Multiple Backup Locations

[jHorrocks]

I have a question regarding my backups from pve1 to pbs1 and to pbs2.

I backup 6 VMs to pbs1 daily, it does this very quickly all ok. If I keep backing up to this server only, my backups are quick but when I back up to pbs2 its slow the first time due to me doing it only once a week which I understand has many changes but the issue then is after backing up to pbs2, backing up back to pbs1 is now slow the 1st time i do it.

pbs1 daily backup
pbs2 weekly backup

(Times below are approx)

1st Backup to pbs1: 4 hours
Backup 2 to pbs1: 25 mins
Backup 3 to pbs1: 25 mins
Backup 4 to pbs1: 25 mins
Backup 5 to pbs1: 25 mins

Switch to pbs2
1st Backup to pbs2: 4 hours
Backup 2 to pbs2: 25 mins
Backup 3 to pbs2: 25 mins
Backup 4 to pbs2: 25 mins
Backup 5 to pbs2: 25 mins

Then switch back to pbs1
Backup 6 to pbs1: 4 hours
Backup 7 to pbs1: 25 mins
Backup 8 to pbs1: 25 mins
Backup 9 to pbs1: 25 mins
Backup 10 to pbs1: 25 mins

Is it because each VM keeps a backup log to compare changes and when i switch from pbs1 to pbs2 it destroys the log changes so has to start all over again creating a log file?

If this i the case, is it possible to create a log file for each backup set and not the VM?

Another option if all the above is wrong, should i just sync the backups between the 2 pbs servers?

 

[Dunuin]

Once you reboot a PVE server, restart a VM (which also includes doing a stop-mode backup which will reboot the VM) or change the backup target the dirty-bitmap will be dropped and PVE will have to read and hash the whole virtual disks again.

Solution for that would be to make sure never to reboot the server, restart the VMs, to only use snapshot-mode backups and to do all the backups to a single PBS and then use the sync job of the second PBS to pull the backups from the first PBS.

So do both your weekly and daily backups to pbs1. Then tell pbs2 to pull the backups from pbs1.

 

[jHorrocks]

Very clear and detailed answer, this is great info... thank you so much... Really appreciate it.

 

[ogghi]

Hi there, I hope it's OK for me to attach a question here!

I have a single PBS installed here, with 2 data stores (NFS mounts).

The issue is that the bitmap is always cleared as those are 2 separate jobs. Is there any way to avoid this?

 

[Dunuin]

The issue is that the bitmap is always cleared as those are 2 separate jobs. Is there any way to avoid this?

Always backup to a single datastore and then use a local sync job to copy the backup snapshots from that datastore to the other one.

 

[ogghi]

So basically setting up this: https://pbs.proxmox.com/docs/managing-remotes.html#sync-jobs
?

 

[Dunuin]

Yes, that's the workaround.

 

[Matrix9688]

Wouldn't it be possible to have seperate bitmaps for different backup jobs? I understand losing the bitmap when powering down the VM, but I would assume it to be technically possible to maintain multiple bitmaps. Are there serious downsides to it?

For context:
I would like to have an unencrypted backup of my VMs on a local PBS server, and an encrypted backup of the same VMs on a remote offsite PBS server. Sync jobs, as I understand it, are not capable of encrypting - it needs to be set in the storage options on the PVE datacenter.
I could just encrypt both backup targets and use a sync job, yes. But then there's the problem that PBS currently can't push sync jobs - it can only pull (see relevant feature request here), so I would need to punch holes into my firewall if I want to sync to an offsite target - something I would rather avoid.
So my workaround (until the sync-push-feature has been added) would be to just have two backup jobs, one local, one remote. And this would be more efficient if both could use the dirty-bitmap feature, I would guess.

 

[VictorSTS]

I think I've read something about a feature request to have an independent bitmap for each backup storage, but can't seem to find ATM. Don't remember if it is doable or not. Currently the dirtymap is related to PBS and PBS may invalidate the dirtymap if verification fail. It's explained here alongside a whole lot of info related to dirtymap handling [1].

Regading syncs, I do prefer the current pull sync: if I get an intrusion in my main site, there's no way the attacker can reach my remote PBS using my network at least the attacker will have to find a way to attack the remote site too as there is no way to reach it from the main site.

Would also love to have a way to make PBS encrypt data when syncing, although that means exposing the encryption key in either the local o remote PBS, making it vulnerable in case of an attack to the PBS itself.

[1] https://forum.proxmox.com/threads/full-backup-of-vm.107093/#post-544684