4 The command line client is called :command:`proxmox-backup-client`.
10 The client uses the following notation to specify a datastore repository
13 [[username@]server[:port]:]datastore
15 The default value for ``username`` is ``root@pam``. If no server is specified,
16 the default is the local host (``localhost``).
18 You can specify a port if your backup server is only reachable on a different
19 port (e.g. with NAT and port forwarding).
21 Note that if the server is an IPv6 address, you have to write it with square
22 brackets (for example, `[fe80::01]`).
24 You can pass the repository with the ``--repository`` command line option, or
25 by setting the ``PBS_REPOSITORY`` environment variable.
27 Here some examples of valid repositories and the real values
29 ================================ ================== ================== ===========
30 Example User Host:Port Datastore
31 ================================ ================== ================== ===========
32 mydatastore ``root@pam`` localhost:8007 mydatastore
33 myhostname:mydatastore ``root@pam`` myhostname:8007 mydatastore
34 user@pbs@myhostname:mydatastore ``user@pbs`` myhostname:8007 mydatastore
35 user\@pbs!token@host:store ``user@pbs!token`` myhostname:8007 mydatastore
36 192.168.55.55:1234:mydatastore ``root@pam`` 192.168.55.55:1234 mydatastore
37 [ff80::51]:mydatastore ``root@pam`` [ff80::51]:8007 mydatastore
38 [ff80::51]:1234:mydatastore ``root@pam`` [ff80::51]:1234 mydatastore
39 ================================ ================== ================== ===========
45 The default backup repository.
48 When set, this value is used for the password required for the backup server.
49 You can also set this to a API token secret.
51 ``PBS_ENCRYPTION_PASSWORD``
52 When set, this value is used to access the secret encryption key (if
53 protected by password).
55 ``PBS_FINGERPRINT`` When set, this value is used to verify the server
56 certificate (only used if the system CA certificates cannot validate the
63 .. include:: output-format.rst
66 .. _client_creating_backups:
71 This section explains how to create a backup from within the machine. This can
72 be a physical host, a virtual machine, or a container. Such backups may contain file
73 and image archives. There are no restrictions in this case.
75 .. note:: If you want to backup virtual machines or containers on Proxmox VE, see :ref:`pve-integration`.
77 For the following example you need to have a backup server set up, working
78 credentials and need to know the repository name.
79 In the following examples we use ``backup-server:store1``.
81 .. code-block:: console
83 # proxmox-backup-client backup root.pxar:/ --repository backup-server:store1
84 Starting backup: host/elsa/2019-12-03T09:35:01Z
86 skip mount point: "/boot/efi"
87 skip mount point: "/dev"
88 skip mount point: "/run"
89 skip mount point: "/sys"
90 Uploaded 12129 chunks in 87 seconds (564 MB/s).
91 End Time: 2019-12-03T10:36:29+01:00
93 This will prompt you for a password and then uploads a file archive named
94 ``root.pxar`` containing all the files in the ``/`` directory.
96 .. Caution:: Please note that the proxmox-backup-client does not
97 automatically include mount points. Instead, you will see a short
98 ``skip mount point`` notice for each of them. The idea is to
99 create a separate file archive for each mounted disk. You can
100 explicitly include them using the ``--include-dev`` option
101 (i.e. ``--include-dev /boot/efi``). You can use this option
102 multiple times for each mount point that should be included.
104 The ``--repository`` option can get quite long and is used by all
105 commands. You can avoid having to enter this value by setting the
106 environment variable ``PBS_REPOSITORY``. Note that if you would like this to remain set
107 over multiple sessions, you should instead add the below line to your
110 .. code-block:: console
112 # export PBS_REPOSITORY=backup-server:store1
114 After this you can execute all commands without specifying the ``--repository``
117 One single backup is allowed to contain more than one archive. For example, if
118 you want to backup two disks mounted at ``/mnt/disk1`` and ``/mnt/disk2``:
120 .. code-block:: console
122 # proxmox-backup-client backup disk1.pxar:/mnt/disk1 disk2.pxar:/mnt/disk2
124 This creates a backup of both disks.
126 The backup command takes a list of backup specifications, which
127 include the archive name on the server, the type of the archive, and the
128 archive source at the client. The format is:
130 <archive-name>.<type>:<source-path>
132 Common types are ``.pxar`` for file archives, and ``.img`` for block
133 device images. To create a backup of a block device run the following command:
135 .. code-block:: console
137 # proxmox-backup-client backup mydata.img:/dev/mylvm/mydata
140 Excluding files/folders from a backup
141 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
143 Sometimes it is desired to exclude certain files or folders from a backup archive.
144 To tell the Proxmox Backup client when and how to ignore files and directories,
145 place a text file called ``.pxarexclude`` in the filesystem hierarchy.
146 Whenever the backup client encounters such a file in a directory, it interprets
147 each line as glob match patterns for files and directories that are to be excluded
150 The file must contain a single glob pattern per line. Empty lines are ignored.
151 The same is true for lines starting with ``#``, which indicates a comment.
152 A ``!`` at the beginning of a line reverses the glob match pattern from an exclusion
153 to an explicit inclusion. This makes it possible to exclude all entries in a
154 directory except for a few single files/subdirectories.
155 Lines ending in ``/`` match only on directories.
156 The directory containing the ``.pxarexclude`` file is considered to be the root of
157 the given patterns. It is only possible to match files in this directory and its subdirectories.
159 ``\`` is used to escape special glob characters.
160 ``?`` matches any single character.
161 ``*`` matches any character, including an empty string.
162 ``**`` is used to match subdirectories. It can be used to, for example, exclude
163 all files ending in ``.tmp`` within the directory or subdirectories with the
164 following pattern ``**/*.tmp``.
165 ``[...]`` matches a single character from any of the provided characters within
166 the brackets. ``[!...]`` does the complementary and matches any single character
167 not contained within the brackets. It is also possible to specify ranges with two
168 characters separated by ``-``. For example, ``[a-z]`` matches any lowercase
169 alphabetic character and ``[0-9]`` matches any one single digit.
171 The order of the glob match patterns defines whether a file is included or
172 excluded, that is to say later entries override previous ones.
173 This is also true for match patterns encountered deeper down the directory tree,
174 which can override a previous exclusion.
175 Be aware that excluded directories will **not** be read by the backup client.
176 Thus, a ``.pxarexclude`` file in an excluded subdirectory will have no effect.
177 ``.pxarexclude`` files are treated as regular files and will be included in the
180 For example, consider the following directory structure:
182 .. code-block:: console
186 . .. .pxarexclude subfolder0 subfolder1
189 . .. file0 file1 file2 file3 .pxarexclude
192 . .. file0 file1 file2 file3
194 The different ``.pxarexclude`` files contain the following:
196 .. code-block:: console
198 # cat folder/.pxarexclude
203 .. code-block:: console
205 # cat folder/subfolder0/.pxarexclude
208 This would exclude ``file1`` and ``file3`` in ``subfolder0`` and all of
209 ``subfolder1`` except ``file2``.
211 Restoring this backup will result in:
213 .. code-block:: console
217 . .. .pxarexclude subfolder0 subfolder1
220 . .. file0 file2 .pxarexclude
226 .. _client_encryption:
231 Proxmox Backup supports client-side encryption with AES-256 in GCM_
232 mode. To set this up, you first need to create an encryption key:
234 .. code-block:: console
236 # proxmox-backup-client key create my-backup.key
237 Encryption Key Password: **************
239 The key is password protected by default. If you do not need this
240 extra protection, you can also create it without a password:
242 .. code-block:: console
244 # proxmox-backup-client key create /path/to/my-backup.key --kdf none
246 Having created this key, it is now possible to create an encrypted backup, by
247 passing the ``--keyfile`` parameter, with the path to the key file.
249 .. code-block:: console
251 # proxmox-backup-client backup etc.pxar:/etc --keyfile /path/to/my-backup.key
253 Encryption Key Password: **************
256 .. Note:: If you do not specify the name of the backup key, the key will be
257 created in the default location
258 ``~/.config/proxmox-backup/encryption-key.json``. ``proxmox-backup-client``
259 will also search this location by default, in case the ``--keyfile``
260 parameter is not specified.
262 You can avoid entering the passwords by setting the environment
263 variables ``PBS_PASSWORD`` and ``PBS_ENCRYPTION_PASSWORD``.
266 Using a master key to store and recover encryption keys
267 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
269 You can also use ``proxmox-backup-client key`` to create an RSA public/private
270 key pair, which can be used to store an encrypted version of the symmetric
271 backup encryption key alongside each backup and recover it later.
273 To set up a master key:
275 1. Create an encryption key for the backup:
277 .. code-block:: console
279 # proxmox-backup-client key create
280 creating default key at: "~/.config/proxmox-backup/encryption-key.json"
281 Encryption Key Password: **********
284 The resulting file will be saved to ``~/.config/proxmox-backup/encryption-key.json``.
286 2. Create an RSA public/private key pair:
288 .. code-block:: console
290 # proxmox-backup-client key create-master-key
291 Master Key Password: *********
294 This will create two files in your current directory, ``master-public.pem``
295 and ``master-private.pem``.
297 3. Import the newly created ``master-public.pem`` public certificate, so that
298 ``proxmox-backup-client`` can find and use it upon backup.
300 .. code-block:: console
302 # proxmox-backup-client key import-master-pubkey /path/to/master-public.pem
303 Imported public master key to "~/.config/proxmox-backup/master-public.pem"
305 4. With all these files in place, run a backup job:
307 .. code-block:: console
309 # proxmox-backup-client backup etc.pxar:/etc
311 The key will be stored in your backup, under the name ``rsa-encrypted.key``.
313 .. Note:: The ``--keyfile`` parameter can be excluded, if the encryption key
314 is in the default path. If you specified another path upon creation, you
315 must pass the ``--keyfile`` parameter.
317 5. To test that everything worked, you can restore the key from the backup:
319 .. code-block:: console
321 # proxmox-backup-client restore /path/to/backup/ rsa-encrypted.key /path/to/target
323 .. Note:: You should not need an encryption key to extract this file. However, if
324 a key exists at the default location
325 (``~/.config/proxmox-backup/encryption-key.json``) the program will prompt
326 you for an encryption key password. Simply moving ``encryption-key.json``
327 out of this directory will fix this issue.
329 6. Then, use the previously generated master key to decrypt the file:
331 .. code-block:: console
333 # proxmox-backup-client key import-with-master-key /path/to/target --master-keyfile /path/to/master-private.pem --encrypted-keyfile /path/to/rsa-encrypted.key
334 Master Key Password: ******
336 Verify Password: ******
338 7. The target file will now contain the encryption key information in plain
339 text. The success of this can be confirmed by passing the resulting ``json``
340 file, with the ``--keyfile`` parameter, when decrypting files from the backup.
342 .. warning:: Without their key, backed up files will be inaccessible. Thus, you should
343 keep keys ordered and in a place that is separate from the contents being
344 backed up. It can happen, for example, that you back up an entire system, using
345 a key on that system. If the system then becomes inaccessible for any reason
346 and needs to be restored, this will not be possible as the encryption key will be
347 lost along with the broken system.
349 It is recommended that you keep your master key safe, but easily accessible, in
350 order for quick disaster recovery. For this reason, the best place to store it
351 is in your password manager, where it is immediately recoverable. As a backup to
352 this, you should also save the key to a USB drive and store that in a secure
353 place. This way, it is detached from any system, but is still easy to recover
354 from, in case of emergency. Finally, in preparation for the worst case scenario,
355 you should also consider keeping a paper copy of your master key locked away in
356 a safe place. The ``paperkey`` subcommand can be used to create a QR encoded
357 version of your master key. The following command sends the output of the
358 ``paperkey`` command to a text file, for easy printing.
360 .. code-block:: console
362 proxmox-backup-client key paperkey --output-format text > qrkey.txt
368 The regular creation of backups is a necessary step to avoiding data
369 loss. More importantly, however, is the restoration. It is good practice to perform
370 periodic recovery tests to ensure that you can access the data in
373 First, you need to find the snapshot which you want to restore. The snapshot
374 list command provides a list of all the snapshots on the server:
376 .. code-block:: console
378 # proxmox-backup-client snapshot list
379 ┌────────────────────────────────┬─────────────┬────────────────────────────────────┐
380 │ snapshot │ size │ files │
381 ╞════════════════════════════════╪═════════════╪════════════════════════════════════╡
382 │ host/elsa/2019-12-03T09:30:15Z │ 51788646825 │ root.pxar catalog.pcat1 index.json │
383 ├────────────────────────────────┼─────────────┼────────────────────────────────────┤
384 │ host/elsa/2019-12-03T09:35:01Z │ 51790622048 │ root.pxar catalog.pcat1 index.json │
385 ├────────────────────────────────┼─────────────┼────────────────────────────────────┤
388 You can inspect the catalog to find specific files.
390 .. code-block:: console
392 # proxmox-backup-client catalog dump host/elsa/2019-12-03T09:35:01Z
394 d "./root.pxar.didx/etc/cifs-utils"
395 l "./root.pxar.didx/etc/cifs-utils/idmap-plugin"
396 d "./root.pxar.didx/etc/console-setup"
399 The restore command lets you restore a single archive from the
402 .. code-block:: console
404 # proxmox-backup-client restore host/elsa/2019-12-03T09:35:01Z root.pxar /target/path/
406 To get the contents of any archive, you can restore the ``index.json`` file in the
407 repository to the target path '-'. This will dump the contents to the standard output.
409 .. code-block:: console
411 # proxmox-backup-client restore host/elsa/2019-12-03T09:35:01Z index.json -
417 If you only want to restore a few individual files, it is often easier
418 to use the interactive recovery shell.
420 .. code-block:: console
422 # proxmox-backup-client catalog shell host/elsa/2019-12-03T09:35:01Z root.pxar
423 Starting interactive shell
425 bin boot dev etc home lib lib32
428 The interactive recovery shell is a minimal command line interface that
429 utilizes the metadata stored in the catalog to quickly list, navigate and
430 search files in a file archive.
431 To restore files, you can select them individually or match them with a glob
434 Using the catalog for navigation reduces the overhead considerably because only
435 the catalog needs to be downloaded and, optionally, decrypted.
436 The actual chunks are only accessed if the metadata in the catalog is not enough
437 or for the actual restore.
439 Similar to common UNIX shells ``cd`` and ``ls`` are the commands used to change
440 working directory and list directory contents in the archive.
441 ``pwd`` shows the full path of the current working directory with respect to the
444 Being able to quickly search the contents of the archive is a commonly needed feature.
445 That's where the catalog is most valuable.
448 .. code-block:: console
450 pxar:/ > find etc/**/*.txt --select
452 pxar:/ > list-selected
454 pxar:/ > restore-selected /target/path
457 This will find and print all files ending in ``.txt`` located in ``etc/`` or a
458 subdirectory and add the corresponding pattern to the list for subsequent restores.
459 ``list-selected`` shows these patterns and ``restore-selected`` finally restores
460 all files in the archive matching the patterns to ``/target/path`` on the local
461 host. This will scan the whole archive.
463 The ``restore`` command can be used to restore all the files contained within
464 the backup archive. This is most helpful when paired with the ``--pattern
465 <glob>`` option, as it allows you to restore all files matching a specific
466 pattern. For example, if you wanted to restore configuration files
467 located in ``/etc``, you could do the following:
469 .. code-block:: console
471 pxar:/ > restore target/ --pattern etc/**/*.conf
474 The above will scan trough all the directories below ``/etc`` and restore all
475 files ending in ``.conf``.
477 .. todo:: Explain interactive restore in more detail
479 Mounting of Archives via FUSE
480 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
482 The :term:`FUSE` implementation for the pxar archive allows you to mount a
483 file archive as a read-only filesystem to a mountpoint on your host.
485 .. code-block:: console
487 # proxmox-backup-client mount host/backup-client/2020-01-29T11:29:22Z root.pxar /mnt/mountpoint
489 bin dev home lib32 libx32 media opt root sbin sys usr
490 boot etc lib lib64 lost+found mnt proc run srv tmp var
492 This allows you to access the full contents of the archive in a seamless manner.
494 .. note:: As the FUSE connection needs to fetch and decrypt chunks from the
495 backup server's datastore, this can cause some additional network and CPU
496 load on your host, depending on the operations you perform on the mounted
499 To unmount the filesystem use the ``umount`` command on the mountpoint:
501 .. code-block:: console
503 # umount /mnt/mountpoint
508 The client tool prompts you to enter the logon password as soon as you
509 want to access the backup server. The server checks your credentials
510 and responds with a ticket that is valid for two hours. The client
511 tool automatically stores that ticket and uses it for further requests
514 You can also manually trigger this login/logout using the login and
517 .. code-block:: console
519 # proxmox-backup-client login
522 To remove the ticket, issue a logout:
524 .. code-block:: console
526 # proxmox-backup-client logout
529 .. _changing-backup-owner:
531 Changing the Owner of a Backup Group
532 ------------------------------------
534 By default, the owner of a backup group is the user which was used to originally
535 create that backup group (or in the case of sync jobs, ``root@pam``). This
536 means that if a user ``mike@pbs`` created a backup, another user ``john@pbs``
537 can not be used to create backups in that same backup group. In case you want
538 to change the owner of a backup, you can do so with the below command, using a
539 user that has ``Datastore.Modify`` privileges on the datastore.
541 .. code-block:: console
543 # proxmox-backup-client change-owner vm/103 john@pbs
545 This can also be done from within the web interface, by navigating to the
546 `Content` section of the datastore that contains the backup group and
547 selecting the user icon under the `Actions` column. Common cases for this could
548 be to change the owner of a sync job from ``root@pam``, or to repurpose a
554 Pruning and Removing Backups
555 ----------------------------
557 You can manually delete a backup snapshot using the ``forget``
560 .. code-block:: console
562 # proxmox-backup-client snapshot forget <snapshot>
565 .. caution:: This command removes all archives in this backup
566 snapshot. They will be inaccessible and unrecoverable.
569 Although manual removal is sometimes required, the ``prune``
570 command is normally used to systematically delete older backups. Prune lets
571 you specify which backup snapshots you want to keep. The
572 following retention options are available:
575 Keep the last ``<N>`` backup snapshots.
577 ``--keep-hourly <N>``
578 Keep backups for the last ``<N>`` hours. If there is more than one
579 backup for a single hour, only the latest is kept.
582 Keep backups for the last ``<N>`` days. If there is more than one
583 backup for a single day, only the latest is kept.
585 ``--keep-weekly <N>``
586 Keep backups for the last ``<N>`` weeks. If there is more than one
587 backup for a single week, only the latest is kept.
589 .. note:: Weeks start on Monday and end on Sunday. The software
590 uses the `ISO week date`_ system and handles weeks at
591 the end of the year correctly.
593 ``--keep-monthly <N>``
594 Keep backups for the last ``<N>`` months. If there is more than one
595 backup for a single month, only the latest is kept.
597 ``--keep-yearly <N>``
598 Keep backups for the last ``<N>`` years. If there is more than one
599 backup for a single year, only the latest is kept.
601 The retention options are processed in the order given above. Each option
602 only covers backups within its time period. The next option does not take care
603 of already covered backups. It will only consider older backups.
605 Unfinished and incomplete backups will be removed by the prune command unless
606 they are newer than the last successful backup. In this case, the last failed
609 .. code-block:: console
611 # proxmox-backup-client prune <group> --keep-daily 7 --keep-weekly 4 --keep-monthly 3
614 You can use the ``--dry-run`` option to test your settings. This only
615 shows the list of existing snapshots and what actions prune would take.
617 .. code-block:: console
619 # proxmox-backup-client prune host/elsa --dry-run --keep-daily 1 --keep-weekly 3
620 ┌────────────────────────────────┬──────┐
622 ╞════════════════════════════════╪══════╡
623 │ host/elsa/2019-12-04T13:20:37Z │ 1 │
624 ├────────────────────────────────┼──────┤
625 │ host/elsa/2019-12-03T09:35:01Z │ 0 │
626 ├────────────────────────────────┼──────┤
627 │ host/elsa/2019-11-22T11:54:47Z │ 1 │
628 ├────────────────────────────────┼──────┤
629 │ host/elsa/2019-11-21T12:36:25Z │ 0 │
630 ├────────────────────────────────┼──────┤
631 │ host/elsa/2019-11-10T10:42:20Z │ 1 │
632 └────────────────────────────────┴──────┘
634 .. note:: Neither the ``prune`` command nor the ``forget`` command free space
635 in the chunk-store. The chunk-store still contains the data blocks. To free
636 space you need to perform :ref:`client_garbage-collection`.
639 .. _client_garbage-collection:
644 The ``prune`` command removes only the backup index files, not the data
645 from the datastore. This task is left to the garbage collection
646 command. It is recommended to carry out garbage collection on a regular basis.
648 The garbage collection works in two phases. In the first phase, all
649 data blocks that are still in use are marked. In the second phase,
650 unused data blocks are removed.
652 .. note:: This command needs to read all existing backup index files
653 and touches the complete chunk-store. This can take a long time
654 depending on the number of chunks and the speed of the underlying
657 .. note:: The garbage collection will only remove chunks that haven't been used
658 for at least one day (exactly 24h 5m). This grace period is necessary because
659 chunks in use are marked by touching the chunk which updates the ``atime``
660 (access time) property. Filesystems are mounted with the ``relatime`` option
661 by default. This results in a better performance by only updating the
662 ``atime`` property if the last access has been at least 24 hours ago. The
663 downside is, that touching a chunk within these 24 hours will not always
664 update its ``atime`` property.
666 Chunks in the grace period will be logged at the end of the garbage
667 collection task as *Pending removals*.
669 .. code-block:: console
671 # proxmox-backup-client garbage-collect
672 starting garbage collection on store store2
673 Start GC phase1 (mark used chunks)
674 Start GC phase2 (sweep unused chunks)
675 percentage done: 1, chunk count: 219
676 percentage done: 2, chunk count: 453
678 percentage done: 99, chunk count: 21188
679 Removed bytes: 411368505
681 Original data bytes: 327160886391
682 Disk bytes: 52767414743 (16 %)
684 Average chunk size: 2486565
688 .. todo:: howto run garbage-collection at regular intervals (cron)
693 The backup client also comes with a benchmarking tool. This tool measures
694 various metrics relating to compression and encryption speeds. You can run a
695 benchmark using the ``benchmark`` subcommand of ``proxmox-backup-client``:
697 .. code-block:: console
699 # proxmox-backup-client benchmark
700 Uploaded 1517 chunks in 5 seconds.
701 Time per request: 3309 microseconds.
702 TLS speed: 1267.41 MB/s
703 SHA256 speed: 2066.73 MB/s
704 Compression speed: 775.11 MB/s
705 Decompress speed: 1233.35 MB/s
706 AES256/GCM speed: 3688.27 MB/s
707 Verify speed: 783.43 MB/s
708 ┌───────────────────────────────────┬─────────────────────┐
710 ╞═══════════════════════════════════╪═════════════════════╡
711 │ TLS (maximal backup upload speed) │ 1267.41 MB/s (103%) │
712 ├───────────────────────────────────┼─────────────────────┤
713 │ SHA256 checksum computation speed │ 2066.73 MB/s (102%) │
714 ├───────────────────────────────────┼─────────────────────┤
715 │ ZStd level 1 compression speed │ 775.11 MB/s (103%) │
716 ├───────────────────────────────────┼─────────────────────┤
717 │ ZStd level 1 decompression speed │ 1233.35 MB/s (103%) │
718 ├───────────────────────────────────┼─────────────────────┤
719 │ Chunk verification speed │ 783.43 MB/s (103%) │
720 ├───────────────────────────────────┼─────────────────────┤
721 │ AES256 GCM encryption speed │ 3688.27 MB/s (101%) │
722 └───────────────────────────────────┴─────────────────────┘
725 .. note:: The percentages given in the output table correspond to a
726 comparison against a Ryzen 7 2700X. The TLS test connects to the
727 local host, so there is no network involved.
729 You can also pass the ``--output-format`` parameter to output stats in ``json``,
730 rather than the default table format.