]>
Commit | Line | Data |
---|---|---|
225affc9 DM |
1 | .. _tape_backup: |
2 | ||
5f79dc28 DM |
3 | Tape Backup |
4 | =========== | |
5 | ||
53939bb4 | 6 | .. image:: images/screenshots/pbs-gui-tape-changer-overview.png |
5565e454 | 7 | :target: _images/pbs-gui-tape-changer-overview.png |
53939bb4 DW |
8 | :align: right |
9 | :alt: Tape Backup: Tape changer overview | |
10 | ||
66d06696 DC |
11 | Proxmox tape backup provides an easy way to store datastore content |
12 | onto magnetic tapes. This increases data safety because you get: | |
5f79dc28 | 13 | |
70d00e01 DW |
14 | - an additional copy of the data, |
15 | - on a different media type (tape), | |
02633961 | 16 | - to an additional location (you can move tapes off-site) |
5f79dc28 | 17 | |
66d06696 | 18 | In most restore jobs, only data from the last backup job is restored. |
70d00e01 | 19 | Restore requests further decline, the older the data |
0bce2118 | 20 | gets. Considering this, tape backup may also help to reduce disk |
70d00e01 DW |
21 | usage, because you can safely remove data from disk, once it's archived on |
22 | tape. This is especially true if you need to retain data for several | |
0bce2118 | 23 | years. |
54d96866 DM |
24 | |
25 | Tape backups do not provide random access to the stored data. Instead, | |
70d00e01 | 26 | you need to restore the data to disk, before you can access it |
02633961 | 27 | again. Also, if you store your tapes off-site (using some kind of tape |
70d00e01 DW |
28 | vaulting service), you need to bring them back on-site, before you can do any |
29 | restores. So please consider that restoring from tape can take much | |
30 | longer than restoring from disk. | |
5f79dc28 DM |
31 | |
32 | ||
33 | Tape Technology Primer | |
34 | ---------------------- | |
35 | ||
70d00e01 | 36 | .. _Linear Tape-Open: https://en.wikipedia.org/wiki/Linear_Tape-Open |
5f79dc28 | 37 | |
70d00e01 DW |
38 | As of 2021, the only widely available tape technology standard is |
39 | `Linear Tape-Open`_ (LTO). Different vendors offer LTO Ultrium tape | |
40 | drives, auto-loaders, and LTO tape cartridges. | |
54d96866 | 41 | |
70d00e01 DW |
42 | There are a few vendors that offer proprietary drives with |
43 | slight advantages in performance and capacity. Nevertheless, they have | |
66d06696 | 44 | significant disadvantages: |
54d96866 DM |
45 | |
46 | - proprietary (single vendor) | |
47 | - a much higher purchase cost | |
48 | ||
66d06696 | 49 | So we currently do not test such drives. |
5f79dc28 DM |
50 | |
51 | In general, LTO tapes offer the following advantages: | |
52 | ||
70d00e01 | 53 | - Durability (30 year lifespan) |
5f79dc28 DM |
54 | - High Capacity (12 TB) |
55 | - Relatively low cost per TB | |
56 | - Cold Media | |
57 | - Movable (storable inside vault) | |
58 | - Multiple vendors (for both media and drives) | |
53939bb4 | 59 | - Built in AES-GCM Encryption engine |
d5efa18a | 60 | |
02633961 TL |
61 | Note that `Proxmox Backup Server` already stores compressed data, so using the |
62 | tape compression feature has no advantage. | |
54d96866 | 63 | |
d5efa18a DM |
64 | |
65 | Supported Hardware | |
66 | ------------------ | |
67 | ||
34407477 | 68 | `Proxmox Backup`_ Server supports `Linear Tape-Open`_ generation 5 (LTO-5) |
ae5b1e18 DC |
69 | or later and has best-effort support for generation 4 (LTO-4). While |
70 | many LTO-4 systems are known to work, some might need firmware updates or | |
71 | do not implement necessary features to work with Proxmox Backup Server. | |
d5efa18a | 72 | |
ee9fa953 DM |
73 | Tape changing is carried out using the SCSI Medium Changer protocol, |
74 | so all modern tape libraries should work. | |
75 | ||
76 | .. Note:: We use a custom user space tape driver written in Rust_. This | |
77 | driver directly communicates with the tape drive using the SCSI | |
53939bb4 DW |
78 | generic interface. This may have negative side effects when used with the old |
79 | Linux kernel tape driver, so you should not use that driver with | |
ee9fa953 | 80 | Proxmox tape backup. |
d5efa18a DM |
81 | |
82 | ||
8a192bed DM |
83 | Drive Performance |
84 | ~~~~~~~~~~~~~~~~~ | |
85 | ||
70d00e01 | 86 | Current LTO-8 tapes provide read/write speeds of up to 360 MB/s. This means, |
66d06696 | 87 | that it still takes a minimum of 9 hours to completely write or |
8a192bed DM |
88 | read a single tape (even at maximum speed). |
89 | ||
53939bb4 | 90 | The only way to speed that data rate up is to use more than one |
70d00e01 | 91 | drive. That way, you can run several backup jobs in parallel, or run |
8a192bed DM |
92 | restore jobs while the other dives are used for backups. |
93 | ||
70d00e01 DW |
94 | Also consider that you first need to read data from your datastore |
95 | (disk). However, a single spinning disk is unable to deliver data at this | |
66d06696 | 96 | rate. We measured a maximum rate of about 60MB/s to 100MB/s in practice, |
70d00e01 DW |
97 | so it takes 33 hours to read the 12TB needed to fill up an LTO-8 tape. If you want |
98 | to write to your tape at full speed, please make sure that the source | |
53939bb4 | 99 | datastore is able to deliver that performance (for example, by using SSDs). |
baefbc44 | 100 | |
f6226955 DC |
101 | LTO-9+ considerations |
102 | ~~~~~~~~~~~~~~~~~~~~ | |
103 | ||
104 | Since LTO-9, it is necessary to initialize new media in your drives, this is | |
105 | called `Media Optimization`. This usually takes between 40 and 120 minutes per | |
106 | medium. It is recommended to initialize your media in this manner with the | |
107 | tools provided by your hardware vendor of your drive or changer. Some tape | |
108 | changers have a method to 'bulk' initialize your media. | |
109 | ||
110 | Because of this, formatting tapes is handled differently in Proxmox Backup | |
111 | Server to avoid re-optimizing on each format/labelling. If you want to format | |
112 | your media for use with the Proxmox Backup Server the first time or after use | |
113 | with another program, either use the functionality of your drive/changer, or | |
114 | use the 'slow' format on the cli: | |
115 | ||
116 | .. code-block:: console | |
117 | ||
118 | # proxmox-tape format --drive your-drive --fast 0 | |
119 | ||
120 | This will completely remove all pre-existing data and trigger a `Media | |
121 | Optimization` pass. | |
122 | ||
123 | If you format a partitioned LTO-9 medium with the 'fast' method (the default or | |
124 | by setting `--fast 1`), only the first partition will be formatted, so make | |
125 | sure to use the 'slow' method. | |
d5efa18a DM |
126 | |
127 | Terminology | |
128 | ----------- | |
129 | ||
10439718 DM |
130 | **Tape Labels:** |
131 | are used to uniquely identify a tape. You would normally apply a | |
132 | sticky paper label to the front of the cartridge. We additionally | |
133 | store the label text magnetically on the tape (first file on tape). | |
d5efa18a DM |
134 | |
135 | .. _Code 39: https://en.wikipedia.org/wiki/Code_39 | |
136 | ||
137 | .. _LTO Ultrium Cartridge Label Specification: https://www.ibm.com/support/pages/ibm-lto-ultrium-cartridge-label-specification | |
138 | ||
8001c82e DM |
139 | .. _LTO Barcode Generator: lto-barcode/index.html |
140 | ||
10439718 DM |
141 | **Barcodes:** |
142 | are a special form of tape labels, which are electronically | |
143 | readable. Most LTO tape robots use an 8 character string encoded as | |
144 | `Code 39`_, as defined in the `LTO Ultrium Cartridge Label | |
145 | Specification`_. | |
d5efa18a | 146 | |
10439718 DM |
147 | You can either buy such barcode labels from your cartridge vendor, |
148 | or print them yourself. You can use our `LTO Barcode Generator`_ | |
149 | app, if you would like to print them yourself. | |
d5efa18a | 150 | |
10439718 DM |
151 | .. Note:: Physical labels and the associated adhesive should have an |
152 | environmental performance to match or exceed the environmental | |
153 | specifications of the cartridge to which it is applied. | |
d5efa18a | 154 | |
10439718 DM |
155 | **Media Pools:** |
156 | A media pool is a logical container for tapes. A backup job targets | |
157 | one media pool, so a job only uses tapes from that pool. The pool | |
158 | additionally defines how long a backup job can append data to tapes | |
159 | (allocation policy) and how long you want to keep the data | |
160 | (retention policy). | |
08d8b2a4 | 161 | |
10439718 DM |
162 | **Media Set:** |
163 | A group of continuously written tapes (all from the same media pool). | |
d5efa18a | 164 | |
10439718 DM |
165 | **Tape drive:** |
166 | The device used to read and write data to the tape. There are | |
167 | standalone drives, but drives are usually shipped within tape | |
168 | libraries. | |
d5efa18a | 169 | |
10439718 DM |
170 | **Tape changer:** |
171 | A device which can change the tapes inside a tape drive (tape | |
172 | robot). They are usually part of a tape library. | |
d5efa18a DM |
173 | |
174 | .. _Tape Library: https://en.wikipedia.org/wiki/Tape_library | |
175 | ||
10439718 DM |
176 | `Tape library`_: |
177 | A storage device that contains one or more tape drives, a number of | |
178 | slots to hold tape cartridges, a barcode reader to identify tape | |
179 | cartridges, and an automated method for loading tapes (a robot). | |
d5efa18a | 180 | |
10439718 DM |
181 | This is also commonly known as an 'autoloader', 'tape robot' or |
182 | 'tape jukebox'. | |
8a192bed | 183 | |
10439718 DM |
184 | **Inventory:** |
185 | The inventory stores the list of known tapes (with additional status | |
186 | information). | |
4cfb1234 | 187 | |
10439718 DM |
188 | **Catalog:** |
189 | A media catalog stores information about the media content. | |
4cfb1234 | 190 | |
8a192bed | 191 | |
70d00e01 | 192 | Tape Quick Start |
aae5db91 | 193 | ---------------- |
8a192bed DM |
194 | |
195 | 1. Configure your tape hardware (drives and changers) | |
196 | ||
197 | 2. Configure one or more media pools | |
198 | ||
70d00e01 | 199 | 3. Label your tape cartridges |
8a192bed DM |
200 | |
201 | 4. Start your first tape backup job ... | |
baefbc44 DM |
202 | |
203 | ||
204 | Configuration | |
205 | ------------- | |
206 | ||
207 | Please note that you can configure anything using the graphical user | |
8c83b75a | 208 | interface or the command-line interface. Both methods result in the |
baefbc44 DM |
209 | same configuration. |
210 | ||
225affc9 | 211 | .. _tape_changer_config: |
baefbc44 DM |
212 | |
213 | Tape changers | |
214 | ~~~~~~~~~~~~~ | |
215 | ||
53939bb4 | 216 | .. image:: images/screenshots/pbs-gui-tape-changers.png |
5565e454 | 217 | :target: _images/pbs-gui-tape-changers.png |
53939bb4 DW |
218 | :align: right |
219 | :alt: Tape Backup: Tape Changers | |
220 | ||
295bae14 TL |
221 | Tape changers (robots) are part of a `Tape Library`_. They contain a number of |
222 | slots to hold tape cartridges, a barcode reader to identify tape cartridges and | |
223 | an automated method for loading tapes. | |
224 | ||
225 | You can skip this step if you are using a standalone drive. | |
baefbc44 | 226 | |
70d00e01 | 227 | Linux is able to auto detect these devices, and you can get a list |
98cdee78 DM |
228 | of available devices using: |
229 | ||
230 | .. code-block:: console | |
baefbc44 DM |
231 | |
232 | # proxmox-tape changer scan | |
a174854a DM |
233 | ┌─────────────────────────────┬─────────┬──────────────┬────────┐ |
234 | │ path │ vendor │ model │ serial │ | |
235 | ╞═════════════════════════════╪═════════╪══════════════╪════════╡ | |
236 | │ /dev/tape/by-id/scsi-CC2C52 │ Quantum │ Superloader3 │ CC2C52 │ | |
237 | └─────────────────────────────┴─────────┴──────────────┴────────┘ | |
baefbc44 | 238 | |
70d00e01 | 239 | In order to use a device with Proxmox Backup Server, you need to create a |
98cdee78 DM |
240 | configuration entry: |
241 | ||
242 | .. code-block:: console | |
baefbc44 | 243 | |
a174854a | 244 | # proxmox-tape changer create sl3 --path /dev/tape/by-id/scsi-CC2C52 |
baefbc44 DM |
245 | |
246 | Where ``sl3`` is an arbitrary name you can choose. | |
247 | ||
70d00e01 | 248 | .. Note:: Please use the persistent device path names from inside |
baefbc44 DM |
249 | ``/dev/tape/by-id/``. Names like ``/dev/sg0`` may point to a |
250 | different device after reboot, and that is not what you want. | |
251 | ||
53939bb4 | 252 | .. image:: images/screenshots/pbs-gui-tape-changers-add.png |
5565e454 | 253 | :target: _images/pbs-gui-tape-changers-add.png |
53939bb4 DW |
254 | :align: right |
255 | :alt: Tape Backup: Add a new tape changer | |
256 | ||
257 | This operation can also be carried out from the GUI, by navigating to the | |
258 | **Changers** tab of **Tape Backup** and clicking **Add**. | |
259 | ||
70d00e01 | 260 | You can display the final configuration with: |
98cdee78 DM |
261 | |
262 | .. code-block:: console | |
baefbc44 | 263 | |
04eba29c DM |
264 | # proxmox-tape changer config sl3 |
265 | ┌──────┬─────────────────────────────┐ | |
266 | │ Name │ Value │ | |
267 | ╞══════╪═════════════════════════════╡ | |
268 | │ name │ sl3 │ | |
269 | ├──────┼─────────────────────────────┤ | |
270 | │ path │ /dev/tape/by-id/scsi-CC2C52 │ | |
271 | └──────┴─────────────────────────────┘ | |
272 | ||
53939bb4 DW |
273 | Or simply list all configured changer devices (as seen in the **Changers** tab |
274 | of the GUI): | |
98cdee78 DM |
275 | |
276 | .. code-block:: console | |
04eba29c | 277 | |
baefbc44 | 278 | # proxmox-tape changer list |
a174854a DM |
279 | ┌──────┬─────────────────────────────┬─────────┬──────────────┬────────────┐ |
280 | │ name │ path │ vendor │ model │ serial │ | |
281 | ╞══════╪═════════════════════════════╪═════════╪══════════════╪════════════╡ | |
282 | │ sl3 │ /dev/tape/by-id/scsi-CC2C52 │ Quantum │ Superloader3 │ CC2C52 │ | |
283 | └──────┴─────────────────────────────┴─────────┴──────────────┴────────────┘ | |
baefbc44 | 284 | |
53939bb4 | 285 | The Vendor, Model and Serial number are auto-detected, but only shown |
baefbc44 DM |
286 | if the device is online. |
287 | ||
98cdee78 DM |
288 | To test your setup, please query the status of the changer device with: |
289 | ||
290 | .. code-block:: console | |
a174854a DM |
291 | |
292 | # proxmox-tape changer status sl3 | |
293 | ┌───────────────┬──────────┬────────────┬─────────────┐ | |
294 | │ entry-kind │ entry-id │ changer-id │ loaded-slot │ | |
295 | ╞═══════════════╪══════════╪════════════╪═════════════╡ | |
296 | │ drive │ 0 │ vtape1 │ 1 │ | |
297 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
298 | │ slot │ 1 │ │ │ | |
299 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
300 | │ slot │ 2 │ vtape2 │ │ | |
301 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
302 | │ ... │ ... │ │ │ | |
303 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
304 | │ slot │ 16 │ │ │ | |
305 | └───────────────┴──────────┴────────────┴─────────────┘ | |
306 | ||
0912878e | 307 | Tape libraries usually provide some special import/export slots (also |
02633961 | 308 | called "mail slots"). Tapes inside those slots are accessible from |
0912878e DM |
309 | outside, making it easy to add/remove tapes to/from the library. Those |
310 | tapes are considered to be "offline", so backup jobs will not use | |
70d00e01 | 311 | them. Those special slots are auto-detected and marked as an |
0912878e DM |
312 | ``import-export`` slot in the status command. |
313 | ||
314 | It's worth noting that some of the smaller tape libraries don't have | |
70d00e01 DW |
315 | such slots. While they have something called a "Mail Slot", that slot |
316 | is just a way to grab the tape from the gripper. They are unable | |
0912878e | 317 | to hold media while the robot does other things. They also do not |
5f3b2330 | 318 | expose that "Mail Slot" over the SCSI interface, so you won't see them in |
0912878e DM |
319 | the status output. |
320 | ||
321 | As a workaround, you can mark some of the normal slots as export | |
322 | slot. The software treats those slots like real ``import-export`` | |
53939bb4 | 323 | slots, and the media inside those slots are considered to be 'offline' |
98cdee78 DM |
324 | (not available for backup): |
325 | ||
326 | .. code-block:: console | |
0912878e DM |
327 | |
328 | # proxmox-tape changer update sl3 --export-slots 15,16 | |
329 | ||
330 | After that, you can see those artificial ``import-export`` slots in | |
98cdee78 DM |
331 | the status output: |
332 | ||
333 | .. code-block:: console | |
0912878e | 334 | |
04eba29c | 335 | # proxmox-tape changer status sl3 |
0912878e DM |
336 | ┌───────────────┬──────────┬────────────┬─────────────┐ |
337 | │ entry-kind │ entry-id │ changer-id │ loaded-slot │ | |
338 | ╞═══════════════╪══════════╪════════════╪═════════════╡ | |
339 | │ drive │ 0 │ vtape1 │ 1 │ | |
340 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
341 | │ import-export │ 15 │ │ │ | |
342 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
343 | │ import-export │ 16 │ │ │ | |
344 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
345 | │ slot │ 1 │ │ │ | |
346 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
347 | │ slot │ 2 │ vtape2 │ │ | |
348 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
349 | │ ... │ ... │ │ │ | |
350 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
351 | │ slot │ 14 │ │ │ | |
352 | └───────────────┴──────────┴────────────┴─────────────┘ | |
a174854a | 353 | |
3cca5d7f DC |
354 | |
355 | Advanced options | |
356 | ^^^^^^^^^^^^^^^^ | |
357 | ||
358 | Since not all tape changer behave the same, there is sometimes the need | |
359 | for configuring advanced options. | |
360 | ||
361 | Currently there are the following: | |
362 | ||
363 | * `eject-before-unload` : This is needed for some changers that require a tape | |
364 | to be ejected before unloading from the drive. | |
365 | ||
366 | You can set these options with `proxmox-tape` like this: | |
367 | ||
368 | .. code-block:: console | |
369 | ||
c7321e2e | 370 | # proxmox-tape changer update sl3 --eject-before-unload true |
3cca5d7f DC |
371 | |
372 | ||
225affc9 | 373 | .. _tape_drive_config: |
baefbc44 DM |
374 | |
375 | Tape drives | |
376 | ~~~~~~~~~~~ | |
377 | ||
53939bb4 | 378 | .. image:: images/screenshots/pbs-gui-tape-drives.png |
5565e454 | 379 | :target: _images/pbs-gui-tape-drives.png |
53939bb4 DW |
380 | :align: right |
381 | :alt: Tape Backup: Drive list | |
382 | ||
04eba29c | 383 | Linux is able to auto detect tape drives, and you can get a list |
98cdee78 DM |
384 | of available tape drives using: |
385 | ||
386 | .. code-block:: console | |
04eba29c DM |
387 | |
388 | # proxmox-tape drive scan | |
389 | ┌────────────────────────────────┬────────┬─────────────┬────────┐ | |
390 | │ path │ vendor │ model │ serial │ | |
391 | ╞════════════════════════════════╪════════╪═════════════╪════════╡ | |
ee9fa953 | 392 | │ /dev/tape/by-id/scsi-12345-sg │ IBM │ ULT3580-TD4 │ 12345 │ |
04eba29c DM |
393 | └────────────────────────────────┴────────┴─────────────┴────────┘ |
394 | ||
53939bb4 | 395 | .. image:: images/screenshots/pbs-gui-tape-drives-add.png |
5565e454 | 396 | :target: _images/pbs-gui-tape-drives-add.png |
53939bb4 DW |
397 | :align: right |
398 | :alt: Tape Backup: Add a tape drive | |
399 | ||
04eba29c | 400 | In order to use that drive with Proxmox, you need to create a |
53939bb4 DW |
401 | configuration entry. This can be done through **Tape Backup -> Drives** in the |
402 | GUI or by using the command below: | |
98cdee78 DM |
403 | |
404 | .. code-block:: console | |
04eba29c | 405 | |
ee9fa953 | 406 | # proxmox-tape drive create mydrive --path /dev/tape/by-id/scsi-12345-sg |
04eba29c | 407 | |
70d00e01 | 408 | .. Note:: Please use the persistent device path names from inside |
ee9fa953 | 409 | ``/dev/tape/by-id/``. Names like ``/dev/sg0`` may point to a |
04eba29c DM |
410 | different device after reboot, and that is not what you want. |
411 | ||
412 | If you have a tape library, you also need to set the associated | |
98cdee78 DM |
413 | changer device: |
414 | ||
415 | .. code-block:: console | |
04eba29c | 416 | |
627d0000 | 417 | # proxmox-tape drive update mydrive --changer sl3 --changer-drivenum 0 |
04eba29c | 418 | |
627d0000 | 419 | The ``--changer-drivenum`` is only necessary if the tape library |
70d00e01 | 420 | includes more than one drive (the changer status command lists all |
02633961 | 421 | drive numbers). |
04eba29c | 422 | |
70d00e01 | 423 | You can display the final configuration with: |
98cdee78 DM |
424 | |
425 | .. code-block:: console | |
04eba29c DM |
426 | |
427 | # proxmox-tape drive config mydrive | |
428 | ┌─────────┬────────────────────────────────┐ | |
429 | │ Name │ Value │ | |
430 | ╞═════════╪════════════════════════════════╡ | |
431 | │ name │ mydrive │ | |
432 | ├─────────┼────────────────────────────────┤ | |
ee9fa953 | 433 | │ path │ /dev/tape/by-id/scsi-12345-sg │ |
04eba29c DM |
434 | ├─────────┼────────────────────────────────┤ |
435 | │ changer │ sl3 │ | |
436 | └─────────┴────────────────────────────────┘ | |
437 | ||
627d0000 | 438 | .. NOTE:: The ``changer-drivenum`` value 0 is not stored in the |
70d00e01 | 439 | configuration, because it is the default. |
04eba29c | 440 | |
98cdee78 DM |
441 | To list all configured drives use: |
442 | ||
443 | .. code-block:: console | |
04eba29c DM |
444 | |
445 | # proxmox-tape drive list | |
446 | ┌──────────┬────────────────────────────────┬─────────┬────────┬─────────────┬────────┐ | |
447 | │ name │ path │ changer │ vendor │ model │ serial │ | |
448 | ╞══════════╪════════════════════════════════╪═════════╪════════╪═════════════╪════════╡ | |
ee9fa953 | 449 | │ mydrive │ /dev/tape/by-id/scsi-12345-sg │ sl3 │ IBM │ ULT3580-TD4 │ 12345 │ |
04eba29c DM |
450 | └──────────┴────────────────────────────────┴─────────┴────────┴─────────────┴────────┘ |
451 | ||
53939bb4 | 452 | The Vendor, Model and Serial number are auto detected and only shown |
04eba29c DM |
453 | if the device is online. |
454 | ||
98cdee78 DM |
455 | For testing, you can simply query the drive status with: |
456 | ||
457 | .. code-block:: console | |
632756b6 DM |
458 | |
459 | # proxmox-tape status --drive mydrive | |
54311a38 DM |
460 | ┌────────────────┬──────────────────────────┐ |
461 | │ Name │ Value │ | |
462 | ╞════════════════╪══════════════════════════╡ | |
463 | │ blocksize │ 0 │ | |
464 | ├────────────────┼──────────────────────────┤ | |
465 | │ density │ LTO4 │ | |
466 | ├────────────────┼──────────────────────────┤ | |
467 | │ compression │ 1 │ | |
468 | ├────────────────┼──────────────────────────┤ | |
469 | │ buffer-mode │ 1 │ | |
470 | ├────────────────┼──────────────────────────┤ | |
471 | │ alert-flags │ (empty) │ | |
472 | ├────────────────┼──────────────────────────┤ | |
473 | │ file-number │ 0 │ | |
474 | ├────────────────┼──────────────────────────┤ | |
475 | │ block-number │ 0 │ | |
476 | ├────────────────┼──────────────────────────┤ | |
477 | │ manufactured │ Fri Dec 13 01:00:00 2019 │ | |
478 | ├────────────────┼──────────────────────────┤ | |
479 | │ bytes-written │ 501.80 GiB │ | |
480 | ├────────────────┼──────────────────────────┤ | |
481 | │ bytes-read │ 4.00 MiB │ | |
482 | ├────────────────┼──────────────────────────┤ | |
483 | │ medium-passes │ 20 │ | |
484 | ├────────────────┼──────────────────────────┤ | |
485 | │ medium-wearout │ 0.12% │ | |
486 | ├────────────────┼──────────────────────────┤ | |
487 | │ volume-mounts │ 2 │ | |
488 | └────────────────┴──────────────────────────┘ | |
632756b6 DM |
489 | |
490 | .. NOTE:: Blocksize should always be 0 (variable block size | |
70d00e01 | 491 | mode). This is the default anyway. |
632756b6 | 492 | |
baefbc44 | 493 | |
225affc9 DM |
494 | .. _tape_media_pool_config: |
495 | ||
baefbc44 DM |
496 | Media Pools |
497 | ~~~~~~~~~~~ | |
498 | ||
53939bb4 | 499 | .. image:: images/screenshots/pbs-gui-tape-pools.png |
5565e454 | 500 | :target: _images/pbs-gui-tape-pools.png |
53939bb4 DW |
501 | :align: right |
502 | :alt: Tape Backup: Media Pools | |
503 | ||
08d8b2a4 | 504 | A media pool is a logical container for tapes. A backup job targets |
53939bb4 | 505 | a single media pool, so a job only uses tapes from that pool. |
08d8b2a4 DM |
506 | |
507 | .. topic:: Media Set | |
508 | ||
509 | A media set is a group of continuously written tapes, used to split | |
510 | the larger pool into smaller, restorable units. One or more backup | |
59217472 | 511 | jobs write to a media set, producing an ordered group of |
70d00e01 DW |
512 | tapes. Media sets are identified by a unique ID. That ID and the |
513 | sequence number are stored on each tape of that set (tape label). | |
08d8b2a4 | 514 | |
70d00e01 DW |
515 | Media sets are the basic unit for restore tasks. This means that you need |
516 | every tape in the set to restore the media set contents. Data is fully | |
08d8b2a4 DM |
517 | deduplicated inside a media set. |
518 | ||
519 | ||
520 | .. topic:: Media Set Allocation Policy | |
521 | ||
522 | The pool additionally defines how long backup jobs can append data | |
59217472 | 523 | to a media set. The following settings are possible: |
08d8b2a4 | 524 | |
b3bed7e4 | 525 | - Try to use the current media set (``continue``). |
08d8b2a4 | 526 | |
70d00e01 | 527 | This setting produces one large media set. While this is very |
59217472 | 528 | space efficient (deduplication, no unused space), it can lead to |
70d00e01 | 529 | long restore times, because restore jobs need to read all tapes in the |
59217472 | 530 | set. |
08d8b2a4 | 531 | |
70d00e01 | 532 | .. NOTE:: Data is fully deduplicated inside a media set. This |
59217472 | 533 | also means that data is randomly distributed over the tapes in |
70d00e01 DW |
534 | the set. Thus, even if you restore a single VM, data may have to be |
535 | read from all tapes inside the media set. | |
59217472 | 536 | |
70d00e01 DW |
537 | Larger media sets are also more error-prone, because a single |
538 | damaged tape makes the restore fail. | |
59217472 | 539 | |
70d00e01 | 540 | Usage scenario: Mostly used with tape libraries. You manually |
59217472 DM |
541 | trigger new set creation by running a backup job with the |
542 | ``--export`` option. | |
543 | ||
e84b801c | 544 | .. NOTE:: Retention period starts with the existence of a newer |
02633961 | 545 | media set. |
e84b801c | 546 | |
b3bed7e4 | 547 | - Always create a new media set (``always``). |
59217472 | 548 | |
70d00e01 DW |
549 | With this setting, each backup job creates a new media set. This |
550 | is less space efficient, because the media from the last set | |
59217472 DM |
551 | may not be fully written, leaving the remaining space unused. |
552 | ||
b0427dda | 553 | The advantage is that this produces media sets of minimal |
70d00e01 DW |
554 | size. Small sets are easier to handle, can be moved more conveniently |
555 | to an off-site vault, and can be restored much faster. | |
59217472 | 556 | |
e84b801c DM |
557 | .. NOTE:: Retention period starts with the creation time of the |
558 | media set. | |
559 | ||
59217472 DM |
560 | - Create a new set when the specified Calendar Event triggers. |
561 | ||
562 | .. _systemd.time manpage: https://manpages.debian.org/buster/systemd/systemd.time.7.en.html | |
563 | ||
564 | This allows you to specify points in time by using systemd like | |
565 | Calendar Event specifications (see `systemd.time manpage`_). | |
566 | ||
567 | For example, the value ``weekly`` (or ``Mon *-*-* 00:00:00``) | |
568 | will create a new set each week. | |
569 | ||
02633961 | 570 | This balances between space efficiency and media count. |
08d8b2a4 | 571 | |
83b5076d DC |
572 | .. NOTE:: Retention period starts on the creation time of the next |
573 | media-set or, if that does not exist, when the calendar event | |
6481fd24 | 574 | next triggers after the current media-set start time. |
e84b801c | 575 | |
08d8b2a4 DM |
576 | Additionally, the following events may allocate a new media set: |
577 | ||
59217472 | 578 | - Required tape is offline (and you use a tape library). |
08d8b2a4 | 579 | |
3f4a62de | 580 | - Current set contains damaged or retired tapes. |
08d8b2a4 | 581 | |
70d00e01 | 582 | - Media pool encryption has changed |
6dd05135 | 583 | |
70d00e01 DW |
584 | - Database consistency errors, for example, if the inventory does not |
585 | contain the required media information, or it contains conflicting | |
586 | information (outdated data). | |
08d8b2a4 DM |
587 | |
588 | .. topic:: Retention Policy | |
589 | ||
e84b801c | 590 | Defines how long we want to keep the data. |
08d8b2a4 | 591 | |
3838ce33 DM |
592 | - Always overwrite media. |
593 | ||
594 | - Protect data for the duration specified. | |
595 | ||
596 | We use systemd like time spans to specify durations, e.g. ``2 | |
597 | weeks`` (see `systemd.time manpage`_). | |
598 | ||
599 | - Never overwrite data. | |
08d8b2a4 | 600 | |
794b0fe9 DM |
601 | .. topic:: Hardware Encryption |
602 | ||
70d00e01 | 603 | LTO-4 (or later) tape drives support hardware encryption. If you |
794b0fe9 DM |
604 | configure the media pool to use encryption, all data written to the |
605 | tapes is encrypted using the configured key. | |
606 | ||
70d00e01 DW |
607 | This way, unauthorized users cannot read data from the media, |
608 | for example, if you loose a tape while shipping to an offsite location. | |
794b0fe9 | 609 | |
70d00e01 | 610 | .. Note:: If the backup client also encrypts data, data on the tape |
794b0fe9 DM |
611 | will be double encrypted. |
612 | ||
70d00e01 | 613 | The password protected key is stored on each medium, so that it is |
9aa8df5b | 614 | possible to `restore the key <tape_restore_encryption_key_>`_ using |
70d00e01 DW |
615 | the password. Please make sure to remember the password, in case |
616 | you need to restore the key. | |
794b0fe9 | 617 | |
53939bb4 | 618 | .. image:: images/screenshots/pbs-gui-tape-pools-add.png |
5565e454 | 619 | :target: _images/pbs-gui-tape-pools-add.png |
53939bb4 DW |
620 | :align: right |
621 | :alt: Tape Backup: Add a media pool | |
08d8b2a4 | 622 | |
53939bb4 DW |
623 | To create a new media pool, add one from **Tape Backup -> Media Pools** in the |
624 | GUI, or enter the following command: | |
98cdee78 DM |
625 | |
626 | .. code-block:: console | |
0bce2118 DM |
627 | |
628 | // proxmox-tape pool create <name> --drive <string> [OPTIONS] | |
629 | ||
630 | # proxmox-tape pool create daily --drive mydrive | |
631 | ||
08d8b2a4 | 632 | |
53939bb4 | 633 | Additional options can be set later, using the update command: |
98cdee78 DM |
634 | |
635 | .. code-block:: console | |
08d8b2a4 | 636 | |
0bce2118 DM |
637 | # proxmox-tape pool update daily --allocation daily --retention 7days |
638 | ||
639 | ||
98cdee78 DM |
640 | To list all configured pools use: |
641 | ||
642 | .. code-block:: console | |
0bce2118 DM |
643 | |
644 | # proxmox-tape pool list | |
645 | ┌───────┬──────────┬────────────┬───────────┬──────────┐ | |
646 | │ name │ drive │ allocation │ retention │ template │ | |
647 | ╞═══════╪══════════╪════════════╪═══════════╪══════════╡ | |
648 | │ daily │ mydrive │ daily │ 7days │ │ | |
649 | └───────┴──────────┴────────────┴───────────┴──────────┘ | |
08d8b2a4 | 650 | |
225affc9 | 651 | .. _tape_backup_job_config: |
baefbc44 | 652 | |
9cf45049 DM |
653 | Tape Backup Jobs |
654 | ~~~~~~~~~~~~~~~~ | |
655 | ||
53939bb4 | 656 | .. image:: images/screenshots/pbs-gui-tape-backup-jobs.png |
5565e454 | 657 | :target: _images/pbs-gui-tape-backup-jobs.png |
53939bb4 DW |
658 | :align: right |
659 | :alt: Tape Backup: Tape Backup Jobs | |
660 | ||
9cf45049 | 661 | To automate tape backup, you can configure tape backup jobs which |
70d00e01 DW |
662 | write datastore content to a media pool, based on a specific time schedule. |
663 | The required settings are: | |
9cf45049 DM |
664 | |
665 | - ``store``: The datastore you want to backup | |
666 | ||
667 | - ``pool``: The media pool - only tape cartridges from that pool are | |
668 | used. | |
669 | ||
670 | - ``drive``: The tape drive. | |
671 | ||
672 | - ``schedule``: Job schedule (see :ref:`calendar-event-scheduling`) | |
673 | ||
674 | For example, to configure a tape backup job for datastore ``vmstore1`` | |
675 | use: | |
676 | ||
677 | .. code-block:: console | |
678 | ||
679 | # proxmox-tape backup-job create job2 --store vmstore1 \ | |
680 | --pool yourpool --drive yourdrive --schedule daily | |
681 | ||
70d00e01 | 682 | The backup includes all snapshots from a backup group by default. You can |
9cf45049 DM |
683 | set the ``latest-only`` flag to include only the latest snapshots: |
684 | ||
685 | .. code-block:: console | |
686 | ||
687 | # proxmox-tape backup-job update job2 --latest-only | |
688 | ||
70d00e01 | 689 | Backup jobs can use email to send tape request notifications or |
9cf45049 DM |
690 | report errors. You can set the notification user with: |
691 | ||
692 | .. code-block:: console | |
693 | ||
694 | # proxmox-tape backup-job update job2 --notify-user root@pam | |
695 | ||
696 | .. Note:: The email address is a property of the user (see :ref:`user_mgmt`). | |
697 | ||
698 | It is sometimes useful to eject the tape from the drive after a | |
70d00e01 | 699 | backup. For a standalone drive, the ``eject-media`` option ejects the |
9cf45049 DM |
700 | tape, making sure that the following backup cannot use the tape |
701 | (unless someone manually loads the tape again). For tape libraries, | |
702 | this option unloads the tape to a free slot, which provides better | |
703 | dust protection than inside a drive: | |
704 | ||
705 | .. code-block:: console | |
706 | ||
707 | # proxmox-tape backup-job update job2 --eject-media | |
708 | ||
70d00e01 | 709 | .. Note:: For failed jobs, the tape remains in the drive. |
9cf45049 | 710 | |
5f9bdaec | 711 | For tape libraries, the ``export-media-set`` option moves all tapes from |
9cf45049 | 712 | the media set to an export slot, making sure that the following backup |
70d00e01 | 713 | cannot use the tapes. An operator can pick up those tapes and move them |
9cf45049 DM |
714 | to a vault. |
715 | ||
716 | .. code-block:: console | |
717 | ||
5f9bdaec | 718 | # proxmox-tape backup-job update job2 --export-media-set |
9cf45049 | 719 | |
5f9bdaec | 720 | .. Note:: The ``export-media-set`` option can be used to force the start |
9cf45049 DM |
721 | of a new media set, because tapes from the current set are no |
722 | longer online. | |
723 | ||
724 | It is also possible to run backup jobs manually: | |
725 | ||
726 | .. code-block:: console | |
727 | ||
728 | # proxmox-tape backup-job run job2 | |
729 | ||
730 | To remove a job, please use: | |
731 | ||
732 | .. code-block:: console | |
733 | ||
734 | # proxmox-tape backup-job remove job2 | |
baefbc44 | 735 | |
74391d1c | 736 | By default, all (recursive) namespaces of the datastore are included in a tape |
e87e4499 | 737 | backup. You can specify a single namespace with ``ns`` and a depth with |
74391d1c DC |
738 | ``max-depth``. For example: |
739 | ||
740 | .. code-block:: console | |
741 | ||
742 | # proxmox-tape backup-job update job2 --ns mynamespace --max-depth 3 | |
743 | ||
744 | If no `max-depth` is given, it will include all recursive namespaces. | |
745 | ||
53939bb4 | 746 | .. image:: images/screenshots/pbs-gui-tape-backup-jobs-add.png |
5565e454 | 747 | :target: _images/pbs-gui-tape-backup-jobs-add.png |
53939bb4 DW |
748 | :align: right |
749 | :alt: Tape Backup: Add a backup job | |
750 | ||
751 | This same functionality also exists in the GUI, under the **Backup Jobs** tab of | |
752 | **Tape Backup**, where *Local Datastore* relates to the datastore you want to | |
753 | backup and *Media Pool* is the pool to back up to. | |
754 | ||
baefbc44 DM |
755 | |
756 | Administration | |
757 | -------------- | |
758 | ||
8c83b75a | 759 | Many sub-commands of the ``proxmox-tape`` command-line tools take a |
44ce25e7 | 760 | parameter called ``--drive``, which specifies the tape drive you want |
70d00e01 | 761 | to work on. For convenience, you can set this in an environment |
98cdee78 DM |
762 | variable: |
763 | ||
764 | .. code-block:: console | |
44ce25e7 DM |
765 | |
766 | # export PROXMOX_TAPE_DRIVE=mydrive | |
767 | ||
768 | You can then omit the ``--drive`` parameter from the command. If the | |
769 | drive has an associated changer device, you may also omit the changer | |
53939bb4 | 770 | parameter from commands that need a changer device, for example: |
98cdee78 DM |
771 | |
772 | .. code-block:: console | |
44ce25e7 DM |
773 | |
774 | # proxmox-tape changer status | |
775 | ||
70d00e01 | 776 | should display the changer status of the changer device associated with |
44ce25e7 DM |
777 | drive ``mydrive``. |
778 | ||
779 | ||
baefbc44 DM |
780 | Label Tapes |
781 | ~~~~~~~~~~~ | |
782 | ||
70d00e01 DW |
783 | By default, tape cartridges all look the same, so you need to put a |
784 | label on them for unique identification. First, put a sticky paper | |
8001c82e DM |
785 | label with some human readable text on the cartridge. |
786 | ||
787 | If you use a `Tape Library`_, you should use an 8 character string | |
70d00e01 DW |
788 | encoded as `Code 39`_, as defined in the `LTO Ultrium Cartridge Label |
789 | Specification`_. You can either buy such barcode labels from your | |
790 | cartridge vendor, or print them yourself. You can use our `LTO Barcode | |
791 | Generator`_ app to print them. | |
8001c82e DM |
792 | |
793 | Next, you need to write that same label text to the tape, so that the | |
794 | software can uniquely identify the tape too. | |
795 | ||
70d00e01 | 796 | For a standalone drive, manually insert the new tape cartridge into the |
98cdee78 DM |
797 | drive and run: |
798 | ||
799 | .. code-block:: console | |
8001c82e | 800 | |
0bce2118 DM |
801 | # proxmox-tape label --changer-id <label-text> [--pool <pool-name>] |
802 | ||
803 | You may omit the ``--pool`` argument to allow the tape to be used by any pool. | |
8001c82e | 804 | |
70d00e01 | 805 | .. Note:: For safety reasons, this command fails if the tape contains |
02633961 | 806 | any data. If you want to overwrite it anyway, erase the tape first. |
8001c82e | 807 | |
98cdee78 DM |
808 | You can verify success by reading back the label: |
809 | ||
810 | .. code-block:: console | |
8001c82e | 811 | |
0bce2118 DM |
812 | # proxmox-tape read-label |
813 | ┌─────────────────┬──────────────────────────────────────┐ | |
814 | │ Name │ Value │ | |
815 | ╞═════════════════╪══════════════════════════════════════╡ | |
816 | │ changer-id │ vtape1 │ | |
817 | ├─────────────────┼──────────────────────────────────────┤ | |
818 | │ uuid │ 7f42c4dd-9626-4d89-9f2b-c7bc6da7d533 │ | |
819 | ├─────────────────┼──────────────────────────────────────┤ | |
820 | │ ctime │ Wed Jan 6 09:07:51 2021 │ | |
821 | ├─────────────────┼──────────────────────────────────────┤ | |
822 | │ pool │ daily │ | |
823 | ├─────────────────┼──────────────────────────────────────┤ | |
824 | │ media-set-uuid │ 00000000-0000-0000-0000-000000000000 │ | |
825 | ├─────────────────┼──────────────────────────────────────┤ | |
826 | │ media-set-ctime │ Wed Jan 6 09:07:51 2021 │ | |
827 | └─────────────────┴──────────────────────────────────────┘ | |
828 | ||
829 | .. NOTE:: The ``media-set-uuid`` using all zeros indicates an empty | |
830 | tape (not used by any media set). | |
8001c82e DM |
831 | |
832 | If you have a tape library, apply the sticky barcode label to the tape | |
833 | cartridges first. Then load those empty tapes into the library. You | |
98cdee78 DM |
834 | can then label all unlabeled tapes with a single command: |
835 | ||
836 | .. code-block:: console | |
8001c82e | 837 | |
0bce2118 | 838 | # proxmox-tape barcode-label [--pool <pool-name>] |
8001c82e DM |
839 | |
840 | ||
baefbc44 DM |
841 | Run Tape Backups |
842 | ~~~~~~~~~~~~~~~~ | |
843 | ||
53939bb4 | 844 | To manually run a backup job click *Run Now* in the GUI or use the command: |
98cdee78 DM |
845 | |
846 | .. code-block:: console | |
9738dd54 DM |
847 | |
848 | # proxmox-tape backup <store> <pool> [OPTIONS] | |
849 | ||
850 | The following options are available: | |
851 | ||
852 | --eject-media Eject media upon job completion. | |
853 | ||
854 | It is normally good practice to eject the tape after use. This unmounts the | |
70d00e01 | 855 | tape from the drive and prevents the tape from getting dusty. |
9738dd54 DM |
856 | |
857 | --export-media-set Export media set upon job completion. | |
858 | ||
02633961 | 859 | After a successful backup job, this moves all tapes from the used |
9738dd54 DM |
860 | media set into import-export slots. The operator can then pick up |
861 | those tapes and move them to a media vault. | |
862 | ||
74391d1c DC |
863 | --ns The namespace to backup. |
864 | ||
6481fd24 DW |
865 | Used if you only want to backup a specific namespace. If omitted, the root |
866 | namespace is assumed. | |
74391d1c DC |
867 | |
868 | --max-depth The depth to recurse namespaces. | |
869 | ||
870 | ``0`` means no recursion at all (only the given namespace). If omitted, | |
6481fd24 | 871 | all namespaces are recursed (below the given one). |
74391d1c | 872 | |
9738dd54 | 873 | |
baefbc44 DM |
874 | Restore from Tape |
875 | ~~~~~~~~~~~~~~~~~ | |
876 | ||
4cfb1234 DM |
877 | Restore is done at media-set granularity, so you first need to find |
878 | out which media set contains the data you want to restore. This | |
879 | information is stored in the media catalog. If you do not have media | |
880 | catalogs, you need to restore them first. Please note that you need | |
881 | the catalog to find your data, but restoring a complete media-set does | |
882 | not need media catalogs. | |
883 | ||
70d00e01 | 884 | The following command lists the media content (from catalog): |
98cdee78 DM |
885 | |
886 | .. code-block:: console | |
4cfb1234 DM |
887 | |
888 | # proxmox-tape media content | |
889 | ┌────────────┬──────┬──────────────────────────┬────────┬────────────────────────────────┬──────────────────────────────────────┐ | |
890 | │ label-text │ pool │ media-set-name │ seq-nr │ snapshot │ media-set-uuid │ | |
891 | ╞════════════╪══════╪══════════════════════════╪════════╪════════════════════════════════╪══════════════════════════════════════╡ | |
892 | │ TEST01L8 │ p2 │ Wed Jan 13 13:55:55 2021 │ 0 │ vm/201/2021-01-11T10:43:48Z │ 9da37a55-aac7-4deb-91c6-482b3b675f30 │ | |
893 | ├────────────┼──────┼──────────────────────────┼────────┼────────────────────────────────┼──────────────────────────────────────┤ | |
894 | │ ... │ ... │ ... │ ... │ ... │ ... │ | |
895 | └────────────┴──────┴──────────────────────────┴────────┴────────────────────────────────┴──────────────────────────────────────┘ | |
896 | ||
897 | ||
898 | A restore job reads the data from the media set and moves it back to | |
98cdee78 DM |
899 | data disk (datastore): |
900 | ||
901 | .. code-block:: console | |
4cfb1234 DM |
902 | |
903 | // proxmox-tape restore <media-set-uuid> <datastore> | |
904 | ||
905 | # proxmox-tape restore 9da37a55-aac7-4deb-91c6-482b3b675f30 mystore | |
906 | ||
fca84a4b DC |
907 | Single Snapshot Restore |
908 | ^^^^^^^^^^^^^^^^^^^^^^^ | |
909 | ||
6481fd24 DW |
910 | Sometimes it is not necessary to restore an entire media-set, but only some |
911 | specific snapshots from the tape. This can be achieved with the ``snapshots`` | |
fca84a4b DC |
912 | parameter: |
913 | ||
914 | ||
915 | .. code-block:: console | |
916 | ||
917 | // proxmox-tape restore <media-set-uuid> <datastore> [<snapshot>] | |
918 | ||
919 | # proxmox-tape restore 9da37a55-aac7-4deb-91c6-482b3b675f30 mystore sourcestore:host/hostname/2022-01-01T00:01:00Z | |
920 | ||
921 | This first restores the snapshot to a temporary location, then restores the relevant | |
922 | chunk archives, and finally restores the snapshot data to the target datastore. | |
923 | ||
6481fd24 | 924 | The ``snapshot`` parameter can be passed multiple times, in order to restore |
fca84a4b DC |
925 | multiple snapshots with one restore action. |
926 | ||
927 | .. NOTE:: When using the single snapshot restore, the tape must be traversed | |
928 | more than once, which, if you restore many snapshots at once, can take longer | |
929 | than restoring the whole datastore. | |
4cfb1234 | 930 | |
74391d1c DC |
931 | Namespaces |
932 | ^^^^^^^^^^ | |
933 | ||
934 | It is also possible to select and map specific namespaces from a media-set | |
935 | during a restore. This is possible with the ``namespaces`` parameter. | |
6481fd24 | 936 | The format for the parameter is: |
74391d1c DC |
937 | |
938 | .. code-block:: console | |
939 | ||
940 | store=<source-datastore>[,source=<source-ns>][,target=<target-ns>][,max-depth=<depth>] | |
941 | ||
942 | If ``source`` or ``target`` is not given, the root namespace is assumed. | |
943 | When no ``max-depth`` is given, the source namespace will be fully recursed. | |
944 | ||
945 | An example restore command: | |
946 | ||
947 | .. code-block:: console | |
948 | ||
949 | # proxmox-tape restore 9da37a55-aac7-4deb-91c6-482b3b675f30 mystore --namespaces store=sourcedatastore,source=ns1,target=ns2,max-depth=2 | |
950 | ||
951 | The parameter can be given multiple times. It can also be combined with the | |
952 | ``snapshots`` parameter to only restore those snapshots and map them to different | |
953 | namespaces. | |
954 | ||
baefbc44 DM |
955 | Update Inventory |
956 | ~~~~~~~~~~~~~~~~ | |
957 | ||
4cfb1234 | 958 | |
baefbc44 DM |
959 | Restore Catalog |
960 | ~~~~~~~~~~~~~~~ | |
9738dd54 | 961 | |
a5f30a56 DC |
962 | To restore a catalog from an existing tape, just insert the tape into the drive |
963 | and execute: | |
964 | ||
965 | .. code-block:: console | |
966 | ||
967 | # proxmox-tape catalog | |
968 | ||
969 | ||
970 | You can restore from a tape even without an existing catalog, but only the | |
971 | whole media set. If you do this, the catalog will be automatically created. | |
972 | ||
4cfb1234 | 973 | |
794b0fe9 DM |
974 | Encryption Key Management |
975 | ~~~~~~~~~~~~~~~~~~~~~~~~~ | |
976 | ||
53939bb4 | 977 | .. image:: images/screenshots/pbs-gui-tape-crypt-keys.png |
5565e454 | 978 | :target: _images/pbs-gui-tape-crypt-keys.png |
53939bb4 DW |
979 | :align: right |
980 | :alt: Tape Backup: Encryption Keys | |
981 | ||
982 | Proxmox Backup Server also provides an interface for handling encryption keys on | |
983 | the backup server. Encryption keys can be managed from the **Tape Backup -> | |
8c83b75a NU |
984 | Encryption Keys** section of the GUI or through the ``proxmox-tape key`` |
985 | command-line tool. To create a new encryption key from the command line: | |
98cdee78 DM |
986 | |
987 | .. code-block:: console | |
794b0fe9 DM |
988 | |
989 | # proxmox-tape key create --hint "tape pw 2020" | |
990 | Tape Encryption Key Password: ********** | |
991 | Verify Password: ********** | |
992 | "14:f8:79:b9:f5:13:e5:dc:bf:b6:f9:88:48:51:81:dc:79:bf:a0:22:68:47:d1:73:35:2d:b6:20:e1:7f:f5:0f" | |
993 | ||
98cdee78 DM |
994 | List existing encryption keys: |
995 | ||
996 | .. code-block:: console | |
794b0fe9 DM |
997 | |
998 | # proxmox-tape key list | |
999 | ┌───────────────────────────────────────────────────┬───────────────┐ | |
1000 | │ fingerprint │ hint │ | |
1001 | ╞═══════════════════════════════════════════════════╪═══════════════╡ | |
1002 | │ 14:f8:79:b9:f5:13:e5:dc: ... :b6:20:e1:7f:f5:0f │ tape pw 2020 │ | |
1003 | └───────────────────────────────────────────────────┴───────────────┘ | |
1004 | ||
98cdee78 DM |
1005 | To show encryption key details: |
1006 | ||
1007 | .. code-block:: console | |
794b0fe9 DM |
1008 | |
1009 | # proxmox-tape key show 14:f8:79:b9:f5:13:e5:dc:...:b6:20:e1:7f:f5:0f | |
1010 | ┌─────────────┬───────────────────────────────────────────────┐ | |
1011 | │ Name │ Value │ | |
1012 | ╞═════════════╪═══════════════════════════════════════════════╡ | |
1013 | │ kdf │ scrypt │ | |
1014 | ├─────────────┼───────────────────────────────────────────────┤ | |
1015 | │ created │ Sat Jan 23 14:47:21 2021 │ | |
1016 | ├─────────────┼───────────────────────────────────────────────┤ | |
1017 | │ modified │ Sat Jan 23 14:47:21 2021 │ | |
1018 | ├─────────────┼───────────────────────────────────────────────┤ | |
1019 | │ fingerprint │ 14:f8:79:b9:f5:13:e5:dc:...:b6:20:e1:7f:f5:0f │ | |
1020 | ├─────────────┼───────────────────────────────────────────────┤ | |
1021 | │ hint │ tape pw 2020 │ | |
1022 | └─────────────┴───────────────────────────────────────────────┘ | |
1023 | ||
8ba47929 DM |
1024 | The ``paperkey`` subcommand can be used to create a QR encoded |
1025 | version of a tape encryption key. The following command sends the output of the | |
98cdee78 DM |
1026 | ``paperkey`` command to a text file, for easy printing: |
1027 | ||
1028 | .. code-block:: console | |
8ba47929 DM |
1029 | |
1030 | proxmox-tape key paperkey <fingerprint> --output-format text > qrkey.txt | |
1031 | ||
1032 | ||
225affc9 | 1033 | .. _tape_restore_encryption_key: |
794b0fe9 DM |
1034 | |
1035 | Restoring Encryption Keys | |
1036 | ^^^^^^^^^^^^^^^^^^^^^^^^^ | |
1037 | ||
1038 | You can restore the encryption key from the tape, using the password | |
1039 | used to generate the key. First, load the tape you want to restore | |
98cdee78 DM |
1040 | into the drive. Then run: |
1041 | ||
1042 | .. code-block:: console | |
794b0fe9 DM |
1043 | |
1044 | # proxmox-tape key restore | |
9aa8df5b | 1045 | Tape Encryption Key Password: *********** |
794b0fe9 DM |
1046 | |
1047 | If the password is correct, the key will get imported to the | |
02633961 | 1048 | database. Further restore jobs automatically use any available key. |
794b0fe9 | 1049 | |
4cfb1234 | 1050 | |
9738dd54 DM |
1051 | Tape Cleaning |
1052 | ~~~~~~~~~~~~~ | |
1053 | ||
70d00e01 | 1054 | LTO tape drives require regular cleaning. This is done by loading a |
9738dd54 DM |
1055 | cleaning cartridge into the drive, which is a manual task for |
1056 | standalone drives. | |
1057 | ||
1058 | For tape libraries, cleaning cartridges are identified using special | |
1059 | labels starting with letters "CLN". For example, our tape library has a | |
98cdee78 DM |
1060 | cleaning cartridge inside slot 3: |
1061 | ||
1062 | .. code-block:: console | |
9738dd54 DM |
1063 | |
1064 | # proxmox-tape changer status sl3 | |
1065 | ┌───────────────┬──────────┬────────────┬─────────────┐ | |
1066 | │ entry-kind │ entry-id │ changer-id │ loaded-slot │ | |
1067 | ╞═══════════════╪══════════╪════════════╪═════════════╡ | |
1068 | │ drive │ 0 │ vtape1 │ 1 │ | |
1069 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
1070 | │ slot │ 1 │ │ │ | |
1071 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
1072 | │ slot │ 2 │ vtape2 │ │ | |
1073 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
1074 | │ slot │ 3 │ CLN001CU │ │ | |
1075 | ├───────────────┼──────────┼────────────┼─────────────┤ | |
1076 | │ ... │ ... │ │ │ | |
1077 | └───────────────┴──────────┴────────────┴─────────────┘ | |
1078 | ||
98cdee78 DM |
1079 | To initiate a cleaning operation simply run: |
1080 | ||
1081 | .. code-block:: console | |
9738dd54 DM |
1082 | |
1083 | # proxmox-tape clean | |
1084 | ||
1085 | This command does the following: | |
1086 | ||
1087 | - find the cleaning tape (in slot 3) | |
1088 | ||
70d00e01 | 1089 | - unload the current media from the drive (back to slot 1) |
9738dd54 DM |
1090 | |
1091 | - load the cleaning tape into the drive | |
1092 | ||
1093 | - run drive cleaning operation | |
1094 | ||
1095 | - unload the cleaning tape (to slot 3) | |
9c96e536 | 1096 | |
59efe20b DC |
1097 | WORM Tapes |
1098 | ---------- | |
1099 | ||
48f37f48 AL |
1100 | WORM (write once, read many) tapes are special cartridges that cannot be |
1101 | deleted or overwritten. This may be useful for legal or protection purposes. | |
59efe20b | 1102 | |
48f37f48 AL |
1103 | If you want to use them, you must use a media pool with a retention policy of |
1104 | `keep`. Otherwise, a backup job can fail when it tries to erase or overwrite | |
1105 | the tape. | |
1106 | ||
1107 | Proxmox Backup Server makes no distinction between normal and WORM tapes. To | |
1108 | avoid confusion, use a different naming scheme for WORM backups and use | |
1109 | dedicated media pools for them. Do not mix WORM and non-WORM tapes in the same | |
1110 | media pool. | |
59efe20b | 1111 | |
59efe20b | 1112 | |
9c96e536 DC |
1113 | Example Setups |
1114 | -------------- | |
1115 | ||
6481fd24 | 1116 | Here are a few example setups for managing media pools and schedules. |
9c96e536 DC |
1117 | This is not an exhaustive list, and there are many more possible combinations |
1118 | of useful settings. | |
1119 | ||
bd030091 DC |
1120 | Single Continued Media Set |
1121 | ~~~~~~~~~~~~~~~~~~~~~~~~~~ | |
9c96e536 | 1122 | |
bd030091 | 1123 | The most simple setup: always continue the media-set and never expire. |
9c96e536 DC |
1124 | |
1125 | Allocation policy: | |
1126 | continue | |
1127 | ||
1128 | Retention policy: | |
1129 | keep | |
1130 | ||
6481fd24 DW |
1131 | This setup has the advantage of being easy to manage and reuses the benefits |
1132 | from deduplication as much as possible. But, it also provides no redundancy, | |
1133 | meaning a failure of any single tape would render all backups referring to | |
1134 | chunks from that tape unusable. | |
bd030091 DC |
1135 | |
1136 | If you want to start a new media-set manually, you can set the currently | |
1137 | writable media of the set either to 'full', or set the location to an | |
6481fd24 | 1138 | off-site vault. |
9c96e536 DC |
1139 | |
1140 | Weekday Scheme | |
1141 | ~~~~~~~~~~~~~~ | |
1142 | ||
bd030091 DC |
1143 | A slightly more complex scheme, where the goal is to have an independent |
1144 | tape or media set for each weekday, for example from Monday to Friday. | |
1145 | This can be solved by having a separate media pool for each day, so 'Monday', | |
1146 | 'Tuesday', etc. | |
9c96e536 DC |
1147 | |
1148 | Allocation policy: | |
1149 | should be 'mon' for the 'Monday' pool, 'tue' for the Tuesday pool and so on. | |
1150 | ||
1151 | Retention policy: | |
1152 | overwrite | |
1153 | ||
6481fd24 | 1154 | There should be one or more tape-backup jobs for each pool on the corresponding |
bd030091 | 1155 | weekday. This scheme is still very manageable with one media set per weekday, |
6481fd24 | 1156 | and could be moved off-site easily. |
9c96e536 | 1157 | |
eb080f36 | 1158 | Multiple Pools with Different Policies |
bd030091 | 1159 | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
9c96e536 | 1160 | |
6481fd24 | 1161 | Complex setups are also possible, with multiple media pools configured with |
9c96e536 DC |
1162 | different allocation and retention policies. |
1163 | ||
eb080f36 TL |
1164 | An example would be to have two media pools. The first configured with weekly |
1165 | allocation and a few weeks of retention: | |
9c96e536 DC |
1166 | |
1167 | Allocation policy: | |
1168 | mon | |
1169 | ||
1170 | Retention policy: | |
1171 | 3 weeks | |
1172 | ||
6481fd24 | 1173 | The second pool configured with yearly allocation that does not expire: |
9c96e536 DC |
1174 | |
1175 | Allocation policy: | |
1176 | yearly | |
1177 | ||
1178 | Retention policy: | |
1179 | keep | |
1180 | ||
6481fd24 DW |
1181 | In combination with fitting prune settings and tape backup schedules, this |
1182 | achieves long-term storage of some backups, while keeping the recent | |
1183 | backups on smaller media sets that expire roughly every 4 weeks (that is, three | |
1184 | plus the current week). |