Backup Strategies: Using Snapshots
A storage snapshot is a set of reference markers for data, similar to a table of contents. It allows an administrator to roll back a computer system’s data to a specific point in time, typically to restore a malfunctioning system to an operational state. This capability means a storage snapshot serves as a restore point for the system. A storage snapshot is often known by other terms such “snapshot backup” and “image backup”, which implies that it’s a type of backup. However, this isn’t the case because a snapshot just defines the location of the data and its method of organization, rather than storing the data on another medium.
Administrators often use snapshots as part of their backup strategy, typically for virtual machines (VM) in a private cloud. The primary advantage of snapshots is a faster backup and recovery process, which is especially helpful when recovering from a disaster or malware infection. Their main disadvantage is that traditional backups are still needed since the snapshots reside on the same medium as the original data.
Traditional Backups
A traditional backup system places files in some type of compressed format to minimize the size of the backup set. It then stores the backup set on another storage medium, often tape or disk. The process of compressing the files and copying them makes a full backup a time-consuming process. This is especially true in the case of a multi-tasking system that may create changes to the files as they’re being backed up, which results in the backup having a condition known as version skew.
Assume for this example of version skew that a file is moved into a directory after it has already been backed up but before the backup is complete. The file won’t exist at all on the backup, even though it was created before the backup finished. Version skew is especially problematic when a file’s contents are changed while the backup program is reading it, which can corrupt the file.
One approach to avoiding version skew when backing up live data is to disable write operations to the disk during the backup. This typically requires the administrator to terminate the applications that could write to the disk or use an Application Programmer Interface (API) to deny write access. This procedure may be acceptable for systems such as a desktop computer that can tolerate regular downtime, but servers that require a higher availability can’t bear a service outage every time a backup is performed.
Snapshot Backups
The Storage Networking Industry Association (SNIA) defines a backup as a collection of data stored on non-volatile storage media for the purpose of recovery. According to this definition, a snapshot isn’t a backup by itself until the data has been replicated to storage device because a snapshot is a virtual copy of the data, rather than an actual copy of the data.
Snapshots provide a means of performing backups significantly more quickly than the traditional method, especially for large data sets. The time required for a traditional backup is proportional to the data set, whereas the time needed for a snapshot doesn’t increase with the size of the data set. Some snapshot implementations take an initial snapshot of the entire data set and only use subsequent snapshots for changed data by referencing unchanged data with a set of pointers to the initial snapshot. This approach also uses less storage space than repeatedly cloning unchanged data. Snapshots also avoid the problem of version skewing, which allows applications to continue writing data.
Malware Recovery
A backup system must be able to create restore points that allow an administrator to restore the system to some point in time. A traditional backup system accomplishes this by copying the data to another storage device, while a snapshot system uses multiple snapshots to create virtual views of the data set at different points in time.
Administrators often use snapshots to restore files that have been modified by malware to their original state. This capability is especially useful for ransomware, which prevents users from accessing content until a ransom has been paid. Advanced ransomware can change a file’s name, which can prevent a traditional backup system from recovering the file. However, a snapshot could restore the file to its state before it was infected by ransomware.
Testing
Snapshots also make testing a lot easier. A snapshot backup easily be cloned and create another VM that has the exact configuration/data as a production VM. From this cloned VM, code changes or operation system upgrades can be tested before making those changes to a production environment. If upgrades are made to a production VM and they don’t go well, it is fast and easy to rollback the changes to a previous snapshot.
Disaster Recovery
Disaster recovery is another common use of backup systems. The traditional method involves creating a backup set on portable media such as tapes and sending it to an off-site storage facility. A snapshot-based backup accomplishes this task with replication, which allows the backup system to place copies of the data in multiple locations.
This scenario may involve using the same replication stream to send a backup set to both an on-site and off-site storage system. The on-site backup may be used for operational recovery, while the off-site backup is used for disaster recovery. A system administrator could accomplish this by replicating the primary storage directly to both backup storage sites. Another approach is to replicating the data to the on-site storage first, then replicate the data from the on-site storage to the off-site storage.
Drawbacks
The primary disadvantage of a snapshot is that it typically resides on the same storage device as the live data. If the data on that device becomes damaged or destroyed, the snapshot is of no use unless it has already been used to replicate the data to another device.
Another disadvantage is that the vendors of snapshot systems often give the impression that snapshots eliminate the need for a centralized backup catalog, which a traditional backup system requires. These vendors may imply that all a system administrator has to do to recover a file is copy it from the snapshot directory to the desired location. Snapshot backups are self-indexing to an extent, but they won’t tell a user where a needed file resides like a backup catalog can. However, some snapshot systems provide this functionality by indexing their backups via Network Data Management Protocol (NDMP).
Integrated Approach
Traditional backups and snapshots should both be incorporated into your backup strategy. A successful implementation might look like doing daily backups of you virtual machines and taking hourly snapshots. If your VM became corrupted for some reason (virus, ransomware, failed upgrade, accidentally delete the database,…) you would have the snapshot that you could roll back to and would only be missing an hours worth of data. If you have a worst case scenario and your storage becomes corrupted, you will have your traditional backup to fall back on. A strategy like this provides a high level of reliability without impacting performance.
Reference:
http://searchdatabackup.techtarget.com/feature/Using-snapshot-backups-to-replace-your-traditional-data-backup-system
https://docs.microsoft.com/en-us/azure/storage/storage-incremental-snapshots
