Fast LTA Silent Bricks

You will need to set up rotating drives as per this section of the help - https://helpcenter.veeam.com/docs/vbr/userguide/backup_repository_rotated.html?ver=13

Also if you need 5 backups and only 4 Saturdays them month end could be the fifth maybe?

Hi,

But I cannot set upthat rotated drives thing with S3 (each brick is a separate S3 share).

Regarding the saturdays: if there is no 5th one, whats with the copy job? Will it not run?

Chris, I bought your new book, find it very useful, like them for the former versions too. Great work. Thank you.

Regards,

Rene

Ah ok yeah the bricks being S3 would probably not work for rotated drives.  The copy job should still run as it will sort out the Saturday thing for you.  Like I said you can always use the monthly too in a pinch.

Thanks for the great feedback on the books.  I try to write them to help users. 👍😎

OK, thank you.

Another problem is, we do backups of our NetApp CIFS shares. But I can not add them to the backup copy job. I can add a secondary target, but then I can not schedule that weekly and select the silent brick for that week.

How can I solve that?

Rene

Maybe start a new topic for the NetApp CIFS question as I know there are NetApp people on the community.

Hi ​@ReneH 

do you have read help about Unstructured Data?
https://helpcenter.veeam.com/docs/vbr/userguide/unstructured_data_backup_copy_backups.html?ver=13

Had to look up Silent Brick’s offerings, for those not aware: https://www.fast-lta.de/en/products/silent-brick-system/software

​@ReneH , as others told we don’t support rotated mechanisms for S3 repositories currently, so your strategy here would likely be N Jobs for N repositories, and manual management of the jobs to ensure the correct one runs for the currently inserted brick.

As I see however that other export options (e.g., iscsi) are available, what was the main reason for picking S3 over the other options? With network shares for example, you could use the built-in rotated drive mechanism.

Out of curiosity, how’s the performance of the Fast LTA? How much data are you ingesting into it on weekly basis approximately?

Currently Unstructured Data backup copies are tied to the source job as you noted. Nothing to share on this changing, but we do want a more consistent experience on this.

We are just at the beginning of using this Fast LTA. About performance, I can tell you later.

From security view, we don’t want to integrate the Fast LTA into the domain. So we tried with a local user, but that didn’t work with Veeam VSA (we got some kerberos errors, see this thread 

https://community.veeam.com/discussion-boards-66/veeam-13-linux-appliance-and-smb-share-11641

 ) so we ended up with S3.

Another option may be use it as VTL, but I have only one server which I use as hardened repository, so I cannot add tape library via iSCSI here.

Rene

Got it, makes sense on all accounts.

SMB would require Kerberos, yes, and appreciate the caution in keeping the Fast LTA off domain, it’s practical idea.

NFS should not have this limitation, but understood that NFS is not always performant; hesitantly I suggest the idea of iscsi mounts to a Linux or Windows server and adding that as a managed server with deployment kits & creating a repository backed by rotated drives. I’m hesitant though as I don’t like the idea of the management overhead of ensuring the current brick gets mounted to the same path (Linux) or relying on Windows volume letters.

Linux repositories backed by rotated drives also have some limitations, so it’s not ideal solution.

With Windows, the detection works by searching the set backup repository path on all available volumes and looking for the jobs’ VBM files; if an older VBM is found, the job understands this to mean the drives have been swapped and follows the rotated drive logic.

But as noted, I’m not super keen on the idea of manually managing the iscsi connections as seems too prone to human error.

As for VTL, yeah Hardened Repository unfortunately is a no-go there, and further more Tape only works as a secondary target; if that is suitable for you, you can consider switching the current hardened repository to a normal Linux Repository with immutability in Governance mode; you will still get the benefit of immutability to prevent accidental deletions, but you will need to secure against an attacker getting root on the system as they would be able to remove the immutability bit.

Will be curious to hear what you end up choosing.

OK, interesting. The Linux repository is a standard Debian based server, with local disks. We added the mount point as hardened repository. It’s NOT the hardened repo ISO installation!

So, is that meant by “Governance mode”? Is there any possibility to add iSCSI VTL?

Regards,

René

Sure let me explain as it can be a little confusion.

Hardened Repository: Secured version of immutable repository where Veeam services do not run with any root permissions (save immutability service which has extremely limited functionality). No other services that require root privileges can be installed. Can be deployed from Veeam Infrastructure Appliance for a pre-hardened & secured server OR deployed as a self-managed server where the user is responsible for further hardening on their own.

Linux Immutable Repository with Governance: Self-managed Linux server with an XFS volume used to store data. Same immutability model as Hardened Repository, but no restrictions on Veeam services running as root, meaning other roles that require root permissions can be installed as well. Not considered “hardened” as too many vectors for an attacker to potentially get root access and remove immutability bits.

For self-managed servers, the Hardened part will show in the UI under Backup Infrastructure > Repositories; if the repository was added as “Hardened”, then it’s a hardened repository and adding other Veeam roles will not be possible. 

Governance Mode is kind of a fancy way of saying “immutable, but not as secure as it could be”, we’re borrowing terminology from Object Storage (compliance vs governance retention lock).

Hope that clears it up, easiest way for you to see what type of repository it is is check in the UI (Remote Console or WebUI), it will be very clear if it’s Hardened Repository.

Is there any possibility to add iSCSI VTL?

With Governance mode, sure. Install the necessary iscsi packages and then connect to the iscsi target. Linux will 99.9% guaranteed recognize the tape devices. Then from Veeam, add a tape server to the managed server, Veeam will install the tape proxy role and rescan the server to find the tape devices.