Video Screencast Help

Troubleshooting incremental backups

Created: 08 May 2012 • Updated: 10 May 2012 | 14 comments


We have a full/diff/incremental backup scheme where we run a full backup on the first Friday of the month, differential backups on other Fridays, and incremental backups Mon-Thurs.  This all works fine, except our daily incremental jobs are much larger than we expect (150-200GB when we're expecting maybe 15-20). What steps can we perform to determine what is causing such big incremental backups?


Comments 14 CommentsJump to latest comment

VJware's picture

What kind of data is being backed up ? Are you using modified time or archive bit ?

Altair's picture

Thanks for the response!  We are backing up Windows and Linux hosts within the same job, so we used the modification date.  As far as types of data, it's mainly docs (Word, Excel, etc) and some profile things such as browser and mail client settings.  Also a couple of MySQL servers.  The database servers I could see falling through on a diff/incr backup - but they're only 10-20GB in total.  

So mostly just wondering if anyone else has had to track this down, and what steps they went through.

Colin Weaver's picture

According to the 2012 admin guide

"Incremental backups include only the files that have changed since the last full or incremental backup"

As such the first Incremental after the differential will backup stuff that was in the differential and actually go back to the previous incremental so would be slightly larger than you might think.

Altair's picture

Good to know, I didn't realize that.  However even incremental-to-incremental intervals come up with large amounts of data.  That is to say that Mon - Thurs' incremental jobs are all about the same size, and all larger than we expect.

pkh's picture

We have a full/diff/incremental backup scheme where we run a full backup on the first Friday of the month, differential backups on other Fridays, and incremental backups Mon-Thurs.

I don't know how you managed to define your jobs because BE 2012 does not allow the mixing of incremental and differential backups in the same backup definition.

Altair's picture

There is a job for each of full, diff, and incremental that are all part of a Policy, sharing a selection list.

Colin Weaver's picture

Please confirm the version of Backup Exec as "policy" is not a term specifically presented in the console to BE 2012 (14.0.1798) users

Altair's picture

Ah, thanks.  Meant to select 2010.  Specifically 2010 R3.

pkh's picture

I think you should review your need to mix differential and incremental backups.  During an emergency restore situation, it will be very difficult to get the restore sequence right.  That is, which backup set do you restore first and so on.  Elaborate backup schemes mean elaborate restores.  Elaborate restores are something you don't need when you are in an emergency situation and everybody is screaming at you to get the servers back up and running.  If you restore your backup sets in the wrong sequence, your end result will be a mess.  Also, it might not be you who will be doing the restore, but somebody else who is not so familiar.  A restore should be as simple as possible and any IT person can do it.

As to your original question, look at your housekeeping jobs and AV scans.  Some AV scans do cause the files to be marked as modified and thus need to be backed up.

You might want to try changing the backup method, e.g. changing from archive bit to modified time method, to see whether it makes a difference.

Altair's picture

Thanks for the info!  Any idea whether Symantec Endpoint Protection is one of the offending AV products?

Would you recommend just running incremental backups every day and one monthly full, instead?

We can use archive bit because, as mentioned above, we include Linux hosts in our jobs.

Ken Putnam's picture

If you only do a single monthly FULL and subsequent  INCRs, then you could conceivably have 21 restores to get your system back in a DR situation

I generally do a FULL once a week and DIFFs daily, if the DIFFs will fit the backup window or INCR otherwise

That way I have the FULL and one DIFF or a FULL and 4 INCR in a DR situation

And I thinnk you mean you CANNOT use Archive Bit if you backup Linux machine.  You need to use Modified Time for them

If this response answers your concern, please mark it as a "solution"

Altair's picture

Oops, yes cannot use archive bit is what I meant.

pkh's picture

As previously advised, the archive bit method does not work with Linux machines.  You got to use the modified time method.

When you use the modified time method and is using SEP, you got to do a registry edit.  Otherwise your incremental/differential backups will become full backups.  See my blog below

You should always use the backup scheme which makes restore the simplest first.  If you have the time and resources,  do full backups everyday.  Otherwise, do full + differential.  Lastly, full + incremental.

Altair's picture

Gave this a shot, but doesn't seem to have made a difference.  Going to do an upgrade to 2012 later this month, I guess we'll see if that helps.