There are any commands that allow me to verify the integrity of the backup files?

cbaguzman

Hi, it's great to be back!

Until now, I've been performing backups on NFS media without the "Encrypt all new data sent to this remote" option and without the "Store backup as multiple data blocks instead of a whole VHD file." option. This allowed me to perform integrity checks on the backup files using a script that utilizes "vhd-cli check"and "xva-validate".

Now I need to change the backup methods by enabling "Encrypt all new data sent to this remote" and "Store backup as multiple data blocks instead of a whole VHD file.".

My question is whether there are any commands that allow me to verify the integrity of the backup files from the command line in this new scenario. I have VMs that are several GB in size, so using Auto Restore Check is not an option for me.

olivierlambert

Hi,

I was about to suggest to use backup health check but it seems you'd like to avoid it In this case, I don't really have an answer, maybe @Bastien-Nollet or @florent does.

Bastien Nollet

Hi @cbaguzman,

Currently there's no way of performing the vhd-cli check command on an encrypted remote, but this is also annoying for us and it shouldn't be too hard to fix, so I'll fix it.

Bastien Nollet

Hi @cbaguzman,

We just merged a PR that should allow you to use vhd-cli check on encrypted remotes: https://github.com/vatesfr/xen-orchestra/pull/9235

Please note that, as stated in the PR description, this PR changes the parameters you need to give to several vhd-cli commands, including the parameters of vhd-cli check. You can use vhd-cli check --help for details.

Here's an example of a command I ran on an encrypted remote:

vhd-cli check --chain 'file:///localRemoteEncryptedTEST?useVhdDirectory=true&encryptionKey=%2219876543210987654321098765432109%22' 'xo-vm-backups/695550e5-16e4-4728-6669-ac39e79f19e2/vdis/2656e4f4-efbc-47a6-95aa-0ba88632e545/7a1b144e-1ec8-44e8-9f5e-2d39119a228d/20251125T095729Z.alias.vhd'

b-Nollet opened this pull request in vatesfr/xen-orchestra

closed feat(vhd-cli): accept all types of remotes #9235

cbaguzman

Thanks @Bastien-Nollet and @olivierlambert .
I'm going to do some tests and write the results. Thank you so much.

cbaguzman

Hello @olivierlambert, @bastien-nollet, Hello Everyone !!

I used vhd-cli with its new arguments and it worked ok.

vhd-cli check --chain 'file:///run/xo-server/mounts/11934fec-f3a1-4f7f-a78d-00eeb1b39654?useVhdDirectory=true&encryptionKey=%22O1xt1ZTRE%5Qq%3X%3D1NZ%26%3ZZQo8%2DD%29s5xt%3OOko%22' 'xo-vm-backups/abc3e130-923e-619e-4fdc-59bcda088586/vdis/cecc4489-722a-4f79-b5e6-c050f63f2761/d489173c-028a-46f0-b712-f4a7c5594c8f/20260108T160552Z.alias.vhd'
ok: xo-vm-backups/abc3e130-923e-619e-4fdc-59bcda088586/vdis/cecc4489-722a-4f79-b5e6-c050f63f2761/d489173c-028a-46f0-b712-f4a7c5594c8f/20260108T160552Z.alias.vhd

But I discovered that using vhd-cli in this way only checks the physical structure of the alias.vhd file. It doesn't check the integrity of the blocks or the total number of blocks to detect a missing block. (It doesn't work like it does with huge monolithic .vhd files, where it detects errors with the slightest modification.)

So I opted to split the solution:

I check the integrity of the filesystem where the files are stored (using btrfs scrub).
I verify that the number of blocks written in the backup is correct (that no blocks are missing).
I verify that the written blocks haven't been modified since they were written.

For point 2, I found (AI) that I could use "vhd-cli info" to find out the total number of blocks in the backup (I don't have much information about it), but when I run it, I get the following error. I suspect it doesn't work with (Encrypt all new data sent to this remote):

vhd-cli info --chain 'file:///run/xo-server/mounts/11934fec-f3a1-4f7f-a78d-00eeb1b39654?useVhdDirectory=true&encryptionKey=%22O1xt1ZTRE%5Qq%3X%3D1NZ%26%3ZZQo8%2DD%29s5xt%3OOko%22' 'xo-vm-backups/abc3e130-923e-619e-4fdc-59bcda088586/vdis/cecc4489-722a-4f79-b5e 6-c050f63f2761/d489173c-028a-46f0-b712-f4a7c5594c8f/20260108T160552Z.alias.vhd'
✖ Unhandled remote type
Error: Unhandled remote type 
at getHandler (/usr/lib/node_modules/vhd-cli/node_modules/@xen-orchestra/fs/dist/index.js:48:11) 
at getSyncedHandler (/usr/lib/node_modules/vhd-cli/node_modules/@xen-orchestra/fs/dist/index.js:54:19) 
at Object.info (/usr/lib/node_modules/vhd-cli/commands/info.js:98:24) 
at Object.runCommand (/usr/lib/node_modules/vhd-cli/index.js:32:13) 
at /usr/lib/node_modules/vhd-cli/node_modules/exec-promise/index.js:57:13 
at new Promise (<anonymous>) 
at execPromise (/usr/lib/node_modules/vhd-cli/node_modules/exec-promise/index.js:56:10) 
at Object.<anonymous> (/usr/lib/node_modules/vhd-cli/index.js:41:1)

at Module._compile (node:internal/modules/cjs/loader:1706:14)

at Object..js (node:internal/modules/cjs/loader:1839:10)

Could you please help me with this? I'm not sure if I'm on the right track. Perhaps there are other ways I'm missing.

Bastien Nollet

Hi @cbaguzman,

I tested on my own and I got the same result as you, but then I realized the AI you used both tricked us into thinking that the --chain was a valid option for the info command (it's not).

I removed this option and the command worked properly.
Can you try the same command without this option?