Protecting devices

Any device with the Tenvara agent can be backed up. Protecting it tells the agent to fetch the backup helper and start backing up on the schedule.

What can be backed up#

Each device reports the things it can back up, called units:

Unit	Platforms	How it is backed up
Volume (for example C: or sda)	Windows, Linux	A full image of the volume. On Windows a VSS shadow copy is taken first, so open files are consistent. Free space on NTFS volumes is never read
Virtual machine	Hyper-V hosts, Proxmox VE nodes	Each guest's disks, taken from a checkpoint (Hyper-V) or a snapshot backup (Proxmox)
Folder	Windows, Linux, macOS	The files in a folder you choose, one by one. On Windows it reads from a VSS shadow copy. This is the only kind on a Mac

You can browse inside volume images when you restore (NTFS, ext4 and XFS), so a full image also gives you single-file restores.

What is selected by default#

• Windows and Linux: every supported fixed volume.
• Mac: the users' home folders (/Users).
• Virtual machines: none. Guests on a Hyper-V host or Proxmox node are listed but stay unticked until you choose them.
• Removable and unsupported volumes: listed with the reason, and never selected by default. A USB stick or USB disk is marked Removable. The system drive is never treated as removable, whatever it is connected through.

An empty selection never means "everything": if nothing is ticked, nothing is backed up. A protected device with nothing ticked shows Nothing selected, is not counted as protected, and is listed in Needs attention on the Backup overview with Choose what to back up.

Protecting one device#

1. Open the device. On its Overview tab, find the Backup section (Backup in the "On this page" list jumps to it).
2. Press Protect (or turn on the Protected switch).

The agent downloads the helper, the helper reports the device's volumes and guests, and the first backup runs at the next scheduled time. To start straight away, press Back up now at the top of the device page.

Protecting many devices at once#

Open Backup > Devices. The list shows every device with the agent, its backup state, customer, last good backup, next run, start time, size and how many units are backed up (for example 1 of 3). The line above the table counts the protected devices, the ones that are not protected and the sandbox hosts that are not backed up; each count opens that view.

1. Find the devices. The Views picker has Protected, Backup failing, Backup overdue, Paused, Not backed up and Sandbox hosts, and the filters are Backup, Protection, Customer, Helper and OS.
2. Tick the devices you want. The box in the header ticks every row the filter shows.
3. Open Backup in the bar that appears and choose Protect....
4. Choose What is backed up: Every fixed volume (every fixed Windows volume, every Linux disk whole, a Mac whole, never removable media) or The system volume.
5. Choose the Schedule and retention: Each customer's (which falls back to Settings > Backup, the Defaults tab) or Set them here to give these devices their own.
6. Choose the First backup: Now or In the next window.
7. Check the list of devices that will be skipped and why, then confirm.

The dialog first works out what it would do and lists every device it would skip with the reason: already protected, retired, no agent, an operating system backup does not run on, or the Lite agent. The button stays off when nothing would change. Once you confirm, the work runs on the server: the dialog shows a progress bar and each device's result, and you can close it while it carries on. Each device gets its usual activity line and each customer one line for the run.

The same Backup menu has:

Action	What it does
Back up now...	Backs up each device's selection now. Devices that are not protected, paused, already queued or running, or with nothing selected are skipped
Stop protecting...	Ends protection. Choose Keep them (the backups stay restorable until retention removes them) or Delete them (they go to Backup > Recycle bin for the recovery window; your role must allow deleting backups and you type the number of devices to confirm)
Pause backups...	Pauses each device until a time you choose, with a reason
Resume backups...	Ends each device's own pause. A customer's pause is resumed on the customer

The Backup menu is in the bar of every device list: Devices > All devices and its views, a customer's Devices tab, a device group's members, Backup > Devices and a customer's Backup tab. It shows for people who manage backup and whose role has the Bulk changes switch.

The same list, limited to one customer, is on the customer's Backup tab. The Starts column shows each device's start time, marked "own" when it has its own rather than the customer's.

Protecting new devices automatically#

Rather than remembering to protect every new server, let the customer's backup policy do it.

1. Open the customer's Backup tab and press Change under Schedule and retention.
2. Under New devices, choose Protect automatically: Off, Servers, Workstations or All.
3. Choose what gets backed up: every fixed volume, or chosen folders only, and whether VSS is used.
4. Save.

A device with the agent that has never been protected is then protected within a minute of appearing, and the device's Backup section says "Protected: Automatically, by the customer's policy". Switching the policy on also protects the customer's existing devices of that kind that were never protected. A device someone turned off stays off, and a server used only as a sandbox host is never protected this way. Customers without a choice of their own follow New devices on the Defaults tab of Settings > Backup (off unless you change it).

Note: While a customer protects new devices automatically, its unprotected devices of other kinds are not listed in Needs attention: a customer that protects servers only chose to leave its workstations alone.

The device's Backup section#

Once protected, the Backup section on the device's Overview tab shows what is backed up and how it is going. Its header has the state, Pause backups, the Protected switch and Settings.

• Units: each volume, folder and guest with how full it is, its backup state, last good backup and how much is backed up. A volume image counts the data on the volume, not the size of the disk. Tick or untick a unit to choose what is backed up. Each has its own back up button, to back up just that unit now.
• Schedule, Keeps and Next run: when it runs and how long it keeps recovery points. Underneath, it says whether that comes from the device, the customer or the default, and the device's time zone.
• Last good, Data backed up and Helper: the last successful backup, how much data it protects and whether the helper is running.
• Exclusions and Scripts: how many exclusion rules apply and whose they are, and any scripts that run before and after the backup.
• Local copy: the local copy's folder with Healthy, Seeding (with how much is still to upload) or Problem and the error. See Storage locations and immutable backups.
• Keep longer...: keep this device's backups for a number of years or for ever. See Schedules and retention.
• Recovery points: the newest points with their size. Restore opens the restore browser on this device. Hover a point to pin it, compare it with the one before, delete it, or restore a SQL Server database from it. Underneath, The whole machine has Start it as a machine and Rebuild it on new hardware.
• Recent jobs: the latest backups with how long they took and how much they sent. All opens the Jobs list for this device.

Device backup settings#

Press Settings in the device's Backup section. Anything not set here follows the customer's settings, then the defaults.

Folders#

Files in these folders are backed up one by one. Volumes are chosen on the device page, folders here.

1. Type a path in the box, for example D:\Shares or /home.
2. Press Add folder.
3. Remove a folder with the cross beside it.

Folder backups only send files that changed. Files that cannot be read (a locked file, a cloud-only OneDrive file) are listed as skipped items with the reason, rather than failing the whole backup.

Exclusions#

Leave out files you never want back, such as temporary files, disc images, downloads and browser caches. Rules apply to folder backups and to Windows volume images.

1. Under Exclusions, turn on Set here. Otherwise the device follows its customer's rules, then Exclusions on the Defaults tab of Settings > Backup.
2. Add one rule per line, or press Add 14 suggested rules to start from temporary files, disc images, downloads, and browser, OneDrive and Dropbox caches.

How rules work:

• A name without a folder matches anywhere: *.tmp, Thumbs.db, node_modules\.
• A path starts at the top of the volume: \Users\*\Downloads\ on every volume, D:\Scratch on D: only, /home/*/.cache/ on Linux.
• * is any part of a name, ? one character, ** any number of folders, and a trailing \ or / matches folders only. Letters match either case on Windows and macOS.

In a Windows volume image a left-out file is stored as free space: it keeps its name in the backup but is empty. Files Windows itself needs, and files with more than one name, are always kept. The job log says how many files the rules left out and how much space that saved. Linux whole-disk images are read below the file system, so use a folder backup there when you need rules.

An empty rule list set here means "nothing is left out" for this device, not "follow the customer".

Scripts#

Run a script from your library before the backup (stop a service, dump a database) and after it (start the service again). See Application-aware and SQL Server backups.

Schedule and retention#

Turn on Set here under Schedule or Retention to give this device its own. See Schedules and retention.

Bandwidth#

Enter Limit uploads to (MB/s) to stop backups filling a slow line. Leave it empty for no limit.

Local copy#

Turn on Local copy to keep a second copy on the device's own disk or a share it can write to. Enter the Folder, then choose:

• Mirror: every backup goes to both places at once. Restores from the local copy are fast.
• Seed first: backups are written here first and uploaded afterwards. Use it for a large first backup over a slow connection.

Applications#

With VSS on, SQL Server on a volume is backed up consistently. SQL Server logs chooses whether the logs are truncated after each image. See Application-aware and SQL Server backups.

Press Save when you are done.

Virtual machines on Hyper-V and Proxmox#

A Hyper-V host or Proxmox VE node that runs the agent lists its guests as units. Tick the guests you want backed up, the same way as volumes.

• Hyper-V: Tenvara takes a checkpoint of the guest and reads its disks from it. It tidies up its own checkpoints and never touches anyone else's.
• Proxmox VE: guests are backed up through Proxmox's own snapshot backup.

When you restore a guest, its disks come back as image files you can attach, and you can pull single files out of them.

Tip: Proxmox's own backup jobs to a Proxmox storage are shown in the Infrastructure area. Tenvara backup adds an encrypted copy in your backup storage, restored the same way as every other device.

Pausing backups#

When a server is being moved, or a laptop is away for repair, pause its backups rather than turning protection off.

1. Press Pause backups in the device's Backup section, or on the customer's Backup tab to pause every device of the customer. For a handful of devices, tick them in a device list and choose Backup > Pause backups....
2. Choose Until: I resume them, Tomorrow, A week, or Until... a date and time.
3. Give a reason under Why. It is shown wherever the backups say paused.
4. Press Pause backups.

While paused, scheduled backups are skipped, overdue alerts are held and any open one clears, and the device shows Paused, which is not a problem: it is not failing or overdue, and it has its own Paused view in the Devices list. The helper, restores and Back up now keep working. Resume ends the pause, or it ends by itself at the time you chose. Overdue then counts from the end of the pause, and missed slots are not made up.

Paused also shows, without anyone pausing anything, when backups were deliberately off: while a customer is in takeover mode and its backups have not been started, or after the backup service was stopped or the Backup module switched off for a while. Those devices are not overdue: they catch up at their next backup, and overdue counts again from when backups came back.

Spreading start times#

When all of a customer's devices start at 22:00, they compete for the same disks and the same internet line. Turn on Spread backups automatically on the customer's Backup tab and Tenvara plans each night itself: devices start one after another through a window so each site's upload stays under its budget, and the plan follows new devices and changing backup sizes. See Spreading backups across the night.

A device can still keep a start time of its own (set in its backup settings): the Starts column marks it "own", and the plan works around it unless you let Tenvara decide. Use the customer's time again puts such devices back on the customer's time.

Removed devices#

A device deleted from Tenvara, or retired, keeps its backups unless you say otherwise. Its backups are listed under Removed devices on the customer's Backup tab, and for every customer on the Status tab of Settings > Backup, with when it was removed, its recovery points, size and last backup.

Retiring a device ends its backup: protection is switched off, queued backups are cancelled, its backup alerts clear, and it leaves every backup list and count. Reinstating it does not protect it again by itself.

The retire dialog says what happens to the device's backups under Its backups: how many recovery points and how big, kept until retention ends with the date its kept points run out, and whether they stay in the second copy. Choose Keep until retention ends, or Delete its backups now to delete them with the retirement (through the recycle bin, and a second administrator's approval where that is required). A device with no backups says so.

A retired device's kept backups are not a running backup. In Backup > Repositories its repository carries a Device retired badge with the date, and its panel says when the kept points run out, whether they are copied and offers Delete these backups.... See Storage locations and immutable backups.

• Browse opens its backups so you can download files and folders.
• Delete permanently (administrators) deletes them, typed with the device's name. It may wait for a second administrator, cannot go while a point is pinned or under a legal hold, and waits out the recovery window in Backup > Recycle bin like any other deletion.

When an administrator deletes a device that has backups, Also delete its backups is offered, unticked by default. Restoring the device from the recycle bin puts its backups back with it.

Stopping protection#

Turn off the Protected switch, or tick devices in a device list and choose Backup > Stop protecting.... The helper stops and no more backups run.

Note: Turning the switch off never deletes backups. The recovery points stay where they are and can still be restored. Only Delete them in the bulk dialog, or deleting backups yourself, removes them, and then they wait out the recovery window in Backup > Recycle bin.

A server that is a sandbox host and was only protected so it could be one can stop being backed up and stay a sandbox host. See Sandbox hosts.