Backup Policies for VMs and Databases

Lesson: Backup Policies for VMs and Databases

Introduction

In the modern digital infrastructure, data is the most valuable asset. Whether your environment consists of Virtual Machines (VMs) or complex database clusters, the risk of data loss—due to human error, cyberattacks like ransomware, or hardware failure—is a constant threat.

Backup Policies serve as the blueprint for your data protection strategy. They define what to back up, how often (frequency), where to store it (retention), and how quickly it must be restored (Recovery Time Objective). Without a formal policy, backups are often inconsistent, incomplete, or impossible to restore when disaster strikes.

The Core Components of a Backup Policy

A robust policy must address three primary metrics:

1. RPO (Recovery Point Objective): The maximum tolerable period in which data might be lost. (e.g., if you back up every 4 hours, your RPO is 4 hours).
2. RTO (Recovery Time Objective): The duration of time within which a business process must be restored after a disaster.
3. Retention Policy: How long you keep backup copies (e.g., daily backups for 30 days, monthly backups for 1 year).

1. Backing Up Virtual Machines

VM backups generally fall into two categories: Snapshot-based (image-level) and Agent-based (file-level).

• Snapshot-based: Captures the entire state of the VM, including the OS, applications, and data. This is ideal for full-system restoration.
• Application-Consistent Backups: Crucial for VMs running databases. These ensure that the database is "quiesced" (flushed to disk) before the snapshot is taken, preventing data corruption.

2. Backing Up Databases

Databases require more granular control than VMs. A simple snapshot of a running database file can lead to "torn pages" or corrupt indices.

• Transaction Log Backups: Essential for Point-in-Time Recovery (PITR). By backing up transaction logs every 15 minutes, you can restore a database to the exact second before a catastrophic error.
• Full vs. Incremental: A common strategy is the Grandfather-Father-Son (GFS) rotation:
  • Full (Grandfather): Monthly.
  • Differential (Father): Weekly.
  • Incremental (Son): Daily.

Practical Implementation: Infrastructure as Code (IaC)

Modern cloud environments (AWS, Azure, GCP) allow you to define backup policies as code. Below is an example of an AWS Backup Plan using Terraform to automate the protection of resources.

resource "aws_backup_plan" "daily_retention" {
  name = "daily_backup_plan"

  rule {
    rule_name         = "daily_30_days"
    target_vault_name = aws_backup_vault.backup_vault.name
    schedule          = "cron(0 5 ? * * *)" # Every day at 5 AM
    start_window      = 60
    completion_window = 360

    lifecycle {
      delete_after = 30 # Retain for 30 days
    }
  }
}

For databases, you might use a native CLI tool to trigger a dump:

# Example: MySQL dump for a database
mysqldump -u [username] -p[password] --single-transaction --routines --triggers [db_name] > /backups/db_backup_$(date +%F).sql

Note: Always use the --single-transaction flag with MySQL/MariaDB to ensure the backup is consistent without locking the database tables for the duration of the dump.

Best Practices

1. The 3-2-1 Rule: Always maintain 3 copies of your data, on 2 different media types, with 1 copy stored offsite (or in a separate cloud region).
2. Automate Everything: Manual backups are prone to human error. Use native cloud backup services or orchestration tools like Veeam or Commvault.
3. Immutable Backups: In the era of ransomware, ensure your backups are "Write Once, Read Many" (WORM). This prevents attackers from deleting your backups even if they gain administrative access.
4. Regular Restoration Testing: A backup that hasn't been tested is merely a "hope." Schedule quarterly "Fire Drills" where you restore a production VM to an isolated network to verify data integrity.

Common Pitfalls

• Ignoring Transaction Logs: Admins often back up the VM files but forget to truncate/back up database transaction logs. This leads to storage disks filling up rapidly and potential data loss.
• Over-relying on Snapshots: Snapshots are not backups. They are local pointers to data. If the underlying storage array fails, your snapshots go with it.
• Neglecting Network Latency: When backing up to the cloud, ensure your network bandwidth can handle the daily change rate of your data. If your data grows faster than your upload speed, your backup window will never close.
• The "One Size Fits All" Trap: Applying the same retention policy to a development VM as a production database is costly and inefficient. Tier your policies based on data criticality.

Key Takeaways

• Policies must be business-driven: Align your RPO and RTO with the actual revenue-impact of downtime.
• Consistency is king: Use application-consistent snapshots for databases to ensure data integrity.
• Automation reduces risk: Use IaC to enforce backup policies across your fleet automatically.
• Verify to Trust: The only way to ensure your Disaster Recovery plan works is through regular, documented restoration tests.
• Security is part of recovery: Protect your backup storage with IAM roles, encryption at rest, and immutability settings.