Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better TogetherMike Resseler Veeam Product Strategy Specialist, MVP, Microsoft Certified IT Professional, MCSA, MCTS, MCP

2

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Introduction Protecting your infrastructure is a challenging task today. Old backup methods don’t work well in modern environments. These old backup methods worked for many years in the client-server model with lots of physical servers. But datacenters are changing and they are changing rapidly. New technologies have enhanced capabilities, which have dramatically changed the ways of supporting customers, end users and business.There are two main reasons why this change is occurring. Virtualization is the first reason. A few of years ago the concept of virtualization came into infrastructures. The idea behind virtualization is pretty simple: it is a way to get more out of the resources you have on physical servers. Instead of having one physical server for one workload, you can run multiple workloads within one physical box. In other words, you can run multiple servers on one physical server. While the idea itself is simple, its impact has dramatically changed the way IT environments run today. Over time, virtualization has grown in importance and is still growing today. At first, virtualization seemed targeted for a niche market, and data protection of virtual machines (VMs) was carried out in the traditional way (i.e., Bare Metal Restore), as it was for all other servers. Today, virtualization is the norm. The technologies have become mature and are increasingly being used in every size of business. Management tools have developed also and, with that, the second reason comes into sight.The private cloud is the next reason why protecting data has become more challenging. Thanks to the private cloud many businesses are now introducing principles such as self-service, elasticity and more into their datacenters. While this is a good thing for end users and customers, it also brings increased agility to the business. However, it is becoming a tremendous challenge for IT professionals around the world who are trying to protect their infrastructures and business data in ways that are affordable and non-complex.

The challengeThe new ways of designing datacenters present new challenges and difficulties to IT professionals. One of these challenges is backup and data protection. As already stated, we used to protect every server’s data and system state and, in some cases, even the entire system through the concept of Bare Metal Restore. Virtualization has changed this, because it allows IT professionals to rapidly create new VMs without the backup team even knowing that there are new servers in the infrastructure. With the introduction of the private cloud and its principles, data protection, roles

3

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

and responsibilities have become more difficult. Now customers and end users can create their own VMs, including data that needs to be protected. The private cloud is provided by the internal IT staff, but there is a great new challenge addressing the location of self-service data.

Who needs data protection? There may be a perception that you don’t need data protection anymore. In fact, many IT Professionals are complaining that they need to provide good reasons to keep their datacenters protected.As decision makers are spending a lot of money and effort in today’s resilience systems—such as clustering, replication, taking snapshots on their shared networks, hardware virtualization and more—they wonder if they still need backup when they are already protected with all those other technologies.While these are great defense systems that will keep your systems up and running as much as possible, they will not protect you against other issues, such as: • data corruption• major natural disasters• equipment failure• theft or human errors• malware • facility or site-related failures• platform failures (storage, operating system or networking)In short, you still need a good backup plan, a disaster recovery plan and, most important, a good recovery plan.

Choosing the right strategy for the right technologyMany years ago I had one backup solution to protect my entire environment. The data on every server in my environment was protected and at the same time there were backups of the system state of those physical boxes. Taking backups required us to have backup windows at convenient times and we needed many hours during the workweek to check our backups. Best practices at the time required us to test backups at least once a year to see if the data was recoverable—this procedure could take days. And recovering a system state from a server to new or other hardware, when necessary, could be a very difficult task.Virtualization technology has provided new ways of protecting servers and workloads. Instead of protecting system states of physical servers, you can now protect an entire VM and recover it to any other host. This flexibility gives IT professionals more options for creating disaster recovery plans and a means to test the plans at regular intervals.Backup and recovery technology has also dramatically improved. There was a time that the prevailing logic was to back up or otherwise provide data protection directly to tape. Then, disk technologies started to be used in a data protection context, providing new options. This improved backup times and allowed fast recovery. New technologies such as VSS (Volume Shadow Copy

4

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

services) meant that consistent backups could be performed any time of the day without interrupting the day-to-day service of that system.Backup software that’s specifically built for virtualization also gives you additional restore capabilities, and this is central to this white paper.

The strategyIn this white paper, I introduce a strategy that leverages two solutions. One solution provides a protection strategy at the virtual infrastructure level while the other solution uses an in-guest agent to protect specific workloads such as SQL, Exchange, SharePoint and more. Together, the two solutions provide a great protection solution with near continuous backup, quick recovery possibilities and an easy way to build a disaster recovery plan.

An exampleTo explain this strategy, I will work with an example infrastructure to show the enhanced protection options available with the two solutions together 1.

Figure 1: Architectural overview of the example

This example contains four physical servers. Three of these servers are running Windows Server 2012 with Hyper-V enabled as a role. The three servers are clustered and attached to a Storage Area Network (SAN), which runs the CSV² for the cluster.The fourth physical server will host Veeam Backup & Replication™. The example virtual infrastructure consists of:• Two Active Directory domain controllers (DC01 and DC02) that are not

permitted to run at the same hypervisor because of the anti-affinity rules• One SQL Server (SQL01) system that hosts production databases, which

provide the following critical services:

1 This is an example. Exact configuration and use cases depend on the business requirements.² CSV: Clustered Shared Volume: A shared disk containing an NTFS volume that is made accessible

for read and write operations by all nodes within a Windows Server Failover Cluster.

5

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

- DB_ERP (a database for the ERP software) - DB_WAGES (a database that holds the wages information for the

employees) - All the SharePoint databases

• Two Exchange Server systems (EXC01 and EXC02) that are configured in a DAG³ configuration

• One SharePoint front-end server (SHAREPOINT01)• One webserver (WWW01) that holds a few .NET applications that have their

databases running on SQL01• One Data Protection Manager server (DPM01)• One virtual server with a pass-through disk⁴ (PASSTHROUGH01)• One physical server with a legacy application (which can’t be run virtually) on

(LEGACY01)Although this is a small environment, it serves as a good example to identify the criticality of important components typical in many infrastructures. And now for the basics of the two solutions:

Virtualization backupsVeeam Backup & Replication is a Modern Data Protection™ solution Built for Virtualization™ that delivers powerful, easy-to-use and affordable data protection for both VMware and Hyper-V. Veeam Backup & Replication talks directly to the virtual infrastructure, providing advantages such as:• Knowledge of the VMs and the hosts they run on• Knowledge of the virtual storage and what needs to be protected• The ability to snapshot VMs and back them up with no downtime• The ability to protect only the VM disk blocks that have changed, reducing

the backup times and the amount of data backed up.Veeam Backup & Replication doesn’t require an agent and talks directly to the virtualization layer. In fact, Veeam was the first backup vendor to support VADP (for VMware) and uses Microsoft VSS technology to create consistent VM backups.

In-guest data backupsAlthough Veeam Backup & Replication is Built for Virtualization, in-guest backups are sometimes needed. Imagine that you have a SQL Server running in your infrastructure. The SQL administrators might need a backup as frequently as every 15 minutes and the ability to recover the data themselves. This use case may be better suited to a solution that is built specifically for this kind of

³DAG: Database Availability Group: A clustering technique introduced in Exchange Server2010.⁴ Pass-through disk: A way of providing a VM direct access to a disk, skipping the virtualization file system.

6

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

scenario. Microsoft’s System Center Data Protection Manager (SCDPM) is a protection solution that is known for its excellent capabilities of protecting SQL Server, Exchange Server, SharePoint Services and more.

Figure 2: SCDPM 2012 SP1 general overview

SCDPM uses an agent inside a VM to talk to VSS writers, a component of Microsoft VSS technologies. This allows the solution to protect the data to disk as often as every 15 minutes. SCDPM can also protect to tape, a secondary SCDPM server or the cloud.

An SCDPM strategy with VeeamOur example takes some considerations into account. The business requires specific SLA⁵, RTO⁶ and RPO⁷ deliverables:• SLA: Data from Exchange, SQL or SharePoint should be recovered within four

hours after the request in the help desk system• RTO: In case of a failure, the most critical systems (email, SharePoint and SQL)

should be up and running in 24 hours• RPO: In case of a disaster, the maximum loss of data is one hourThe above deliverables assume that replacement hardware is available and already has the operating system and hypervisor running.Many things need to be taken into consideration for recovery after a disaster—passwords for administrators and service accounts, the ability to provision servers, the availability of Internet lines and software installation media and more. This scenario starts from the point where an environment is ready to recover and

5 SLA: Service Level Agreement is a part of a service contract where a service is formally defined.6 RTO: Recovery Time Objective is the time that a process must be restored after a disaster.7 RPO: Recovery Point Objective is the maximum amount of time in which data may be lost.

7

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

all items are available to start recovering.

Let’s start protectingBy combining Veeam Backup & Replication and SCDPM solutions, IT professionals have an excellent protection strategy that allows fast recovery, almost zero data loss and a great disaster recovery method.

Protecting VMs with Veeam Backup & ReplicationAfter setting up the Veeam Backup & Replication server, the next step includes site-specific configuration: adding the hypervisors to the backup infrastructure, adding backup repositories and adding backup proxies. After the configuration is

ready, you can create the job.Figure 3: Overview of our backup infrastructure

In the example, you will protect all the VMs in one job and schedule it daily at 10 p.m.

Figure 4: Scheduling options

8

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Because you’re using SCDPM to protect select critical application workloads inside the operating systems of individual VMs, you need to be certain that Veeam Backup & Replication won’t truncate the logs. Within the VSS framework, only one backup solution is permitted to truncate critical application logs. Because SCDPM will perform the workload protection every 15 minutes, it will manage log truncation.Therefore, in the backup job, it’s necessary to change the guest processing options so that they don’t interfere with the log truncation.

Figure 5: Guest transaction log settings

Now you have a backup job of the entire VM stack on a daily basis. At this point, there is robust application protection with SCDPM (discussed later) and all VMs are protected as an image with Veeam Backup & Replication. This leads to a number of different restore capabilities, delivering the most options in recovery scenarios.

Protecting in-guest data with System Center Data Protection Manager 2012 SP1Now that all the VMs in the environment are protected with Veeam Backup & Replication, you will need to configure the in-guest data protection with System Center Data Protection Manager 2012 SP1 for select critical applications.First, it’s necessary to perform some installation and configuration actions:• Install SCDPM 2012 SP1 on the server • Add storage to the storage pool • Deploy agents to the virtual machines After completing the above actions, one or more protection groups need to be created to define the rules for protecting the data. Creating a protection group defines the RTO and RPO settings and length of the retention period. It also defines how many times a backup will be taken of the data.

9

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Figure 6: Retention, Synchronization and Recovery Points settings

• In the example, a specific protection group is created for protecting SQL databases that has retention of five days and a full recovery point three times a day. And the closed logs⁸ have been synchronized (every 15 minutes to the DPM server for a possible recovery point every 15 minutes).

Protection groups need to be created for all of other workloads that run in the environment. In this example, protection groups are created to protect the file server data, Exchange databases, the system state of an Active Directory domain controller, the SharePoint data and configuration and the websites on WWW01 (through system state)There are still a few more things to protect. One of the VMs (passthrough01) has a pass-through disk attached, which makes it impossible to protect with Veeam Backup & Replication. Therefore, this VM will be threaded as a physical server. And a protection group will be created in SCDPM to protect this server with the Bare Metal Recover (BMR) option.Note: The Windows Server Backup feature must be enabled to do this!

Figure 7: Server protected with Bare Metal Recovery and system state

BMR (which automatically includes system state) will protect all of the critical volumes. A critical volume refers to the volumes present on the system, which contain the operating system (OS) and other files that are essential for the OS to function properly.

8 Closed logs: SQL Server will close a log when it hits a certain size (adjustable). Those log files are transferred to the SCDPM server. It is the same principle used in SQL Server log shipping.

10

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

In addition to the BMR, the specific data needed to recover the application running on the Passthrough01 server will be protected. In the example, this will be the entire volume that represents that disk that will be protected.Finally, the last protection group that will be built is for the legacy physical server (legacy01). Since this is a real physical server, the strategy will be exactly the same as for the virtual server with the pass-through disk (passthrough01).

Recovery possibilities with VeeamNow that the setup is complete and all of the VMs are protected through Veeam Backup & Replication and the specific data residing on those VM machines is protected through SCDPM, I will explore the recovery options.

VM recoveriesVeeam offers a number of different recovery techniques for VMware and Hyper-V environments, including Instant VM Recovery™, full VM recovery, as well as recovery of VM files and guest files. There are additional specific recovery options for applications, storage integration and web technologies.

Figure 8: Recovery options for Hyper-V

A quick explanation on the different recovery methods:• Instant VM Recovery enables you to instantly start a VM directly from a

backup file without retrieving it to the production storage before using the recovered VM. The data is transferred to production storage at the end of the recovery process, after the VM is up and running.

• Full VM Recovery enables you to recover a VM from a backup file to its original or another location.

• VM file recovery enables you to recover separate VM files (virtual disks, configuration files and more).

• Windows file-level recovery enables you to recover individual Windows guest OS files (FAT, NTFS and ReFS file systems) from backups. Linux and other operating systems are supported for file-level recovery on VMware only.

11

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Two of these recovery options will fit our purpose very well. There are many other use cases for recovering VM files or guest files. I focus here specifically on the recovery of a Full VM and on Instant VM recovery

Full VM recoveryWith full VM recovery you can restore an entire VM from a backup to the latest state or to any good known point in time.

Figure 9: Choosing your recovery point

This means that you have to extract the full virtual image from the production storage. Veeam Backup & Replication will retrieve the data from the backup repository to the selected storage, register the VM on the chosen host and (if necessary) power on the VM.

Figure 10: Choosing your restore mode

12

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Instant VM RecoveryWith Instant VM Recovery you can immediately restore a VM into your production environment by running it directly from the compressed and deduplicated backup file. Instant VM Recovery helps improve the RTO and minimize disruption and downtime of your production VM. With this process you can start a failed VM very quickly and migrate it to the production storage.

Data Recoveries in SCDPMSCDPM 2012 SP1 offers a lot of recovery methods for specific workloads, such as Exchange and SQL Server. This part describes a few recovery methods specific to SQL Server. Recovering SQL Server data provides a few options;• Recover the database to its original location• Recover the database with a new name to its original location or to a different

instance of SQL Server• Recover the database to a different instance of SQL Server• Copy the database to a network folder

Figure 11: Recovery options for a SQL database

Some of these options are useful for specific scenarios like copy the database to a network folder. This gives SQL administrators the database (and log files if this is not a recovery from an application recovery point) as flat files, allowing admins to move the database to other SQL instances or use the database in testing scenarios. Recovering the database with a new name or to another instance can also be useful for testing scenarios or when you want to find out if you have recoverable backups. The example mainly focuses on the option to Recover to original instance of SQL Server (Overwrite database).This option allows recovery of the full database every 15 minutes for the last five days (remember the settings for synchronization, recovery point and retention in the previous section on Protecting our in-guest data with SCDPM 2012 SP1.).

13

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

You can recover the database and place it into one of two modes: operational or non-operational. Operational means that the database will be running after the recovery and no further action from the SQL administrators is necessary. Leaving the database in non-operational mode allows the SQL administrators to do application-specific recovery with native administrative tools, like SQL Server Management Studio. This is certainly a great feature when the SQL admins request a specific Point in Time. You can recover the databases and the logs and the SQL admins can work in SQL Server Management Studio.

Figure 12: Database state options during recovery with SCDPM

You now know how to recover specific workloads. The next part demonstrates how easy it is to recover an entire server with Veeam Backup & Replication and recover the latest application data on it. But you still need to be able to recover the physical server (legacy01) and the VM that was treated like a physical server (passthrough01).Since the application data is included in the protection group, you can easily restore that data exactly as for SQL or Exchange or others. But when you need to recover the full server, there is some more work to do.A good walkthrough guide to document your recovery process can be found here: http://blogs.technet.com/b/dpm/archive/2010/05/12/performing-a-bare-metal-restore-with-dpm-2010.aspx⁹

9 This guide is for SCDPM 2010 but is still valid for SCDPM 2012.

14

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Building a disaster recovery planNow that you’ve learned about the two protection methods, think back to the example and think about a few scenarios in a disaster recovery plan.Here are two important, high-level scenarios:• Losing the datacenter• Losing one important VM

Losing the datacenterIn this scenario, there is a huge disaster and none of the crucial VMs are running. After doing the initial work, such as making sure there are hypervisor hosts and rebuilding the backup and replication server, you are ready to recover the entire infrastructure.The first step is to recover all the VMs back to the hypervisor hosts. In this case, start recovering the VMs in the following order¹⁰:• DC01 • EXC01• SQL01• WWW01• SHAREPOINT01• DC02• EXC02Leveraging Veeam Backup & Replication, you will have the entire datacenter up and running very quickly. This will depend on the backend storage, network throughput and other parameters, but in the end, you will have a running datacenter with almost no manual work.

Figure 13: Restore job

10 This order is based on what the business has defined as crucial data first. This can and will be different in your scenario.

15

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

After one of the VMs has been recovered, there may be an issue that the data running on it is 24 hours old and does not meet the SLAs and RPOs previously covered. With SCDPM in-guest backups, you can restore the latest data (worst case scenario 15 minutes) to the VM just recovered. The good part is that you don’t need to do any additional work. Because you took a full VM backup with Veeam Backup & Replication, the in-guest agent used by SCDPM is running in the recovered VM. Therefore, you can start recovering the data straight away as discussed earlier in the section on Data Recoveries.And this procedure can be started from the moment that one VM has been recovered. The following diagram illustrates this parallel workflow:

Figure 14: High-level overview of the DR plan

As you can see in the workflow (Figure 14), you can perform multiple recoveries at the same time with a maximum data loss of 15 minutes. For the purpose of this white paper, it is important to note that different methods and options need to be chosen to perform this kind of recovery across different applications. The VM image is well protected and easily recovered with Veeam Backup & Replication, and if critical applications need frequent recovery options, SCDPM makes that an easy task. While this seems like a very easy workflow, some of the recoveries might require some additional tasks. These things should be tested upfront before there is a real disaster. The Virtual Lab in Veeam Backup & Replication offers an easy way to do this.

16

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Finally, you need to perform Bare Metal Recovery of the two servers as discussed in the section on Data Recoveries in SCDPM.

Losing one important VMLet’s say that in this example the SQL Server is corrupted. After investigation, you decide that repairing the corruption will take too much time and you will probably not be able to fix the issue. In that case, you want to recover the entire VM and afterward recover the latest data. In the worst case scenario, you will lose 15 minutes of data—well within the limits of your RPO.The scenario here is pretty simple. First you will use Veeam Backup & Replication to recover the full VM from the latest recovery point. When that recovery is finished and the machine is back up and running, you are facing the issue that the data is 24 hours old in the worst case scenario. Because of the RPO, you jump to the SCDPM server and recover the latest SQL data to the recovered VM. Because the recovered VM has the same settings, name and UUID as the original VM, DPM will instantly recover the database(s) and files to this server.

Figure 15: Recovering the latest SQL data

Great advantages with this solutionBesides the ability to create great disaster recovery plans or attack any major failure in the datacenter, you can do a lot more with those two solutions. There are many additional recovery scenarios, including Veeam’s replication, U-AIR® and more.One of the advantages is Veeam Explorer™ for Microsoft Exchange. This feature gives you instant visibility into your Exchange backups. You can browse, search and selectively export items (such as emails, contacts, notes and more) directly from Veeam backups of your Exchange VMs.

17

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Figure 16: Veeam Explorer for Exchange

All the different workloads that are protected with SCDPM can be recovered in multiple ways as with the SQL options. This provides you with easy testing options and additional recovery options.For example, with SCDPM you can work with a secondary server that will give you additional DR scenarios and more flexibility when Murphy’s law hits you.

Veeam Backup & Replication with System Center Data Protection Manager: Better togetherWhile no two virtual environments are created equal, as an IT professional, you can take a modern approach and deliver robust protection options for your virtual infrastructure and critical applications. Veeam Backup & Replication with System Center Data Protection Manager allows you to do just that. Find out more at www.Veeam.com.

18

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Additional informationSystem Center Data Protection Manager 2012 SP1• Technical documentation library of System Center Data Protection Manager

2012 SP1: http://technet.microsoft.com/en-us/library/hh758173.aspx• System Center library: http://technet.microsoft.com/en-US/systemcenter/

hh880681• SCDPM general page: http://technet.microsoft.com/en-us/systemcenter/

hh315834

Veeam Backup & Replication• Veeam Backup & Replication overview: http://www.veeam.com/vm-backup-

recovery-replication-software.html• Hyper-V backup with Veeam Backup & Replication: http://www.veeam.com/

microsoft-hyper-v-server-backup-recovery-replication.html• VMware backup with Veeam Backup & Replication: http://www.veeam.com/

vmware-esx-backup.html• Veeam Backup & Replication resources: http://www.veeam.com/vmware-esx-

backup/resources.html

19

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

About the AuthorMike Resseler is a Product Strategy Specialist for Veeam. Mike is focused on technologies around Hyper-V and System Center. With years of experience in the field, he presents on many occasions at large events such as MMS, TechEd and TechDays. Mike has been awarded the MVP for System Center Cloud and Datacenter Management since 2010. His major hobby is discussing and developing solid disaster recovery scenarios. Additionally, he has enterprise-class experience in private cloud architecture and deployment, with marked focus on protection from the bottom to the top. He holds certifications in many Microsoft Technologies such as MCITP.

Follow Mike on @MikeResseler or @Veeam and on Google+.

About Veeam Software Veeam® is Modern Data Protection™. We believe today’s IT requirements have changed and that “3C” legacy backup problems—high costs, increased complexity and missing capabilities—are no longer acceptable for any organization. Veeam provides powerful, easy-to-use and affordable solutions that are Built for Virtualization™ and the cloud—a perfect fit for the modern datacenter.Veeam Backup & Replication™ is VMware backup, Hyper-V backup, recovery and replication. This #1 VM Backup™ solution helps organizations meet RPOs and RTOs, save time, eliminate risks and dramatically reduce capital and operational costs. Veeam Backup Management Suite™ combines Veeam Backup & Replication and Veeam ONE™ in a single integrated solution to protect virtualization investments, increase administrator productivity and help mitigate daily management risks. Veeam Management Pack™ (MP) extends enterprise monitoring to VMware through Microsoft System Center. Veeam also provides free tools for the virtualization community.Learn more by visiting http://www.veeam.com.

20

Microsoft System Center Data Protection Manager and Veeam Backup & Replication – Better Together

Modern Data ProtectionBuilt for Virtualization

Powerful

Veeam Backup & ReplicationEasy-to-Use

To learn more, visit http://www.veeam.com/backup

#1 VM Backup for VMware and Hyper-VVirtualization changes everything – especially backup. If you’ve virtualized on VMware or Hyper-V, now is the time to move up to the data protection solution Built for Virtualization: Veeam Backup & Replication.Unlike traditional backup that suffers from the “3C” problem (missing capabilities, complexity and cost), Veeam is:

Join the 58,000 organizations who have already modernized their data protection with Veeam. Download Veeam Backup & Replication today!

Powerful: Restore an entire virtual machine (VM) or an individual file, email or database record in 2 minutes

Easy-to-Use: It just works!

Affordable: No agents to license or maintain, works with your existing storage, and includes deduplication, VM replication, Microsoft Exchange recovery, and more!

GOLD AWARDNEW

TECHNOLOGY

GOLD AWARDNEW

TECHNOLOGY