4 The command line client is called :command:`proxmox-backup-client`.
10 The client uses the following notation to specify a datastore repository
13 [[username@]server[:port]:]datastore
15 The default value for ``username`` is ``root@pam``. If no server is specified,
16 the default is the local host (``localhost``).
18 You can specify a port if your backup server is only reachable on a different
19 port (e.g. with NAT and port forwarding).
21 Note that if the server is an IPv6 address, you have to write it with square
22 brackets (for example, `[fe80::01]`).
24 You can pass the repository with the ``--repository`` command line option, or
25 by setting the ``PBS_REPOSITORY`` environment variable.
27 Here some examples of valid repositories and the real values
29 ================================ ================== ================== ===========
30 Example User Host:Port Datastore
31 ================================ ================== ================== ===========
32 mydatastore ``root@pam`` localhost:8007 mydatastore
33 myhostname:mydatastore ``root@pam`` myhostname:8007 mydatastore
34 user@pbs@myhostname:mydatastore ``user@pbs`` myhostname:8007 mydatastore
35 user@pbs!token@host:store ``user@pbs!token`` myhostname:8007 mydatastore
36 192.168.55.55:1234:mydatastore ``root@pam`` 192.168.55.55:1234 mydatastore
37 [ff80::51]:mydatastore ``root@pam`` [ff80::51]:8007 mydatastore
38 [ff80::51]:1234:mydatastore ``root@pam`` [ff80::51]:1234 mydatastore
39 ================================ ================== ================== ===========
45 The default backup repository.
48 When set, this value is used for the password required for the backup server.
49 You can also set this to a API token secret.
51 ``PBS_ENCRYPTION_PASSWORD``
52 When set, this value is used to access the secret encryption key (if
53 protected by password).
55 ``PBS_FINGERPRINT`` When set, this value is used to verify the server
56 certificate (only used if the system CA certificates cannot validate the
63 Most commands support the ``--output-format`` parameter. It accepts
66 :``text``: Text format (default). Structured data is rendered as a table.
68 :``json``: JSON (single line).
70 :``json-pretty``: JSON (multiple lines, nicely formatted).
73 Please use the following environment variables to modify output behavior:
75 ``PROXMOX_OUTPUT_FORMAT``
76 Defines the default output format.
78 ``PROXMOX_OUTPUT_NO_BORDER``
79 If set (to any value), do not render table borders.
81 ``PROXMOX_OUTPUT_NO_HEADER``
82 If set (to any value), do not render table headers.
84 .. note:: The ``text`` format is designed to be human readable, and
85 not meant to be parsed by automation tools. Please use the ``json``
86 format if you need to process the output.
94 This section explains how to create a backup from within the machine. This can
95 be a physical host, a virtual machine, or a container. Such backups may contain file
96 and image archives. There are no restrictions in this case.
98 .. note:: If you want to backup virtual machines or containers on Proxmox VE, see :ref:`pve-integration`.
100 For the following example you need to have a backup server set up, working
101 credentials and need to know the repository name.
102 In the following examples we use ``backup-server:store1``.
104 .. code-block:: console
106 # proxmox-backup-client backup root.pxar:/ --repository backup-server:store1
107 Starting backup: host/elsa/2019-12-03T09:35:01Z
109 skip mount point: "/boot/efi"
110 skip mount point: "/dev"
111 skip mount point: "/run"
112 skip mount point: "/sys"
113 Uploaded 12129 chunks in 87 seconds (564 MB/s).
114 End Time: 2019-12-03T10:36:29+01:00
116 This will prompt you for a password and then uploads a file archive named
117 ``root.pxar`` containing all the files in the ``/`` directory.
119 .. Caution:: Please note that the proxmox-backup-client does not
120 automatically include mount points. Instead, you will see a short
121 ``skip mount point`` notice for each of them. The idea is to
122 create a separate file archive for each mounted disk. You can
123 explicitly include them using the ``--include-dev`` option
124 (i.e. ``--include-dev /boot/efi``). You can use this option
125 multiple times for each mount point that should be included.
127 The ``--repository`` option can get quite long and is used by all
128 commands. You can avoid having to enter this value by setting the
129 environment variable ``PBS_REPOSITORY``. Note that if you would like this to remain set
130 over multiple sessions, you should instead add the below line to your
133 .. code-block:: console
135 # export PBS_REPOSITORY=backup-server:store1
137 After this you can execute all commands without specifying the ``--repository``
140 One single backup is allowed to contain more than one archive. For example, if
141 you want to backup two disks mounted at ``/mnt/disk1`` and ``/mnt/disk2``:
143 .. code-block:: console
145 # proxmox-backup-client backup disk1.pxar:/mnt/disk1 disk2.pxar:/mnt/disk2
147 This creates a backup of both disks.
149 The backup command takes a list of backup specifications, which
150 include the archive name on the server, the type of the archive, and the
151 archive source at the client. The format is:
153 <archive-name>.<type>:<source-path>
155 Common types are ``.pxar`` for file archives, and ``.img`` for block
156 device images. To create a backup of a block device run the following command:
158 .. code-block:: console
160 # proxmox-backup-client backup mydata.img:/dev/mylvm/mydata
163 Excluding files/folders from a backup
164 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
166 Sometimes it is desired to exclude certain files or folders from a backup archive.
167 To tell the Proxmox Backup client when and how to ignore files and directories,
168 place a text file called ``.pxarexclude`` in the filesystem hierarchy.
169 Whenever the backup client encounters such a file in a directory, it interprets
170 each line as glob match patterns for files and directories that are to be excluded
173 The file must contain a single glob pattern per line. Empty lines are ignored.
174 The same is true for lines starting with ``#``, which indicates a comment.
175 A ``!`` at the beginning of a line reverses the glob match pattern from an exclusion
176 to an explicit inclusion. This makes it possible to exclude all entries in a
177 directory except for a few single files/subdirectories.
178 Lines ending in ``/`` match only on directories.
179 The directory containing the ``.pxarexclude`` file is considered to be the root of
180 the given patterns. It is only possible to match files in this directory and its subdirectories.
182 ``\`` is used to escape special glob characters.
183 ``?`` matches any single character.
184 ``*`` matches any character, including an empty string.
185 ``**`` is used to match subdirectories. It can be used to, for example, exclude
186 all files ending in ``.tmp`` within the directory or subdirectories with the
187 following pattern ``**/*.tmp``.
188 ``[...]`` matches a single character from any of the provided characters within
189 the brackets. ``[!...]`` does the complementary and matches any single character
190 not contained within the brackets. It is also possible to specify ranges with two
191 characters separated by ``-``. For example, ``[a-z]`` matches any lowercase
192 alphabetic character and ``[0-9]`` matches any one single digit.
194 The order of the glob match patterns defines whether a file is included or
195 excluded, that is to say later entries override previous ones.
196 This is also true for match patterns encountered deeper down the directory tree,
197 which can override a previous exclusion.
198 Be aware that excluded directories will **not** be read by the backup client.
199 Thus, a ``.pxarexclude`` file in an excluded subdirectory will have no effect.
200 ``.pxarexclude`` files are treated as regular files and will be included in the
203 For example, consider the following directory structure:
205 .. code-block:: console
209 . .. .pxarexclude subfolder0 subfolder1
212 . .. file0 file1 file2 file3 .pxarexclude
215 . .. file0 file1 file2 file3
217 The different ``.pxarexclude`` files contain the following:
219 .. code-block:: console
221 # cat folder/.pxarexclude
226 .. code-block:: console
228 # cat folder/subfolder0/.pxarexclude
231 This would exclude ``file1`` and ``file3`` in ``subfolder0`` and all of
232 ``subfolder1`` except ``file2``.
234 Restoring this backup will result in:
236 .. code-block:: console
240 . .. .pxarexclude subfolder0 subfolder1
243 . .. file0 file2 .pxarexclude
254 Proxmox Backup supports client-side encryption with AES-256 in GCM_
255 mode. To set this up, you first need to create an encryption key:
257 .. code-block:: console
259 # proxmox-backup-client key create my-backup.key
260 Encryption Key Password: **************
262 The key is password protected by default. If you do not need this
263 extra protection, you can also create it without a password:
265 .. code-block:: console
267 # proxmox-backup-client key create /path/to/my-backup.key --kdf none
269 Having created this key, it is now possible to create an encrypted backup, by
270 passing the ``--keyfile`` parameter, with the path to the key file.
272 .. code-block:: console
274 # proxmox-backup-client backup etc.pxar:/etc --keyfile /path/to/my-backup.key
276 Encryption Key Password: **************
279 .. Note:: If you do not specify the name of the backup key, the key will be
280 created in the default location
281 ``~/.config/proxmox-backup/encryption-key.json``. ``proxmox-backup-client``
282 will also search this location by default, in case the ``--keyfile``
283 parameter is not specified.
285 You can avoid entering the passwords by setting the environment
286 variables ``PBS_PASSWORD`` and ``PBS_ENCRYPTION_PASSWORD``.
289 Using a master key to store and recover encryption keys
290 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
292 You can also use ``proxmox-backup-client key`` to create an RSA public/private
293 key pair, which can be used to store an encrypted version of the symmetric
294 backup encryption key alongside each backup and recover it later.
296 To set up a master key:
298 1. Create an encryption key for the backup:
300 .. code-block:: console
302 # proxmox-backup-client key create
303 creating default key at: "~/.config/proxmox-backup/encryption-key.json"
304 Encryption Key Password: **********
307 The resulting file will be saved to ``~/.config/proxmox-backup/encryption-key.json``.
309 2. Create an RSA public/private key pair:
311 .. code-block:: console
313 # proxmox-backup-client key create-master-key
314 Master Key Password: *********
317 This will create two files in your current directory, ``master-public.pem``
318 and ``master-private.pem``.
320 3. Import the newly created ``master-public.pem`` public certificate, so that
321 ``proxmox-backup-client`` can find and use it upon backup.
323 .. code-block:: console
325 # proxmox-backup-client key import-master-pubkey /path/to/master-public.pem
326 Imported public master key to "~/.config/proxmox-backup/master-public.pem"
328 4. With all these files in place, run a backup job:
330 .. code-block:: console
332 # proxmox-backup-client backup etc.pxar:/etc
334 The key will be stored in your backup, under the name ``rsa-encrypted.key``.
336 .. Note:: The ``--keyfile`` parameter can be excluded, if the encryption key
337 is in the default path. If you specified another path upon creation, you
338 must pass the ``--keyfile`` parameter.
340 5. To test that everything worked, you can restore the key from the backup:
342 .. code-block:: console
344 # proxmox-backup-client restore /path/to/backup/ rsa-encrypted.key /path/to/target
346 .. Note:: You should not need an encryption key to extract this file. However, if
347 a key exists at the default location
348 (``~/.config/proxmox-backup/encryption-key.json``) the program will prompt
349 you for an encryption key password. Simply moving ``encryption-key.json``
350 out of this directory will fix this issue.
352 6. Then, use the previously generated master key to decrypt the file:
354 .. code-block:: console
356 # openssl rsautl -decrypt -inkey master-private.pem -in rsa-encrypted.key -out /path/to/target
357 Enter pass phrase for ./master-private.pem: *********
359 7. The target file will now contain the encryption key information in plain
360 text. The success of this can be confirmed by passing the resulting ``json``
361 file, with the ``--keyfile`` parameter, when decrypting files from the backup.
363 .. warning:: Without their key, backed up files will be inaccessible. Thus, you should
364 keep keys ordered and in a place that is separate from the contents being
365 backed up. It can happen, for example, that you back up an entire system, using
366 a key on that system. If the system then becomes inaccessible for any reason
367 and needs to be restored, this will not be possible as the encryption key will be
368 lost along with the broken system. In preparation for the worst case scenario,
369 you should consider keeping a paper copy of this key locked away in
376 The regular creation of backups is a necessary step to avoiding data
377 loss. More importantly, however, is the restoration. It is good practice to perform
378 periodic recovery tests to ensure that you can access the data in
381 First, you need to find the snapshot which you want to restore. The snapshot
382 command provides a list of all the snapshots on the server:
384 .. code-block:: console
386 # proxmox-backup-client snapshots
387 ┌────────────────────────────────┬─────────────┬────────────────────────────────────┐
388 │ snapshot │ size │ files │
389 ╞════════════════════════════════╪═════════════╪════════════════════════════════════╡
390 │ host/elsa/2019-12-03T09:30:15Z │ 51788646825 │ root.pxar catalog.pcat1 index.json │
391 ├────────────────────────────────┼─────────────┼────────────────────────────────────┤
392 │ host/elsa/2019-12-03T09:35:01Z │ 51790622048 │ root.pxar catalog.pcat1 index.json │
393 ├────────────────────────────────┼─────────────┼────────────────────────────────────┤
396 You can inspect the catalog to find specific files.
398 .. code-block:: console
400 # proxmox-backup-client catalog dump host/elsa/2019-12-03T09:35:01Z
402 d "./root.pxar.didx/etc/cifs-utils"
403 l "./root.pxar.didx/etc/cifs-utils/idmap-plugin"
404 d "./root.pxar.didx/etc/console-setup"
407 The restore command lets you restore a single archive from the
410 .. code-block:: console
412 # proxmox-backup-client restore host/elsa/2019-12-03T09:35:01Z root.pxar /target/path/
414 To get the contents of any archive, you can restore the ``index.json`` file in the
415 repository to the target path '-'. This will dump the contents to the standard output.
417 .. code-block:: console
419 # proxmox-backup-client restore host/elsa/2019-12-03T09:35:01Z index.json -
425 If you only want to restore a few individual files, it is often easier
426 to use the interactive recovery shell.
428 .. code-block:: console
430 # proxmox-backup-client catalog shell host/elsa/2019-12-03T09:35:01Z root.pxar
431 Starting interactive shell
433 bin boot dev etc home lib lib32
436 The interactive recovery shell is a minimal command line interface that
437 utilizes the metadata stored in the catalog to quickly list, navigate and
438 search files in a file archive.
439 To restore files, you can select them individually or match them with a glob
442 Using the catalog for navigation reduces the overhead considerably because only
443 the catalog needs to be downloaded and, optionally, decrypted.
444 The actual chunks are only accessed if the metadata in the catalog is not enough
445 or for the actual restore.
447 Similar to common UNIX shells ``cd`` and ``ls`` are the commands used to change
448 working directory and list directory contents in the archive.
449 ``pwd`` shows the full path of the current working directory with respect to the
452 Being able to quickly search the contents of the archive is a commonly needed feature.
453 That's where the catalog is most valuable.
456 .. code-block:: console
458 pxar:/ > find etc/**/*.txt --select
460 pxar:/ > list-selected
462 pxar:/ > restore-selected /target/path
465 This will find and print all files ending in ``.txt`` located in ``etc/`` or a
466 subdirectory and add the corresponding pattern to the list for subsequent restores.
467 ``list-selected`` shows these patterns and ``restore-selected`` finally restores
468 all files in the archive matching the patterns to ``/target/path`` on the local
469 host. This will scan the whole archive.
471 With ``restore /target/path`` you can restore the sub-archive given by the current
472 working directory to the local target path ``/target/path`` on your host.
473 By additionally passing a glob pattern with ``--pattern <glob>``, the restore is
474 further limited to files matching the pattern.
477 .. code-block:: console
480 pxar:/etc/ > restore /target/ --pattern **/*.conf
483 The above will scan trough all the directories below ``/etc`` and restore all
484 files ending in ``.conf``.
486 .. todo:: Explain interactive restore in more detail
488 Mounting of Archives via FUSE
489 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
491 The :term:`FUSE` implementation for the pxar archive allows you to mount a
492 file archive as a read-only filesystem to a mountpoint on your host.
494 .. code-block:: console
496 # proxmox-backup-client mount host/backup-client/2020-01-29T11:29:22Z root.pxar /mnt/mountpoint
498 bin dev home lib32 libx32 media opt root sbin sys usr
499 boot etc lib lib64 lost+found mnt proc run srv tmp var
501 This allows you to access the full contents of the archive in a seamless manner.
503 .. note:: As the FUSE connection needs to fetch and decrypt chunks from the
504 backup server's datastore, this can cause some additional network and CPU
505 load on your host, depending on the operations you perform on the mounted
508 To unmount the filesystem use the ``umount`` command on the mountpoint:
510 .. code-block:: console
512 # umount /mnt/mountpoint
517 The client tool prompts you to enter the logon password as soon as you
518 want to access the backup server. The server checks your credentials
519 and responds with a ticket that is valid for two hours. The client
520 tool automatically stores that ticket and uses it for further requests
523 You can also manually trigger this login/logout using the login and
526 .. code-block:: console
528 # proxmox-backup-client login
531 To remove the ticket, issue a logout:
533 .. code-block:: console
535 # proxmox-backup-client logout
540 Pruning and Removing Backups
541 ----------------------------
543 You can manually delete a backup snapshot using the ``forget``
546 .. code-block:: console
548 # proxmox-backup-client forget <snapshot>
551 .. caution:: This command removes all archives in this backup
552 snapshot. They will be inaccessible and unrecoverable.
555 Although manual removal is sometimes required, the ``prune``
556 command is normally used to systematically delete older backups. Prune lets
557 you specify which backup snapshots you want to keep. The
558 following retention options are available:
561 Keep the last ``<N>`` backup snapshots.
563 ``--keep-hourly <N>``
564 Keep backups for the last ``<N>`` hours. If there is more than one
565 backup for a single hour, only the latest is kept.
568 Keep backups for the last ``<N>`` days. If there is more than one
569 backup for a single day, only the latest is kept.
571 ``--keep-weekly <N>``
572 Keep backups for the last ``<N>`` weeks. If there is more than one
573 backup for a single week, only the latest is kept.
575 .. note:: Weeks start on Monday and end on Sunday. The software
576 uses the `ISO week date`_ system and handles weeks at
577 the end of the year correctly.
579 ``--keep-monthly <N>``
580 Keep backups for the last ``<N>`` months. If there is more than one
581 backup for a single month, only the latest is kept.
583 ``--keep-yearly <N>``
584 Keep backups for the last ``<N>`` years. If there is more than one
585 backup for a single year, only the latest is kept.
587 The retention options are processed in the order given above. Each option
588 only covers backups within its time period. The next option does not take care
589 of already covered backups. It will only consider older backups.
591 Unfinished and incomplete backups will be removed by the prune command unless
592 they are newer than the last successful backup. In this case, the last failed
595 .. code-block:: console
597 # proxmox-backup-client prune <group> --keep-daily 7 --keep-weekly 4 --keep-monthly 3
600 You can use the ``--dry-run`` option to test your settings. This only
601 shows the list of existing snapshots and what actions prune would take.
603 .. code-block:: console
605 # proxmox-backup-client prune host/elsa --dry-run --keep-daily 1 --keep-weekly 3
606 ┌────────────────────────────────┬──────┐
608 ╞════════════════════════════════╪══════╡
609 │ host/elsa/2019-12-04T13:20:37Z │ 1 │
610 ├────────────────────────────────┼──────┤
611 │ host/elsa/2019-12-03T09:35:01Z │ 0 │
612 ├────────────────────────────────┼──────┤
613 │ host/elsa/2019-11-22T11:54:47Z │ 1 │
614 ├────────────────────────────────┼──────┤
615 │ host/elsa/2019-11-21T12:36:25Z │ 0 │
616 ├────────────────────────────────┼──────┤
617 │ host/elsa/2019-11-10T10:42:20Z │ 1 │
618 └────────────────────────────────┴──────┘
620 .. note:: Neither the ``prune`` command nor the ``forget`` command free space
621 in the chunk-store. The chunk-store still contains the data blocks. To free
622 space you need to perform :ref:`garbage-collection`.
625 .. _garbage-collection:
630 The ``prune`` command removes only the backup index files, not the data
631 from the datastore. This task is left to the garbage collection
632 command. It is recommended to carry out garbage collection on a regular basis.
634 The garbage collection works in two phases. In the first phase, all
635 data blocks that are still in use are marked. In the second phase,
636 unused data blocks are removed.
638 .. note:: This command needs to read all existing backup index files
639 and touches the complete chunk-store. This can take a long time
640 depending on the number of chunks and the speed of the underlying
643 .. note:: The garbage collection will only remove chunks that haven't been used
644 for at least one day (exactly 24h 5m). This grace period is necessary because
645 chunks in use are marked by touching the chunk which updates the ``atime``
646 (access time) property. Filesystems are mounted with the ``relatime`` option
647 by default. This results in a better performance by only updating the
648 ``atime`` property if the last access has been at least 24 hours ago. The
649 downside is, that touching a chunk within these 24 hours will not always
650 update its ``atime`` property.
652 Chunks in the grace period will be logged at the end of the garbage
653 collection task as *Pending removals*.
655 .. code-block:: console
657 # proxmox-backup-client garbage-collect
658 starting garbage collection on store store2
659 Start GC phase1 (mark used chunks)
660 Start GC phase2 (sweep unused chunks)
661 percentage done: 1, chunk count: 219
662 percentage done: 2, chunk count: 453
664 percentage done: 99, chunk count: 21188
665 Removed bytes: 411368505
667 Original data bytes: 327160886391
668 Disk bytes: 52767414743 (16 %)
670 Average chunk size: 2486565
674 .. todo:: howto run garbage-collection at regular intervals (cron)
679 The backup client also comes with a benchmarking tool. This tool measures
680 various metrics relating to compression and encryption speeds. You can run a
681 benchmark using the ``benchmark`` subcommand of ``proxmox-backup-client``:
683 .. code-block:: console
685 # proxmox-backup-client benchmark
686 Uploaded 656 chunks in 5 seconds.
687 Time per request: 7659 microseconds.
688 TLS speed: 547.60 MB/s
689 SHA256 speed: 585.76 MB/s
690 Compression speed: 1923.96 MB/s
691 Decompress speed: 7885.24 MB/s
692 AES256/GCM speed: 3974.03 MB/s
693 ┌───────────────────────────────────┬─────────────────────┐
695 ╞═══════════════════════════════════╪═════════════════════╡
696 │ TLS (maximal backup upload speed) │ 547.60 MB/s (93%) │
697 ├───────────────────────────────────┼─────────────────────┤
698 │ SHA256 checksum computation speed │ 585.76 MB/s (28%) │
699 ├───────────────────────────────────┼─────────────────────┤
700 │ ZStd level 1 compression speed │ 1923.96 MB/s (89%) │
701 ├───────────────────────────────────┼─────────────────────┤
702 │ ZStd level 1 decompression speed │ 7885.24 MB/s (98%) │
703 ├───────────────────────────────────┼─────────────────────┤
704 │ AES256 GCM encryption speed │ 3974.03 MB/s (104%) │
705 └───────────────────────────────────┴─────────────────────┘
707 .. note:: The percentages given in the output table correspond to a
708 comparison against a Ryzen 7 2700X. The TLS test connects to the
709 local host, so there is no network involved.
711 You can also pass the ``--output-format`` parameter to output stats in ``json``,
712 rather than the default table format.