Encrypted veeam configuration backup

Protecting Your Veeam Backup Server

Backing up the backups

Should you backup your backup server – hell yeah. If you suffer a site failure and want to start bringing things back the first thing you are going to need is restore your backup server. Veeam Backup and Replication provides this facility through Configuration Backups. Configuration backups dump out the information stored in the DB associated with Veeam to a flat file with a .bco extension

Default Veeam configuration backup settings

The good news is the that these config backups are enabled daily by default.  They will however run to the default backup repository which is held locally on the Veeam backup server. Obviously a key part of your recovery strategy will be ensuring you can cope with the loss of your backup server.

To view your current config backup setup, pull down the main menu and select configuration backup

Selecting configuration backup from Veeam main menu

In the below screenshot we can see an example config backup setup.  The choice of settings is simple frequency, number of restore points and backup repository.

Veeam configuration backup window

You can choose any backup repository as a target. So choosing a remote backup repository will ensure the config file is off sited. Your other option is to use a File Copy Job to ensure that you get two copies of the config and send one of these offsite. Just remember to keep a note of where your config backup is held in your DR plans.

If you have encrypted jobs or tapes in Veeam you will need to enable encrypt configuration backup. If you do not do this configuration backups will not run since otherwise the encryption keys in the config DB could be visible. The added benefit of encrypting config backups is that they will then include the details stored in the credentials manager.  This means that when you restore your backup server you will not need to re-enter credential information.

Encrypted veeam configuration backup


Other availability options

The backup server its self can be backed up as you would with any other VM.  The VM backup of the Veeam backup server can then be backed up to a an offsite repository, or offsited with a copy job.

Another option which would deliver the quickest recovery is that the backup server its self can also be in a Replication Job.

Final Thoughts

  • Start be thinking about what you are trying to achieve, what is the RPO and RTO for your backup server and remember to relate this to your main recovery objectives.  You will not be able to recover any servers until you bring back your backup server
  • Once you have considered what you are trying to achieve think which protection method you need to use from configuration backups, backup copies and replication jobs. Also consider that the protection methods are not mutually exclusive, you can use a combination of them.
  • Finally no matter which method you choose ensure that you document and test the recovery process