What would you change, if anything, in this backup system design?

[localzuk]

I am currently working on a new backup design for our trust, as the current mix of backup solutions is a mess and I am not confident that everything would be recoverable at all schools. So, I've designed a relatively simple setup to handle it instead. What I would like is to get some input from others as to what they think of this setup?

 

1. All schools have their data replicated to our central site using DFSR.

2. The data from 1 is replicated into a virtual machine for each school.

3. Every night we do a differential backup using Veeam, onto a NAS hosted at the same site, but in a different building.

4. Once that backup has completed, the data is duplicated over to a secondary site to a NAS at that site via our WAN.

 

As both the central and secondary sites are schools too, I figure the above would mean we have at least 1 off-site copy of all data for each school at any one time.

 

So, any thoughts?

[hallb15]

That's very similar to what we do, but on a much smaller scale as we are only one school, but with two buildings. We use Altaro but the principle of backing up to NAS and duplicating to another NAS in the other building is the same. We also backup the most important data to the cloud via Attix5 Pro nightly.

[NB9457]

I'm still a fan of tapes, so if somehow everything somehow when pear shaped, we still have weekly and monthly tapes as well as a NAS backup and DPM server.

[john]

Have you thought of De-duplicating backup devices over a standard NAS and DFSR as the issue with DFSR is if its a lot of data and it freaks its a pain to re-sync. A De-duplicating backup device will do very clever things so you may find that a lot of your data is duplicated and not needed anyway so saves bandwidth and space needed

 

You can get items such as Data Domain, they do a Virtual appliance edition which is very keenly priced, and they support replication and are licensed by front end TB's so bash one of them in each site and one in the main one and set the jobs to rep back to the main site and your main site one back out to one of the edges? They support Veeam and other software suites and we were very impressed at how good it was the glossy sales brochures and claims from sales really were true in this case it hands down beats the competitor product we moved from to it.

[localzuk]

The DFS bit is actually a short term thing. When we migrate our network over to its new design, all data will be centralised, with DFS working in the opposite direction (and only for user data itself). All actual data will be centralised and deduplicated during backup on the local site.

[mavhc]

I'd make the data stores ZFS, raidz2 for disk duplication, then use zfs send/zfs receive for duplication to other computers/sites. Central machines can be specced high enough to use compression and deduplication if that's worth the cost in cpu/ram

[DavidYoung]

If you're using Veeam have you considered a Server 2016 box with ReFS instead of NAS boxes? Should be about the same cost but apparently you get massive space and performance savings, allowing you to keep full backups going back a very long way.

 

Also, I would add in some form of offline backup, even if it is as simple as a USB3 drive sitting on top of the NAS/Server which gets rotated each day/week. With all the stories of Ransomware and also the possibility of internal attack (either from staff or, more likely a student with compromised admin creds) that could be a potential job-saver.

[pete]

How much data are we talking about in 1) initially and how much churn is there?

 

In the eventual plan (everything centralised and pushed across the WAN (riverbeds?) to other schools):

 

a) How much of an impact would losing the central site (say a fire in the server room, JCB through your fibre) be to day-to-day operations of the other schools?

b) Can the secondary step up as the backup site for the other schools until the central site gets up and running? Do the remote schools have onsite backup as well, or are they relying on the central site for backup and restore?

[DrCheese]

Keep your veeam machine off the domain - This ensures if you get ransomware it's unlikely it can touch it.

Also, ensure you have an airgapped backup of some kind for the same reason (I have tape)

 

Lastly, test your backups! If you have a spare PC around you can use surebackup in veeam to automatically mount the backup files & do tests on the VMs. If you have backups on tape, do an occasional restore to check.