Delta Backup Changes Report?
-
Is there a way to get a report of the changes in a Delta Backup? Some of my VMs are having larger than expected deltas and I'd like to try and figure out where the changes are coming from.
-
@CJ XO wouldn't be the place to look for this information, you would want to implement a SIEM and monitor for changes like that.
Or something like Liongard, which is a cloud / agent component which records all changes to the system for security purposes.
-
The reason you wouldn't want to look at XO for this from a technical standpoint is because XO works at the hardware level of the hypervisor, dolling out resources to different VMs and creating backups.
You need to look at the content within a given VM and compare the file system difference from points A and B.
Only something that is operating within the file system would be able to readily tell you "Something has changed".
Odds are you have a user or several who are dumping files onto a share that they shouldn't be, or are replicating some cloud service to keep a copy on your server etc.
-
@CJ
I did already think about such a feature. Veeam is doing something like that. If backup time or backup size is much bigger / smaller, than the average of the last three runs, a notification is triggered.I think, this could be possible by parsing the backup logs through REST-API and to analyze them, but I did not yet start to try it...
-
This feature is already planned
(but in the backlog so far) -
FYI, we discussed than with @florent few months ago
-
@KPS A notification would be handy, but I'm mainly just looking for a way to manually tell. A simple list of changed files and size delta would work.
I don't want to do a whole third party agent such as suggested by @DustinB as the issue isn't caused by the typical cases he listed. One of the VMs is Windows and spends 90% of it's time idle. I'm assuming the large deltas are caused by various background updates but it would be nice to know for sure.
@olivierlambert I'm glad to hear it's on the roadmap.
Vates has been pretty responsive IME so I look forward to it's eventual rollout. -
Looking through things, I think I've determined part of the reason for the larger backups. When I turned on memory snapshots that means that the memory is now getting saved as a separate VHD and then transferred.
Is it possible for the backup job status to provide more information regarding memory vs actual disk parts of the snapshots? For example, the cleanup task now shows two unused VHD, which I assume is the separate memory and disk VHD for the snapshot.
