databases and without installing the AWS agent to each virtual machine hosting an application, recovery capabilities are limited to full virtual machine recovery and granular file and folder recovery (without the ability to recover files and folders directly back to the virtual machine from which they were captured). Non-VSS Compliant Virtual Machines and Applications in a VMware Environment Platforms and applications that are not VSS-compliant, such as Linux, cannot be properly protected using VSS. If these virtual machines are protected using the Virtual Agent and image-based backups, backups will be crash consistent, and will be captured without knowledge of any applications that may reside within the virtual machine. The virtual machines are not taken offline during the snapshot and backup process; however, the backups are crash consistent. Administrators using Backup Exec 2012 and the Virtual Agent to protect virtual environments that include one or more virtual machines that are not VSS-compliant should consider using agent-based backups, leveraging the standard AWS This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

agent or Agent for Linux and Unix Servers, to protect non-VSS compliant virtual machines. Using the AWS agent or the Agent for Linux and Unix Servers to protect non-VSS-compliant virtual machines helps ensure the virtual machines themselves, as well as the applications they contain, are backed up properly. Application Protection in a Microsoft Hyper-V Environment The Backup Exec 2012 Agent for Applications and Databases plays a critical role in the protection of virtualized applications. This agent is licensed separately from the Virtual Agent, and one license of the Agent for Applications and Databases is required for each virtualized application in an environment for which advanced protection and recovery capabilities are desired. Virtual Machine-level Application Protection through VSS in a Hyper-V Environment The Virtual Agent provides online backups of Hyper-V virtual machines that host Microsoft applications and which utilize the Microsoft VSS framework. VSS-aware applications such as these are protected as part of a normal image-level backup of the entire virtual machine. This process leverages VSS to capture a consistent snapshot of the virtual machine and the VSS-aware applications that it hosts. This VSS snapshot process also automatically truncates transaction logs for Exchange and Active Directory. These virtual machines are not taken offline during this process; normal operations continue. Note: In order for online backups of virtual machines to be possible, Hyper-V Integration Services must be installed to the virtual machines hosting applications for enhanced VSS provider support. Note: Without adding a license for the Agent for Applications and Databases, and without installing AWS into the virtual machine hosting the VSS-ware application, the virtual machine is still protected using VSS, and the application inside the virtual machine will still be backed up in a consistent state. However, recovery options are limited to restoring the entire virtual machine or granular files and folders. Advanced Application Protection and Recovery in a Hyper-V Environment Advanced protection and recovery of applications that have been virtualized in a Hyper-V environment can be enabled by combining the Agent for Applications and Databases with the Virtual Agent. When these agents are combined, the AWS agent should be installed to each virtual machine hosting a virtualized application to enable advanced protection and recovery capabilities. This agent-assisted configuration continues to provide single-pass, image-based backup protection of the virtual machines hosting applications in a Hyper-V environment. This agent-assisted combination also allows for additional application protection capabilities to be enabled, such as automatic virtualized application discovery and granular application object recovery capabilities. Because of these critical additional features enabled by the Agent for Applications and Databases, it is highly recommended that this agent be used alongside the Virtual Agent when protecting virtualized applications in a Hyper-V environment. Without the addition of the Agent for Applications and Databases and without installing the AWS agent to each virtual machine hosting an application, recovery capabilities are limited to full virtual machine recovery and granular file and folder recovery (without the ability to recover files and folders directly back to the virtual machine from which they were captured). Non-VSS Compliant Virtual Machines and Applications in a Hyper-V Environment Some platforms and applications are not VSS-compliant, such as Linux, and cannot be properly protected using VSS. If these virtual machines are protected using the Virtual Agent and image-based backups, they may be momentarily placed in a suspended or offline state while the virtual machine snapshot is being captured. When virtual machines are taken offline in order to capture backups they are not placed in a consistent or “backup ready” state, nor are application logs truncated. Rather, they are protected in a crash-consistent manner. This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

For a list of virtual machine configurations that may be taken offline during such a backup operation, please refer to Microsoft resources. Administrators using Backup Exec 2012 and the Virtual Agent to protect virtual environments that include one or more virtual machines that are not VSS-compliant should consider using agent-based backups, leveraging the standard AWS agent or Agent for Linux and Unix Servers, to protect non-VSS compliant virtual machines. Using the AWS agent or the Agent for Linux and Unix Servers to protect non-VSS-compliant virtual machines helps ensure the virtual machines themselves, as well as the applications they contain, are backed up properly.


Virtual Machine Recovery Options Backup Exec 2012 supports a wide range of recovery options for virtual machines that are protected with the Virtual Agent. Each of these recovery options is possible from a single-pass, image-level backup of either VMware vSphere or Microsoft Hyper-V virtual machines. No additional or separate backup operation is required to achieve additional levels of restore granularity. For virtualized applications, granular application recovery can only be enabled by combining the Virtual Agent with the Agent for Applications and Databases, and by installing AWS to the virtual machines hosting applications in a VMware or Hyper-V environment. The virtual machine recovery options described below apply to VMware virtual machine backups as well as Hyper-V virtual machine backups. Full Virtual Machine Recovery The Virtual Agent supports full virtual machine recovery. This includes all elements of a virtual machine, such as the virtual disk files and any other virtual machine-related files. During a full virtual machine recovery operation, virtual disk files are recovered entirely, including the operating system, applications, and data. Integration with the Microsoft VSS service ensures that VSS-aware applications, such as Exchange and SQL, hosted on VSS-aware platforms, such as Windows 2008, are recovered properly as part of a full virtual machine recovery operation. A virtual machine can be recovered to the original host or can be redirected to an alternate host. Administrators have several options to deal with the power state (on/off) of a virtual machine during recovery operations. For example, administrators can select the following:  

Whether to automatically power off the target virtual machine during a recovery operation Whether or not to automatically power on a restored virtual machine after a recovery operation

Note: In order to redirect a virtual machine to an alternate host during recovery, the alternate host must also be licensed for the Backup Exec 2012 Virtual Agent. Virtual Disk Configurations and Support The Virtual Agent allows administrators to protect virtual machines that are configured with different virtual disk types. The Virtual Agent supports the protection of VMware virtual machines configured with either thick or thin virtual disks. Upon recovery, the administrator has the option of recovering a VMware virtual machine with either a thick or thin virtual disk, and can therefore change the virtual disk type during a recovery operation (e.g. thick to thin or thin to thick). The Virtual Agent supports the protection of Hyper-V virtual machines configured with either dynamically expanding or fixed size VHDs. When recovered, a virtual machine will have the same VHD type as it had when it was backed up (for example, if the virtual machine had fixed size VHDs when it was backed up, it will have fixed size VHDs after it’s been recovered). Application Recovery For virtual machines hosting Exchange, SQL, SharePoint, and Active Directory, full recovery at the application level is also supported by the Virtual Agent, but only when the Virtual Agent is combined with the Agent for Applications and Databases and the AWS agent is installed to the virtual machine hosting the application. This allows administrators to recover a full application instance if a full virtual machine recovery is not necessary or is not desired. Exchange, SQL, SharePoint, and Active Directory backups are fully VSS-compliant in accordance with Microsoft best practices, ensuring the applications will operate and function properly after recovery. This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

To enable application-level recovery, the Backup Exec 2012 Agent for Applications and Databases must be licensed for the virtual machine hosting the application and the AWS agent must be installed to the virtual machine hosting the application. Note: application-level recovery is not supported for virtualized applications in a distributed configuration. Granular Application Recovery The Backup Exec 2012 Virtual Agent enables administrators to recover granular application objects from single-pass backups of VMware and Hyper-V virtual machines when the Virtual Agent is combined with the Agent for Applications and Databases and the AWS agent is installed to the virtual machine hosting the application. Example granular application objects that can be recovered in this configuration include Exchange mailboxes, emails, attachments, and calendar items, Active Directory objects such as user and computer objects, SharePoint documents, SQL databases, and more. A separate database-level or object-level backup is not required for granular application recovery; the same single-pass, image-based backup is harvested for granular application object recovery operations. To enable granular application object recovery, the Backup Exec 2012 Agent for Applications and Databases must be licensed for the virtual machine hosting the application and the AWS agent must be installed to the virtual machine.

Figure 9: Granular Recovery for Virtualized Applications

Granular File and Folder Recovery Granular file and folder recovery is also supported for virtual machines protected using the Virtual Agent, and is done from the same single-pass, image-level backups used for other recovery options. It is not necessary to have the AWS agent installed to the virtual machine in order for granular files and folder recovery to be possible. However, having the AWS agent installed to the virtual machine is required in order to recover files and folders directly back to the source virtual machine.


Optionally, or if the AWS agent is not installed to the original machine from which backups were captured, files and folders can be recovered to a local directory on the Backup Exec server, and moved back to the original virtual machine using other methods.


Licensing Considerations Another key advantage to using Backup Exec 2012 and the Virtual Agent when compared to other solutions in the market is its simplified licensing system. A single license of the Virtual Agent allows for full image-level protection of all virtual machines on a single hypervisor host, as well as full virtual machine recovery and granular file and folder recovery. This single license provides protection for all virtual machines associated with the hypervisor, regardless of how many virtual machines a hypervisor is hosting or how many CPU cores the server contains. The Agent for Applications and Databases, which enables advanced application protection and recoveroy capabilities, is licensed separately. Example Licensing Scenarios To better illustrate how to properly license the Virtual Agent alongside other Backup Exec 2012 components in both VMware and Hyper-V environments, a few example scenarios are shown below. Example VMware Licensing Environment Here is an example VMware virtual environment protected by Backup Exec:

Figure 10: Example VMware Environment for Licensing Purposes

The above environment includes a Backup Exec server, a vSphere server, and four virtual machines. The four virtual machines above can be described as follows (from left to right): • • • •

Exchange server Active Directory SQL Server File Server

This environment would require the following Backup Exec 2012 licenses in order to be both fully protected and fully in compliance with license requirements: Backup Exec Licensable Component

Required Licenses

Backup Exec Server

1

Agent for VMware and Hyper-V (Virtual Agent)

1

Agent for Applications and Databases

3


Agent for Windows Systems (AWS)

0

In this example diagram, the four virtual machines on the vSphere host are licensed for all Backup Exec protection and recovery capabilities. This includes VSS-aware protection for all virtual machines (including automatic application discovery), full virtual machine recovery, application recovery, granular application recovery, and granular file and folder recovery. Note that although the AWS agent is shown in this diagram to enable agent-assisted protection which offers application discovery, granular application recovery, and direct-to-source granular file recovery, no AWS agent licenses are required as these are included for all virtual machines on the host in the Virtual Agent license. Also note that no AWS agent, or any other agent, is resident on the VMware vSphere server. The Backup Exec server interacts with VMware hosts directly through the vStorage APIs for Data Protection (VADP) and does not require an agent to be present on the host. Other options that unlock additional Backup Exec 2012 capabilities, such as the Deduplication Option, are licensed separately (not shown in this diagram). Example Hyper-V Licensing Environment Here is an example Hyper-V virtual environment protected by Backup Exec:

Figure 11: Example Hyper-V Environment for Licensing Purposes

The above environment includes a Backup Exec server, a Hyper-V server, and four virtual machines. The four virtual machines above can be described as follows (from left to right): • • • •

Exchange server Active Directory SQL Server File Server

This environment would require the following Backup Exec 2012 licenses in order to be both fully protected and fully in compliance with license requirements: Backup Exec Licensable Component Backup Exec Server

Required Licenses 1


Agent for VMware and Hyper-V (Virtual Agent)

1

Agent for Applications and Databases

3

Agent for Windows Systems (AWS)

0

In this example diagram, the four virtual machines on the Hyper-V host are licensed for all Backup Exec protection and recovery capabilities. This includes VSS-aware protection for all virtual machines (including automatic application discovery), full virtual machine recovery, application recovery, granular application recovery, and granular file and folder recovery. Note that although the AWS agent is shown in this diagram to enable agent-assisted protection which offers application discovery, granular application recovery, and direct-to-source granular file recovery, no AWS agent licenses are required as these are included for all virtual machines on the host in the Virtual Agent license. Also note that the AWS agent on the Hyper-V server is included in the license for the Virtual Agent. The Backup Exec server interacts with the AWS agent on the host Hyper-V host to both protect the Hyper-V host itself (if desired) and to transfer virtual machine image-based backups (captured from snapshots generated on the Hyper-V host) to the Backup Exec server for storage. Other options that unlock additional Backup Exec 2012 capabilities, such as the Deduplication Option, are licensed separately (not shown in this diagram).


The Agent for VMware and Hyper-V and Other Backup Exec Agents and Options Agent for Windows Systems The Backup Exec 2012 Virtual Agent enables what is generally known in the industry as “agent-less” backup. This means that backups of virtual machines are captured at the image level though interaction with the hypervisor host and the generation of virtual machine snapshots. Backups are not generated through an agent operation installed to and active within the virtual machine itself. However, if the Agent for Windows Systems (AWS) is installed into virtual machines, additional and supporting backup functionality can be enabled. This does not cause Backup Exec to revert backup to agent-based backups; image-based backups continue. However, having AWS inside of a virtual machine can enable additional functionality, such as the following: 

Direct recovery of files and folders to the virtual machine containing the AWS agent



Automatic discovery of applications within a virtual machine (requires Agent for Applications and Databases)



Application-level recovery (requires Agent for Applications and Databases)



Granular recovery of application objects (requires Agent for Applications and Databases)

Installing the AWS agent into a virtual machine while still capturing image-based backups of virtual machines is referred to in this document as agent-assisted backups. The user maintains the benefits of image-based backups (off host backups in the case of VMware) while also enjoying the benefits of having a software agent resident within the virtual machine for advanced protection and recovery capabilities. Agent for Applications and Databases Another key component of the Backup Exec 2012 portfolio designed to work hand-in-hand with the Agent VMware and Hyper-V is the Agent for Applications and Databases. The Agent for Applications and Databases is licensed separately from the Virtual Agent, and requires the AWS agent to be installed inside of the virtual machine hosting the application. One of the most important features enabled by the Agent for Applications and Databases is granular application recovery. The granular application recovery technology enabled by the Agent for Applications and Databases does not require an additional or separate backup operation to function. Granular application objects are harvested from the same imagebased backup that is used for other types of recovery, such as full virtual machine recovery. The Agent for Applications and Databases supports key Microsoft applications hosted on virtual machines, including: • • • •

Exchange SharePoint SQL Server Active Directory

The Backup Exec 2012 Virtual Agent can interact with these applications when the Backup Exec Agent for Windows Systems (AWS) is installed inside of the virtual machine hosting the application and the Agent for Applications and Databases has been licensed on the Backup Exec server. For specific details about the applications supported by Backup Exec and the Agent for Applications and Databases, please refer to the Backup Exec Software Compatibility List (SCL) available online. Data Deduplication Option This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

The Backup Exec 2012 Virtual Agent can be used in conjunction with the Backup Exec 2012 Deduplication Option to realize significant backup data storage savings. When the Backup Exec 2012 Deduplication Option is added to the environment, deduplication technology is employed against the Deduplication Storage Folder where backups are stored. The Backup Exec 2012 Deduplication Option enables several capabilities that can greatly benefit Administrators looking to control storage growth associated with backup operations. There are three different methods of deduplication that are available with the Deduplication Option: 

Client Deduplication



Server Deduplication



Appliance Deduplication

Client Deduplication Client-side deduplication uses a process whereby deduplication calculations, meaning the identification of unique and non-unique blocks and the skipping of non-unique blocks, is driven by the local Backup Exec Agent for Windows Systems (AWS) or Agent for Linux locally installed to the protected server. The advantage of using this method is that only the unique blocks of data are transferred to the Backup Exec server, greatly reducing the data traffic impact on network or LAN. Server Deduplication The server-side deduplication method uses a process where all backup data is transferred to the Backup Exec server before deduplication calculations are made. Once backup data has arrived at the Backup Exec server, blocks are fingerprinted and identified as unique or non-unique, and either kept or skipped respectively. In most environments, server-side deduplication is optimal for backups of VMware environments using the Virtual Agent. Appliance Deduplication The appliance deduplication method leverages a 3rd-party deduplication device (for example, an ExaGrid EX series or a Quantum DXi 7500) to handle all aspects of deduplication. Backup data is transferred to the appliance device for storage, while catalog information is transferred to the Backup Exec server. Flexible Deduplication Choices Different deduplication methods can be mixed and matched to better service the configuration needs of Backup Exec customers.

Figure 12: Integrated Block-level Deduplication for Backups

Configurations are not restricted to a single deduplication method for a particular environment. Some protected servers will be better matched for one type of deduplication or another, and Backup Exec administrators have the flexibility to mix and match deduplication methods in order to tailor protection to meet the specific needs of their environment. VMDK and VHD Stream Handlers This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Backup Exec 2012 includes stream handler technology designed specifically for backups of VMware and Hyper-V virtual machines. Stream handler technology operates invisibly to Backup Exec, meaning no additional management or configuration adjustments are required on the part of the administrator. The stream handlers enable variable-length segmenting of VMware (VMDK) and Hyper-V (VHD) disk files during deduplication calculations. This aligns deduplication blocks to file extent boundaries, and data changes over time within VMDK and VHD files result in fewer unique blocks. This translates into better storage savings across both VMware and Hyper-V backups when using the Backup Exec 2012 Virtual Agent in conjunction with the Backup Exec 2012 Deduplication Option.

Figure 13: VMware (VMDK) and Hyper-V (VHD) Stream Handler Diagram

Combining the Virtual Agent with the Deduplication Option can offer significant storage savings for Backup Exec administrators, allowing them to reduce sorage costs by getting the most out of the backup storage resources at their disposal.


Backup Exec Management Plug-in for VMware Overview In early 2011, Symantec released the Backup Exec Management Plug-in for VMware. This management plug-in is offered at no charge and is available for download from the Backup Exec Technical Support web portal. The Backup Exec Management Plug-in for VMware allows administrators of VMware virtual environments that are protected by Backup Exec and the Virtual Agent to utilize the vSphere client application to perform status monitoring, virtual machine validation, and virtual machine auto recovery tasks without having to visit the Backup Exec server console. This includes the following: • • • •

Monitor backup status of VMware virtual machines protected by Backup Exec Resource-centric view of the backup status of protected virtual machines Perform virtual machine validation tasks Configure Backup Exec integration with ApplicationHA for automatic virtual machine recovery*

* ApplicationHA is a separate product from Symantec and is not a component of Backup Exec. ApplicationHA is purchased and configured separately. The information that is displayed in the vSphere client interface is retrieved from the Backup Exec server that controls the backup jobs protecting VMware virtual machines. The Backup Exec Management Plug-in for VMware is installed to a system that also runs the VMware vSphere client, and supports both vCenter server environments and standalone vSphere hosts. The Backup Exec management information is displayed within the context of the vSphere client application on a separate “Symantec Backup Exec” tab. This new management plug-in requires and VMware vSphere 4.0 or 5.0 components (or later). For more information on the versions of Backup Exec and VMware vSphere that are supported by this management plug-in, please refer to the Backup Exec Software Compatibility list, available on-line. Login Users of the Backup Exec Management Plug-in for VMware will be required to log into the associated Backup Exec server. This can be done by specifying the server’s hostname or IP address. The credentials should represent a user that is a member of the Backup Exec Operators group. Monitoring In the plug-in display, the administrator is able to view all the Backup Exec backup jobs that protect virtual machines in the VMware environment. For environments with multiple Backup Exec servers running jobs that protect VMware virtual machines, the administrator can connect to one Backup Exec server at a time to monitor the status of VMware backup jobs processed by that server. Additional views are also offered, such as a view that shows unprotected virtual machines or virtual machines that are protected by a different Backup Exec server.


Figure 14: Backup Exec Management Plug-in for VMware

Virtual Machine Validator A new feature of the Backup Exec Management Plug-in for VMware is the Virtual Machine Validator. This feature enables administrators to validate the integrity of VMware virtual machine backups captured using Backup Exec and the Agent for VMware. The Virtual Machine Validator functionality is available through the vSphere client application. Like the Management Plug-in for VMware itself, the Virtual Machine Validator feature is available at no additional charge to Backup Exec customers. The Virtual Machine Validator operates by leveraging VMware Workstation to mount a backup of a virtual machine from backup storage and launch it. Once the virtual machine has booted, the Virtual Machine Validator connects to the local VMware Tools application inside of the virtual machine to ensure the backup of the virtual machine booted properly and verify that it is valid. If desired, custom scripts can also be executed within the virtual machine for further validation. Validation events are initiated from the vSphere client interface, using the Backup Exec Management Plug-in for VMware. When the plug-in has been installed, a ‘Symantec Backup Exec’ tab will appear in the vSphere client interface. The administrator can perform verify tasks using the options available at this tab.

Figure 15: VMware Virtual Machine Validator Diagram This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Results from virtual machine validation tests are published back to the Management Plug-in for VMware and displayed in the “Symantec Backup Exec” tab in the vSphere client. The new Virtual Machine Validator feature of the Backup Exec Management Plug-in for VMware supports different network configuration settings allowing administrators to validate individual virtual machines or validate multiple virtual machines in a private network environment. Virtual Machine Validator Notes: • • • •

Validation tasks can only be run against GRT-enabled VMware backups Validation tasks can only be run against VMware backups stored to disk or Deduplication Storage Folders (cannot be run against backup sets stored to tape) Validation tasks cannot be run against backup sets that have been transferred to remote Backup Exec servers through optimized duplication It is recommended that VMware Workstation be installed to a standalone system and not the same system to which the Backup Exec server has been installed

For additional information on supported platforms and other requirements for the Virtual Machine Validator, please refer to the Backup Exec Administrator’s Guide and the Backup Exec Software Compatibility List. Virtual Machine Auto Recovery Another key element of the Backup Exec Management Plug-in for VMware is integration with the SymantecHA product to offer automated recovery of VMware virtual machines hosting applications that have become unresponsive. The ApplicationHA solution monitors the status of applications hosted on VMware virtual machines and includes functionality to automatically bring the application back on-line in the event that the application stops functioning properly. When the monitoring functionality of ApplicationHA determines that an application hosted on a VMware virtual machine has become unresponsive, it will first attempt to restart the application and its associated services. If one or more application restarts do not bring the application coming back online, ApplicationHA will then restart or reset the virtual machine itself. If the virtual machine restart also does not bring the application back online, integration between Backup Exec and ApplicationHA through the management plug-in enables the full virtual machine to be restored by Backup Exec from a recent backup.

Figure 16: VMware Virtual Machine Auto Recovery Configuration Options This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Selecting the ‘Auto Recovery’ button in the management plug-in interface allows the administrator to configure what virtual machines being protected by Backup Exec are eligible for auto recovery and the rules governing the auto recovery process. The Backup Exec Management Plug-in for VMware is available to be downloaded from the following location: http://www.symantec.com/business/support/index?page=content&id=TECH169148.


Example Configurations Configurations of Backup Exec 2012 in virtual environments will vary depending on the size, configuration, and complexity of the virtual environment that is being protected. In this section, we will review some basic configuration examples for both VMware and Hyper-V environments. Example Backup Exec Configurations for VMware Environments Basic VMware Environment with a Single vSphere Server In this example, Backup Exec 2012 is protecting a single vSphere server with a small number of virtual machines. In this example, Backup Exec is installed to a separate physical server (usually offers the best performance), but Backup Exec could optionally be installed as another guest virtual machine on the vSphere host. In such configurations, backup data will be stored to the virtual disk files of the virtual machine hosting the Backup Exec server. This example also shows the virtual machines being protected as residing on a shared SAN storage array. When a vSphere configuration utilizes shared SAN storage, and the Backup Exec server is connected to the SAN infrastructure, VMware virtual machine backup data can be transported to the backup destination over the SAN which can offer significant performance benefits.

Figure 17: Basic VMware Environment with a Single vSphere Server

Advanced VMware vCenter Environment (Multiple vSphere Hosts) In this example, Backup Exec 2012 is protecting a more complex VMware vSphere environment that includes multiple vSphere servers and a vCenter server. In configurations such as these, Backup Exec can discover and protect virtual machines through the vCenter server itself and it is not necessary to perform discovery operations at the vSphere server level. In this example, Backup Exec is installed to a separate physical machine, which is recommended for larger VMware vSphere environments. This example also shows the virtual machines being protected as residing on a shared SAN storage array. When a vSphere configuration utilizes shared SAN storage, and the Backup Exec server is connected to the SAN infrastructure, backup data can be transported over the SAN which can offer significant performance benefits compared to transporting backup data over the LAN.


Figure 18: Advanced VMware vCenter Environment

Example Backup Exec Configurations for Hyper-V Environments Basic Hyper-V Environment with a Single Hyper-V Server In this example, Backup Exec 2012 is protecting a single Hyper-V server with a small number of virtual machines. In this example, Backup Exec is installed to a separate physical server, but Backup Exec could optionally be installed to the Hyper-V host itself. For smaller environments, installing Backup Exec to the Hyper-V host itself will commonly offer the best performance, since backup storage devices will be local to the Hyper-V server and backup data will not have to travel over the LAN before being stored.

Figure 19: Basic Hyper-V Environment with a Single Hyper-V Server

Basic Hyper-V Environment with a Single Hyper-V Server hosting Backup Exec as a Virtual Machine In this example, Backup Exec 2012 is protecting a single Hyper-V server with a small number of virtual machines. In this example, Backup Exec is installed to one of the virtual machines hosted on the Hype-V host, and not on a separate backup server. In such configurations, backup data will be stored to the virtual disk files of the virtual machine hosting the Backup Exec server.


Figure 20: Hyper-V Environment with Backup Exec in a Virtual Machine

Advanced Hyper-V Environment (Multiple Hyper-V Servers) In this example, Backup Exec 2012 is protecting a more complex Hyper-V environment that includes multiple Hyper-V servers. In configurations such as these, Backup Exec discovers both the Hyper-V host and the virtual machines through the process of deploying the Agent for Windows Systems (AWS) to the Hyper-V server. In this example Backup Exec is installed to a separate physical machine, which is recommended for larger Hyper-V environments. It’s important to note that in Hyper-V environments backup data is captured and transferred to the Backup Exec server over the LAN, through communication between the Backup Exec server and the AWS agent on the Hyper-V host.

Figure 21: Advanced Hyper-V Environment


Performance Recommendations VMware Performance Recommendations SAN-based Backup Guidance Configuring SAN-based backups for VMware with Backup Exec 2012 and the Virtual Agent is relatively simple after following some basic guidelines: 

Zone the LUNs that contain the VMFS data store such that the Backup Exec server can see and access them.



On the Backup Exec server, ensure that the “automount disable” and “automount scrub” commands have been run to disable automatic drive letter assignment.



As a result of the “automount disable” and “automount scrub” commands having been run, the VMFS datastore LUN’s should appear in Windows Disk Administrator (on the Backup Exec server) as “unknown”; do not attempt to mount, partition, or format these disks.

Backup performance will be largely determined by the slowest component of the entire backup data path from the vSphere Server to the Backup Exec storage location (i.e. Tape or Disk). These components are: • • • •

vSphere server system resources: CPU (GHz) vSphere system disk I/O capabilities (Gbps) Network type (Fiber Channel 1/2/4/8GB, iSCSI, 1/10GB Ethernet, etc) Backup Exec server system resources

General Performance Guidelines and Expectations Here are some basic guidelines that should be followed when designing a VMware environment to be protected by Backup Exec and configured for optimal performance: • •

•

For SAN-based backups, consider installing Backup Exec on a physical machine. The internal bus of the Backup Exec server should be fast enough to support the I/O devices that are connected to it; if multiple I/O ports are used, a system with multiple internal buses should be considered to support the additional I/O. Backup Exec server I/O performance is generally more important than CPU performance; for example, a 2 Gb Fiber connection should be able to transfer backup data at a nominal transfer rate of 140 MB/second; backups over Gigabit Ethernet will likely be much slower, while 4/8 Gb Fiber Channel connections and newer iSCSI configurations should be significantly faster.

For more information, see Backup Exec Technote http://seer.entsupport.symantec.com/docs/346047.htm Recommended Number of Virtual Machines to Protect with a Single Backup Exec Server There is no limit to the number of virtual machines that a single Backup Exec server can protect. This is highly dependent on the size of the VMDK files for each virtual machine, and the physical backup infrastructure. In large environments, multiple Backup Exec servers can be used to optimize performance across the infrastructure. Backup Protection Recommendations It is recommended that a seven-day rotation be used to protect VMware virtual machines with incremental and differential backups, where a full backup is run on the 7th day to avoid long incremental/differential backup chains. It is also recommended that the Backup Exec 2012 Deduplication Option be used in conjunction with the Virtual Agent. This will significantly reduce backup storage requirements associated with virtual machine backups. This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

Hyper-V Performance Recommendations General Performance Guidelines and Expectations Overall backup performance in a Hyper-V environment will be largely determined by the slowest common denominator in the infrastructure. Generally, disk I/O performance is the most common bottleneck, such as the disk I/O capabilities of the storage device/array hosting the Hyper-V virtual machine files, as well as the I/O capabilities of the Backup Exec server. For best performance in larger environments where multiple Hyper-V servers are protected by Backup Exec, consider installing the Backup Exec server to a separate, standalone physical server. For best performance in smaller environments where only a single Hyper-V server is being protected by Backup Exec, consider installing the Backup Exec server to the Hyper-V host itself. Recommended Number of Virtual Machines to Protect with a Single Backup Exec Server There is no limit to the number of virtual machines that a single Backup Exec server can protect. This is highly dependent on the size of the .VHD files for each virtual machine, and the physical backup infrastructure. Backup Protection Recommendations It is also recommended that the Backup Exec 2012 Deduplication Option be used in conjunction with the Virtual Agent. This will significantly reduce backup storage requirements associated with virtual machine backups.


Notes and Best Practices VMware Notes and Best Practices Exchange 2010 and Database Availability Group (DAG) Configurations GRT restores are currently unsupported for backups of Exchange 2010 virtual machines in a Distributed Availability Group (DAG) configuration. Virtual Machines Configured With RDM Physical Compatibility Mode Disks The Backup Exec VMware Agent cannot protect RDM (Raw Device Mapping) Physical Compatibility Mode disks. There are two types of RDM disks; virtual mode and physical compatibility mode. Physical compatibility mode (i.e. persistent-independent) bypasses the vSphere storage infrastructure (VMFS file system) and cannot have a snapshot taken by vStorage APIs for Data Protection (VADP). Physical compatibility mode RDM disks in this configuration are skipped automatically during backup job processing and logged by Backup Exec as unprotected. In order to protect virtual machines configured with physical compatibility mode RDM disks, Backup Exec Remote Agents can be installed in the virtual machines to back up their data using traditional backup methods. Virtual Machines Configured With GPT Disks The Backup Exec Virtual Agent can be used to back up and recover virtual machines that are configured with GPT disks at the image level. This includes full, differential, and incremental backup methods. However, granular file/folder recovery and granular application recovery from virtual machines configured with GPT disks is not currently supported using the Backup Exec Virtual Agent. For configurations where a need exists to protect virtual machines configured with GPT disks and take advantage of granular recovery capabilities, install the Backup Exec Agent for Windows Systems (AWS) to the virtual machine configured with GPT disks and protect it in the standard fashion using agent-based backups. Virtual Machines Configured With Fault Tolerance The Backup Exec Virtual Agent cannot be used to protect vSphere Fault Tolerant virtual machines. Once a virtual machine has Fault Tolerance enabled, snapshots are no longer supported on that virtual machine. The Backup Exec Virtual Agent uses snap-based backups via the vStorage APIs for Data Protection (VADP) to protect VMware virtual machines, and therefore cannot protect virtual machines with Fault Tolerance enabled. The only way to back up a virtual machine that is enabled with Fault Tolerance using the Backup Exec Virtual Agent is to break the Fault Tolerance, run the backup, then re-enable Fault Tolerance. The workaround for protecting Fault Tolerant virtual machines without breaking the Fault Tolerance is to install the Agent for Windows Systems (AWS) to that virtual machine and protect it as you would a standalone physical machine using agent-based backups. Hyper-V Notes and Best Practices Exchange 2010 and Database Availability Group (DAG) Configurations GRT restores are currently unsupported for backups of Exchange 2010 virtual machines in a Distributed Availability Group (DAG) configuration. AWS Must Be Installed to Hyper-V Host This document is provided for informational purposes only and is intended for distribution only to Symantec employees and selected partners. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Copyright © 2012 Symantec Corporation. All rights reserved. Symantec, the Symantec logo and Backup Exec are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

The Backup Exec Agent for Windows Systems (AWS) must be installed to Hyper-V hosts in order to enable protection of Hyper-V host itself as well as any virtual machines it is hosting using the Backup Exec Virtual Agent. Hyper-V Integration Services Required in Hyper-V Virtual Machines Hyper-V Integration Services must be installed to Hyper-V virtual machines before online backup using the Virtual Agent will be possible. Non-VSS Aware Platforms and Applications Non-VSS aware platform and applications, such as Linux, should be protected with the associated Backup Exec Agents and not using the Virtual Agent. Backup Exec Servers and Windows 2008 Core Backup Exec servers cannot be installed to Windows 2008 Core systems. Unsupported Disk Configurations Certain disk configuration types are unsupported for online backup or have certain limitations. These include the following: • • •

•

Remote iSCSI Disks – Virtual machines utilizing remote iSCSI disks should be protected using the standard AWS agent and not the Virtual Agent. Physical or Pass-through Disks - Virtual machines utilizing physical or pass-through disks should be protected using the standard AWS agent and not the Virtual Agent. Dynamic Disks (http://technet.microsoft.com/en-us/library/cc757696(WS.10).aspx) – Virtual machines using Dynamic Disks can be protected using the Virtual Agent. However, online backups of these virtual machines are unsupported. Granular recovery of Dynamic Disk volume backups captured through the Virtual Agent is also unsupported. FAT32 Volumes - Virtual machines using FAT32-formatted VHDs can be protected using the Virtual Agent. However, online backups of FAT32 volumes are not supported. Other features, such as granular recovery of FAT32 volumes, are supported via the Virtual Agent.

For more information on these disk configuration types, please visit: http://technet.microsoft.com/enus/library/cc754747.aspx. Granular Recovery and Backups Stored to Tape GRT backups stored to tape media will be staged back to disk during GRT recovery operations.


For More Information Link

Description

www.symantec.com/business/backup-exec-for-windows-servers

BE Family Landing Page

www.symantec.com/business/products/whitepapers.jsp?pcid=pcat_business_cont&pvid=57_1

BE White Papers

http://support.veritas.com/docs/304175

BE in Large Environments

www.symantec.com/business/products/datasheets.jsp?pcid=2244&pvid=57_1

BE Datasheets, Solution Briefs

www.backupexec.com/compatibility

BE Compatibility Docs

www.backupexec.com/configurator

BE Product Configurator

www.backupexec.com/skugenerator

SKU Generator and BEST Tool


Backup Exec 2012 Agent for VMware and Hyper-V

Backup Exec 2012 Agent for VMware and Hyper-V

Suggest Documents

Symantec Backup Exec 2010 Agent for VMware Virtual ... - CDW

Symantec Backup Exec™ 2012 - CDW

Symantec Backup Exec™ 2012 Licensing Guide

Symantec Backup Exec™ 2012 V-Ray Edition

Symantec Backup Exec 2010 Agent for Microsoft SQL Server

Backup Exec™ 15

Backup Exec 11d Encryption Capabilities

Backup Exec 2012 Fundamental Guide - Tech Data Corporation

Backup Exec 3600 Appliance - Symantec

symantec backup exec 2012 manual pdf - Google Drive

Backup Exec 2012 Software Compatibility List (SCL) - Veritas

Symantec Backup Exec 2014: Administrator's Guide - Veritas

Backup copies: Symantec Backup Exec as an ... - Support OnLine

Backup Exec 15: Protecting Microsoft Exchange

Symantec Backup Exec™ 3600 Appliance - Arrow ECS

Symantec Backup Exec 2014: Administrator's Guide - Veritas

Symantec Backup Exec Recovery 2013 - extremIT

Designing Backup Solutions for VMware vSphere

Backup policies defined for VMware VMs

Designing Backup Solutions for VMware vSphere

Designing Backup Solutions for VMware vSphere

Symantec Backup Exec 2010 R2 Agent for Microsoft Hyper-V FAQ

Unitrends Enterprise Backup Deployment Guide for VMware

Designing Backup Solutions for VMware vSphere