Backup Exec appears to have spontaneously executed a restore... TWICE!!!
I am in desparate need of some assistance please. Twice in the past two weeks, Backup Exec appears to have spontaneously decided to execute a restore instead of a backup and has complete restored the computer to an earlier point in time. When I say completely restored, when looking at any system log, the backup log, and even data in our database, all items are showing lapses from the time of the tape to the current day.
We are a small operation with a single server (Windows SBS 2003) and 5 client devices (Windows XP). I use Backup Exec 2010 do to a GFS tape rotation on which the full backup occurs on Mondays. The job is configured to happen at 8pm nightly and has a timeout set for 1pm the following day. I also have System Recovery 2010 configured to take nightly snapshots of the server and store them on a NAS device. The SR snapshots start at 12AM. I am the Sys Admin but the Office Administrator manages the tape rotation because I am not a full time employee.
Since the system is getting restored, I have no logs I can use to try and peice together what has happened. The user account for the first event is follows:
The tape is provided at the end of the day before the Office Administrator (OA) leaves. She comes in the next morning and checks on the tape and sees that the tape has ejected but there is also a prompt to supply a tape for a job that appears to be trying to execute. The tape was supplied and ran for about an hour or two and then the user was provided a message that the system was going to reboot. After reboot, data was missing. Log examination showed a complete disappearance of data for a 2 week span. I restored the computer from the System Recovery images and the computer was fine for about 2 weeks.
This morning I was called and notified that "it happened again". I came in and found that the log entries in the System application log read 10/19 and then 11/2 - nothing in between. I get email notifications of the backups and the last backup notification is 10/24 which appears to have completed successfully with exceptions ( unable to obtain minimum quiet time for a drive). I have been told the shut the server down on 10/29 in preparation for the hurricane and it was down till 10/31. After restore... the earliest log entries I have are 11/2 at 8:43:19 AM. Coincidentally, both accounts seemed to happen on a thursday night into friday morning (10/11 and 11/1).
As I do not have any logs to examine or any restore jobs configured, is there any advice you can give me about how this possibly could have happened? Admittedly, the OA is not a very technical person, so if she was prompted to supply a tape for restore instead of backup, she might not have realized that is was a different request. However, what really concerns me is why she would have been given such a prompt to begin with?