Day 39

Taking Backup and Restoring Files

TSM Backup and Restore Functions Overview

TSM Client backups generally are scheduled events. Occasionally, you also need to back up objects manually. There are 3 different ways to take the backup of client files.

Backup Overview

BA Client GUI

To start the GUI, use one of the following methods

• On Windows: Either click Start > Programs, or enter the dsm command from a system command line.

• On UNIX: Enter dsmj from a system command line.

• On a web client: Use port 1581 and a supported web browser.

After logging in to the GUI, follow these steps to take the backup

1. Select Backup from the GUI main window.

2. Expand the directory tree to see folders and files.

3. Select objects to back up.

4. Select the type of backup from the Select Action menu:

• Incremental (complete)
• Incremental (date only)
• Always backup
• Incremental (without journal)

5. Click Backup.

While the backup is running, the Backup Report window opens, showing the progress of your backup. When the backup finishes, the window shows the results of the backup.

Using the command line for backups

With the backup-archive command line, you have more options to back up and restore data. More than one method invokes the same command line. Options that are available to this command include DOMAIN, PASSWORD, COMPRESSION, and QUIET/VERBOSE. 

All options on the command line override the options that are specified in the configuration options file except the domain option, which adds to the options file domain option. The file specification filename parameter is different than the -DOMAIN= option. The file specification filename parameter overrides the domain option in the configuration options file.

To take backup using command lineFirst, change directories to the backup-archive client. Use dsmc command to start a backup from the system command prompt or command line. The syntax for the command line is as follows

dsmc action keyword –option=value file_name 

When you run an incremental backup on the command line, the results show the details from start to finish.. For example, to perform an incremental backup of the /home/project/2013/lab24.txt file, use the following command

 dsmc Incremental /home/project/2013/lab24.txt

Alternatively, you can start the backup-archive command line and perform the same command as follows

tsm> i /home/project/2013/lab24.txt

Performing selective backups

The selective command backs up files that you specify. If these files become damaged or lost, you can replace them with backup versions from the server. When you run a selective backup, all the files are candidates for backup unless you exclude them from backup, or if they do not meet management class requirements for serialization.

To back up all of the files in the d:\proj directory, use the selective command as in the following example

   dsmc SELective d:\proj\*

To include all subdirectories for the same backup, use the following command:

   tsm> sel -subdir=yes d:\proj\*

Using the QUERY FILESPACE command

Issue the Query Filespace command from the backup-archive command line to see whether the Last Incr Date shows that a recently run incremental backup finished successfully. The query filespace command shows a list of file spaces in Tivoli Storage Manager storage. You can also specify a single file space name to query.

Restore overview

Restore is the process of copying a backed up version of a file from the Tivoli Storage Manager server to the client system over the specified communication method. Tivoli Storage Manager server sends a copy of the file to the client, but the backup remains on the server. You can use the following options

• Do restores through the GUI, client command line, or through a schedule.

• Restore files to a location other than where they are backed up.

• Restore backed up files to their state at a specific point in time.

• Replace or overwrite existing files with the restored version.

• Select specific files and directories to restore.

If a file is damaged, the user (Tivoli Storage Manager client) can request that the system restore the current or a specific backup version, without the aid of an administrator. A user can restore only files that the user backed up unless the user has authority to access the backup files that belong to another person. If you do not specify a destination, the files are restored to their original location.

When a user restores a backup version of a file, Tivoli Storage Manager sends a copy of the file to the client node. The backup version remains in the Tivoli Storage Manager server. If more than one backup version exists, a user can restore the active backup version of the file or any inactive backup versions.

Restoring files by using the GUI

The Restore GUI queries the Tivoli Storage Manager server for a list of files that are backed up and presents them in the same format as the backup GUI. Select the files that you want to restore.

You can also use the Find function to select files. The Find function has the same options as the Backup GUI, but the Find function looks for backed up files on the Tivoli Storage Manager server. Select the files to restore from the server.

Displaying active and inactive version of a file to restore

To restore a specific version of a file, you must click View > Display active/inactive files. With this option you can able to restore inactive files as well.

Point-in-time restore

Tivoli Storage Manager uses a point-in-time restore to restore a file space, directory, or file to the version equal to or before the point in time. Incremental backups are necessary to capture the fact that files are deleted. Support for point-in-time restore is essential to recover a file space or directory to a time when it is known to be in a good or consistent state. For example, a point-in-time restore eliminates the effect of data corruption or recovers a configuration to a prior date or time. When a point-in-time restore is done, new files that are created on the client after the point-in-time date are not deleted.

A point-in-time restore that includes deleted files is possible when incremental backups run on the client. The server is notified only when files are deleted from a client file space during an incremental backup. Run incremental backups frequently enough to provide the necessary point-in-time resolution. Files that are deleted from a client file space between two incremental backups might be restored during a point-in-time restore.

Restartable restores

If an error occurs in the middle of a restore operation, the user can start another restore operation by specifying the same source and destination. If the restore starts within the restart period allowed, the operation starts from where it left off. If a restore restarts, some files might be restored again. The file restore completion depends on how much of the Tivoli Storage Manager transaction is finished when the error occurs. A restarted restore starts at a transaction boundary as defined by the Tivoli Storage Manager client and server options, TXNGROUPMAX and TXNBYTELIMIT.

To ensure a consistent restore, the client file space that is restored during a restartable restore is locked when a restartable restore operation is in running state. This locking prevents all Tivoli Storage Manager move operations for sequential media containing files from the node or file space. Tivoli Storage Manager client also prevents backup operations that affect data being restored.

Restoring backuped files

The default restore method is the no query method, unless inactive, pick, latest, fromdate, and todate are specified, or it is a restore of NetWare NDS. To force the use of classic restore, use a question mark and an asterisk (?*) in the source file specification rather than an asterisk (*). For example:

c:\projects\2013\?* or /home/projects/2013/?*

Use the following command to restore the c:\projects\lab.ppt file to its original directory

                         dsmc restore c:\projects\lab.ppt

If you do not specify a destination, the files are restored to their original location.

Using the PRESERVEPATH restore option

The PRESERVEPATH restore option is available by using the backup-archive command line. With this option, users specify how to handle directory structures during a restore to a new location. The process creates the lowest-level source directory as a subdirectory of the target directory. Files from the source directory are stored in the new subdirectory. You can specify the PRESERVEPATH restore option with one of the following options

• Partial or subtree: Creates the lowest-level source directory as a subdirectory of the target directory. It stores files from the source directory in the new subdirectory. Subtree is the default.

• Complete: Restores the entire path, starting from the root, into the specified directory. The entire path includes all the directories except the file space name.

• Nobase: Restores the contents of the source directory without the lowest-level, or base directory, into the specified destination directory.

• None: Restores all selected source files to the target directory. No part of the source path at or above the source directory is reproduced at the target.

If you specify subdir=yes, Tivoli Storage Manager restores all files in the source directories to the single target directory.

You can also use the Operations Center to verify or run backups and restores. Open services, and then policies to see Backups & Restores.

Deleting backup data from Server storage

The Utilities menu has several options to delete archive data, backup data, or filespaces. The client must already have authority to delete backup data before the option is available. Update the node by using the following command

update node client backdelete=yes

You must select the delete option first. Otherwise, your current file selections are lost and you have to select the files again. In the right pane, select the backup object to delete, and click the Delete button. You are prompted to confirm that you want to delete the backed up file. You also receive a confirmation when the deletion finishes.

• Delete Active Objects

• Delete Inactive Objects

• Delete All Objects

Day 38

Different types of data movement in TSM Infrastructure

Types of data Movement in TSM Infrastructure

There are 2 main data movement types which are generally used for taking backup and archive from clients to TSM server.

Backup through Local Area Networks (LAN) & Wide Area Networks (WAN)

In a traditional LAN and WAN environment, the Tivoli Storage Manager  backup-archive client reads data from locally attached disks and sends it over  the LAN to the Tivoli Storage Manager server. The server receives the data, then writes it out to its storage pool — tape, disk, or optical media — based on predefined policies and server configuration. Data is read and written by both the Tivoli Storage Manager client and server machines. In  addition, control information is also sent over the LAN to the Tivoli Storage Manager server.

Restore operations also follow the same path in the opposite direction. Data is read by the Tivoli Storage Manager server, sent via the LAN to the client system, and  is written there on local attached storage devices.

Backup through Storage Area Networks (SAN)

SAN technology provides an alternative path for data movement between the Tivoli Storage Manager client and the server. Shared storage resources (disk, tape) are accessible to both the client and the server through the SAN. Data movement is off-loaded from the LAN and from the server processor and allows for greater scalability. LAN-free backups decrease the load on the LAN by introducing a Storage Agent. The Storage Agent can be thought of as a small Tivoli Storage Manager server (without a database or recovery log) that is installed and run on the Tivoli Storage Manager client. The Storage Agenthandles the communication with the Tivoli Storage Manager server over the LAN but sends the data directly to SAN attached tape devices, relieving the Tivoli Storage Manager server from the actual I/O transfer.

From a technical point of view, a SAN topology also offers higher bandwidth and  therefore faster speed availability for data movement. In reality this depends heavily on attached storage device technology and the nature of the transferred data. Usually, large files such as databases are transferred faster via SAN than LAN. When transferring small files, SAN performance may radically decrease.Moreover, LAN-free backups do add some complexity to a Tivoli Storage Manager implementation. You need to be careful of how the SAN-attached backup storage devices are utilized — insufficient resource planning can create 

a storage device overload. 

Tape library sharing between multiple Tivoli Storage Manager servers also requires proper planning. Instead of only one Tivoli Storage Manager server and its LAN-free clients using the attached library, multiple servers and their clients are sharing the storage device. Storage area networks are beneficial when moving large files, such as database backups, and application data, such as Exchange, Domino, SQL, or Oracle. Local area networks are appropriate for file server backups of small files.

Backup and Restore Overview

A backup creates an additional copy of a data object to use for recovery. A data object might be a file, directory, or a user-defined data object, such as a database table. The backup version of this data object is stored separately in the Tivoli Storage Manager server storage repository. When you restore an object, you copy it back from the server to the client.

You can restore a file, a directory, or even a whole machine. You need to know two things:

• Items to restore: file name, directory

• The time in the past of the saved items, optional

By default, TSM always takes Progressive incremental backup if the backup type is not specified. This method is the standard backup method that the Tivoli Storage Manager backup- archive client uses. A full backup of new objects is followed by incremental backups. No additional full backups of are required after the first backup. There is no need to retransmit backup data that has not changed during successive backup operations. changed data unchanged data

Backup types available in TSM

Below are the commonly used backups using TSM. By using TDP, you can also archivelog backups of the database applications. By default, Tivoli Storage Manager uses the intelligent Progressive Incremental backup strategy. Only files that are changed or that are new are backed up, reducing the amount of data transfer on your network and system. With progressive backup, you do not need resource-intensive, full backups. Progressive backup provides faster restores because it needs to restore only the version of the file requested. Progressive backup backs up less data, thus saving network bandwidth, tapes, and management overhead. With UNIX symbolic links, only the path information that the symbolic link contains is backed up.

• Incremental (complete)

• Incremental by date

• Incremental (without journal)

• Journal-based

• Always backups, selective or full

• Logical volume backup

• Image snapshot backup

• Network Data Management Protocol (NDMP)

Incremental (complete) backup

The incremental backup function, also known as incremental (complete), backs up all the files that are changed since the last back up. Incremental backups also back up all of the files that are created since the last backup. The incremental backup function does not back up files that are excluded by the include-exclude list.

Incremental by date backup

A disk or volume is eligible for an incremental by date backup, if you have done at least one full incremental backup of that entire disk or volume. Running an incremental backup of only a directory branch or individual file does not make the disk or volume eligible for incremental by date backups.

To perform an incremental by date backup by using the GUI, select the Incremental (date only) option from the type of backup list menu, or use the incrbydate option with the incremental command. The following conditions apply to backup criteria:

• The client backs up only those files with modification dates and times that are more recent than the date and time of the most recent incremental backup of the file system.

• Files that the client adds after the most recent incremental backup are not backed up if their modification date and times are earlier than that backup date and times.

• Files that are renamed after the most recent incremental backup, but otherwise remain unchanged, are not backed up.

Incremental backup by date does not check for frequency, new files, deleted files, changes in file attributes, or rebinding of files.

Journal-based backup

Journal-based backups for Windows, UNIX, and Linux improve performance of incremental and selective backups by using the journal engine service to note the changed files, rather than using file scanning. When the journal engine service is installed and configured, journaling is used by default with incremental backups.

Incremental (without journal) backup

To run an incremental backup without using the journal database, select Incremental (without journal). The journal database is discussed later in the lesson.

Selective (always backup)

The selective backup always attempts to back up the objects that you select. Use a selective backup to back up specific files or directories, regardless of whether a current copy of those files exists on the server.

Image Snapshot Backups

Image backups are full volume backups for Windows clients, which use the snapshot function of Tivoli Storage Manager.

Logical volume backups

Logical volume backups improve the restore performance. Periodically, the logical volume is backed up, before the scheduled daily incremental backups. If a logical volume needs to be restored, the logical volume backup is restored first, followed by the subsequent incrementals.

Network attached storage (NAS)

Network attached storage (NAS) file system backups are enabled through the support of Network Data Management Protocol (NDMP). Tivoli Storage Manager Windows, AIX, and Solaris servers back up and restore network attached storage (NAS) file system images to automated tape drives or libraries. These libraries are attached to Network Appliance and EMC Celerra NAS file servers. NDMP support is available only on IBM Tivoli Storage Manager Extended Edition.

Journal-based backups

Journal-based backup provides an alternative to traditional progressive  incremental backup, which under certain circumstances may dramatically  increase overall backup performance. As the name already implies, journal-based backups have no effect on archive  processing. The main difference between journal-based backup and progressive  incremental backup is the method in which the list of backup candidate objects is derived.

A progressive incremental backup creates the list of files by scanning the entire file system on the client and comparing that list with a list of files on the server. For a journal-based backup, the Tivoli Storage Manager backup-archive client obtains the list of backups by examining the entries that the Journal Based Backup Daemon creates.

Journal-based backup is supported on UNIX, Linux, and all Windows clients except for clients that run on Windows Server 2003 for Itanium-based systems. If you install the journal engine service and it is running, by default, the incremental command automatically does a journal-based backup on selected file systems that the journal engine service monitors. Tivoli Storage Manager does not use the journaling facility that is inherent in Windows NTFS file systems or any other journaled file system. To perform a journal-based backup successfully, the following conditions must be met

• You must set up the journal service to monitor the file system that contains the files and directories that are backed up.

• Must run a full incremental backup successfully at least once on the file system that is backed up.

• The file space image of the file system at the server must not be modified by an administrative command since the last full incremental backup.

• The storage management policy for the files that are backed up must not be updated since the last full incremental backup.

Backup sets

A backup set is a group of active versions of files, copied onto portable media. Backup sets can be restored on the client locally, without the Tivoli Storage Manager server being available.

Although the creation of backup sets is not a client function, it is an important feature of backups. Using the most recent backup versions that the server stores, a Tivoli Storage Manager administrator can generate a complete set of client files (backup set). These backup sets are used to retain a copy of client files for a longer period of time (Instant Archive) or for recovery of a client system, without server or network, when the backup set is copied onto portable media and restored locally (Rapid Recovery).

• The generate backupset command runs as a background process on the server.

• The restore backupset command restores a backup set from the server, a local file, or a local tape device.

Day 37

Securing TSM Client data with Encryption and SSL technologies

TSM Client Data Encryption

To ensure the security of the backed up data, the Tivoli Storage Manager client implements an encryption function. With this function, you can encrypt the data before sending it to the Tivoli Storage Manager server.

The user can chooses the files that are subject to encryption with include-exclude processing. All files that match the pattern on the include.encrypt specification undergo encryption. The encryption processing is the final task on the client system before the data goes to the server. Other client operations, such as compression, occur before encryption.

Encryption uses a simple key management system, which means that the user either must remember the encryption key password during restore operation or store it locally on the client system. Encryption works for both backup and archive operations.

Encryption is a CPU-intensive process. The encryption process requires additional computing requirements on the client CPU. Carefully decide which data items need encryption, and control them by using the include-exclude statements. The administrator has the option to overwrite client selections by using client options sets.

Problems can occur with the simple key management scheme, especially in the case of long-term archiving of data. If data is archived with encryption, organizational rules must ensure that the encryption key password remains available for retrieval. Cyclic password changes or lack of external password management can cause situations in which data cannot be retrieved successfully.

When restoring data by using the scheduling function, files might not be restored because the needed encryption key password is not stored locally (PROMPT mode). Or the restored files might be encrypted with a different key than the stored encryption key password.

After the data is stored on the Tivoli Storage Manager server, it is unreadable. The include.encrypt option is the only way to enable encryption on the client.

include.encrypt /database/.../*.*

Place the encryptkey option in the client options file, either the dsm.opt file or the dsm.sys file. Use one of the following options to manage the key that file encryption uses

     encryptkey save

     encryptkey prompt

     encryptkey generate

With the SAVE option, the encryption key password is saved in the Tivoli Storage Manager client’s password file. A prompt is issued for the initial encryption key password. After the initial prompt, the encryption key password that is saved in the password file is used for backups and archives that match the include.encrypt specification.

With the PROMPT option, you manage the encryption key password. You are prompted for the encryption key password when the Tivoli Storage Manager client begins a backup or archive operation. A prompt for the same key is issued when restoring or retrieving the encrypted file.

With the GENERATE option, an encryption key password is dynamically generated when the Tivoli Storage Manager client begins a backup or archive. This generated key password is used for the backups of files that match the include.encrypt specification. The generated key password is kept on the Tivoli Storage Manager server in an encrypted form. The key password is returned to the Tivoli Storage Manager client for decryption during restore and retrieve operations.

TSM Client Data Security (Secure Sockets Layer SSL)

You can use Secure Sockets Layer (SSL) to have another level of protection beyond passwords. Secure Sockets Layer (SSL) is the standard technology to create encrypted connections between servers and clients. SSL provides secure communications for servers and clients over open communications paths through the use of digital certificates.

You can use the Secure Sockets Layer (SSL) or the Transport Layer Security (TLS) protocol to provide transport layer security for a secure connection between Tivoli Storage Manager servers, clients, and storage agents. If you send data between the server, client, and storage agent, use SSL or TLS to encrypt the data.

SSL is provided by the Global Security Kit (GSKit) that is installed with the Tivoli Storage Manager server that the server, client, and storage agent use. The Operations Center and Reporting agent do not use GSKit.

Each Tivoli Storage Manager server, client, or storage agent that enables SSL must use a trusted self-signed certificate or obtain a unique certificate that is signed by a certificate authority (CA). You can use your own certificates or purchase certificates from a CA. Either certificate can be installed and added to the key database on the Tivoli Storage Manager server, client, or storage agent. The certificate is verified by the SSL client or server that requests or initiates the SSL communication. SSL is set up independently on the Tivoli Storage Manager server, client, and storage agent.

You can set up SSL or TLS on the Tivoli Storage Manager server, backup-archive client, and storage agent to ensure that your data is encrypted during communication. You can use an SSL certificate to verify an SSL communication request between the server, client, and storage agent.

Check TSM infocenter  website for more details on how to configure Secure communication between clients and server using SSL.