6 .. image:: images/screenshots/pbs-gui-tape-changer-overview.png
8 :alt: Tape Backup: Tape changer overview
10 Proxmox tape backup provides an easy way to store datastore content
11 onto magnetic tapes. This increases data safety because you get:
13 - an additional copy of the data,
14 - on a different media type (tape),
15 - to an additional location (you can move tapes off-site)
17 In most restore jobs, only data from the last backup job is restored.
18 Restore requests further decline, the older the data
19 gets. Considering this, tape backup may also help to reduce disk
20 usage, because you can safely remove data from disk, once it's archived on
21 tape. This is especially true if you need to retain data for several
24 Tape backups do not provide random access to the stored data. Instead,
25 you need to restore the data to disk, before you can access it
26 again. Also, if you store your tapes off-site (using some kind of tape
27 vaulting service), you need to bring them back on-site, before you can do any
28 restores. So please consider that restoring from tape can take much
29 longer than restoring from disk.
32 Tape Technology Primer
33 ----------------------
35 .. _Linear Tape-Open: https://en.wikipedia.org/wiki/Linear_Tape-Open
37 As of 2021, the only widely available tape technology standard is
38 `Linear Tape-Open`_ (LTO). Different vendors offer LTO Ultrium tape
39 drives, auto-loaders, and LTO tape cartridges.
41 There are a few vendors that offer proprietary drives with
42 slight advantages in performance and capacity. Nevertheless, they have
43 significant disadvantages:
45 - proprietary (single vendor)
46 - a much higher purchase cost
48 So we currently do not test such drives.
50 In general, LTO tapes offer the following advantages:
52 - Durability (30 year lifespan)
53 - High Capacity (12 TB)
54 - Relatively low cost per TB
56 - Movable (storable inside vault)
57 - Multiple vendors (for both media and drives)
58 - Built in AES-GCM Encryption engine
60 Note that `Proxmox Backup Server` already stores compressed data, so using the
61 tape compression feature has no advantage.
67 Proxmox Backup Server supports `Linear Tape-Open`_ generation 5 (LTO-5)
68 or later and has best-effort support for generation 4 (LTO-4). While
69 many LTO-4 systems are known to work, some might need firmware updates or
70 do not implement necessary features to work with Proxmox Backup Server.
72 Tape changing is carried out using the SCSI Medium Changer protocol,
73 so all modern tape libraries should work.
75 .. Note:: We use a custom user space tape driver written in Rust_. This
76 driver directly communicates with the tape drive using the SCSI
77 generic interface. This may have negative side effects when used with the old
78 Linux kernel tape driver, so you should not use that driver with
85 Current LTO-8 tapes provide read/write speeds of up to 360 MB/s. This means,
86 that it still takes a minimum of 9 hours to completely write or
87 read a single tape (even at maximum speed).
89 The only way to speed that data rate up is to use more than one
90 drive. That way, you can run several backup jobs in parallel, or run
91 restore jobs while the other dives are used for backups.
93 Also consider that you first need to read data from your datastore
94 (disk). However, a single spinning disk is unable to deliver data at this
95 rate. We measured a maximum rate of about 60MB/s to 100MB/s in practice,
96 so it takes 33 hours to read the 12TB needed to fill up an LTO-8 tape. If you want
97 to write to your tape at full speed, please make sure that the source
98 datastore is able to deliver that performance (for example, by using SSDs).
105 are used to uniquely identify a tape. You would normally apply a
106 sticky paper label to the front of the cartridge. We additionally
107 store the label text magnetically on the tape (first file on tape).
109 .. _Code 39: https://en.wikipedia.org/wiki/Code_39
111 .. _LTO Ultrium Cartridge Label Specification: https://www.ibm.com/support/pages/ibm-lto-ultrium-cartridge-label-specification
113 .. _LTO Barcode Generator: lto-barcode/index.html
116 are a special form of tape labels, which are electronically
117 readable. Most LTO tape robots use an 8 character string encoded as
118 `Code 39`_, as defined in the `LTO Ultrium Cartridge Label
121 You can either buy such barcode labels from your cartridge vendor,
122 or print them yourself. You can use our `LTO Barcode Generator`_
123 app, if you would like to print them yourself.
125 .. Note:: Physical labels and the associated adhesive should have an
126 environmental performance to match or exceed the environmental
127 specifications of the cartridge to which it is applied.
130 A media pool is a logical container for tapes. A backup job targets
131 one media pool, so a job only uses tapes from that pool. The pool
132 additionally defines how long a backup job can append data to tapes
133 (allocation policy) and how long you want to keep the data
137 A group of continuously written tapes (all from the same media pool).
140 The device used to read and write data to the tape. There are
141 standalone drives, but drives are usually shipped within tape
145 A device which can change the tapes inside a tape drive (tape
146 robot). They are usually part of a tape library.
148 .. _Tape Library: https://en.wikipedia.org/wiki/Tape_library
151 A storage device that contains one or more tape drives, a number of
152 slots to hold tape cartridges, a barcode reader to identify tape
153 cartridges, and an automated method for loading tapes (a robot).
155 This is also commonly known as an 'autoloader', 'tape robot' or
159 The inventory stores the list of known tapes (with additional status
163 A media catalog stores information about the media content.
169 1. Configure your tape hardware (drives and changers)
171 2. Configure one or more media pools
173 3. Label your tape cartridges
175 4. Start your first tape backup job ...
181 Please note that you can configure anything using the graphical user
182 interface or the command line interface. Both methods result in the
185 .. _tape_changer_config:
190 .. image:: images/screenshots/pbs-gui-tape-changers.png
192 :alt: Tape Backup: Tape Changers
194 Tape changers (robots) are part of a `Tape Library`_. They contain a number of
195 slots to hold tape cartridges, a barcode reader to identify tape cartridges and
196 an automated method for loading tapes.
198 You can skip this step if you are using a standalone drive.
200 Linux is able to auto detect these devices, and you can get a list
201 of available devices using:
203 .. code-block:: console
205 # proxmox-tape changer scan
206 ┌─────────────────────────────┬─────────┬──────────────┬────────┐
207 │ path │ vendor │ model │ serial │
208 ╞═════════════════════════════╪═════════╪══════════════╪════════╡
209 │ /dev/tape/by-id/scsi-CC2C52 │ Quantum │ Superloader3 │ CC2C52 │
210 └─────────────────────────────┴─────────┴──────────────┴────────┘
212 In order to use a device with Proxmox Backup Server, you need to create a
215 .. code-block:: console
217 # proxmox-tape changer create sl3 --path /dev/tape/by-id/scsi-CC2C52
219 Where ``sl3`` is an arbitrary name you can choose.
221 .. Note:: Please use the persistent device path names from inside
222 ``/dev/tape/by-id/``. Names like ``/dev/sg0`` may point to a
223 different device after reboot, and that is not what you want.
225 .. image:: images/screenshots/pbs-gui-tape-changers-add.png
227 :alt: Tape Backup: Add a new tape changer
229 This operation can also be carried out from the GUI, by navigating to the
230 **Changers** tab of **Tape Backup** and clicking **Add**.
232 You can display the final configuration with:
234 .. code-block:: console
236 # proxmox-tape changer config sl3
237 ┌──────┬─────────────────────────────┐
239 ╞══════╪═════════════════════════════╡
241 ├──────┼─────────────────────────────┤
242 │ path │ /dev/tape/by-id/scsi-CC2C52 │
243 └──────┴─────────────────────────────┘
245 Or simply list all configured changer devices (as seen in the **Changers** tab
248 .. code-block:: console
250 # proxmox-tape changer list
251 ┌──────┬─────────────────────────────┬─────────┬──────────────┬────────────┐
252 │ name │ path │ vendor │ model │ serial │
253 ╞══════╪═════════════════════════════╪═════════╪══════════════╪════════════╡
254 │ sl3 │ /dev/tape/by-id/scsi-CC2C52 │ Quantum │ Superloader3 │ CC2C52 │
255 └──────┴─────────────────────────────┴─────────┴──────────────┴────────────┘
257 The Vendor, Model and Serial number are auto-detected, but only shown
258 if the device is online.
260 To test your setup, please query the status of the changer device with:
262 .. code-block:: console
264 # proxmox-tape changer status sl3
265 ┌───────────────┬──────────┬────────────┬─────────────┐
266 │ entry-kind │ entry-id │ changer-id │ loaded-slot │
267 ╞═══════════════╪══════════╪════════════╪═════════════╡
268 │ drive │ 0 │ vtape1 │ 1 │
269 ├───────────────┼──────────┼────────────┼─────────────┤
271 ├───────────────┼──────────┼────────────┼─────────────┤
272 │ slot │ 2 │ vtape2 │ │
273 ├───────────────┼──────────┼────────────┼─────────────┤
275 ├───────────────┼──────────┼────────────┼─────────────┤
277 └───────────────┴──────────┴────────────┴─────────────┘
279 Tape libraries usually provide some special import/export slots (also
280 called "mail slots"). Tapes inside those slots are accessible from
281 outside, making it easy to add/remove tapes to/from the library. Those
282 tapes are considered to be "offline", so backup jobs will not use
283 them. Those special slots are auto-detected and marked as an
284 ``import-export`` slot in the status command.
286 It's worth noting that some of the smaller tape libraries don't have
287 such slots. While they have something called a "Mail Slot", that slot
288 is just a way to grab the tape from the gripper. They are unable
289 to hold media while the robot does other things. They also do not
290 expose that "Mail Slot" over the SCSI interface, so you won't see them in
293 As a workaround, you can mark some of the normal slots as export
294 slot. The software treats those slots like real ``import-export``
295 slots, and the media inside those slots are considered to be 'offline'
296 (not available for backup):
298 .. code-block:: console
300 # proxmox-tape changer update sl3 --export-slots 15,16
302 After that, you can see those artificial ``import-export`` slots in
305 .. code-block:: console
307 # proxmox-tape changer status sl3
308 ┌───────────────┬──────────┬────────────┬─────────────┐
309 │ entry-kind │ entry-id │ changer-id │ loaded-slot │
310 ╞═══════════════╪══════════╪════════════╪═════════════╡
311 │ drive │ 0 │ vtape1 │ 1 │
312 ├───────────────┼──────────┼────────────┼─────────────┤
313 │ import-export │ 15 │ │ │
314 ├───────────────┼──────────┼────────────┼─────────────┤
315 │ import-export │ 16 │ │ │
316 ├───────────────┼──────────┼────────────┼─────────────┤
318 ├───────────────┼──────────┼────────────┼─────────────┤
319 │ slot │ 2 │ vtape2 │ │
320 ├───────────────┼──────────┼────────────┼─────────────┤
322 ├───────────────┼──────────┼────────────┼─────────────┤
324 └───────────────┴──────────┴────────────┴─────────────┘
326 .. _tape_drive_config:
331 .. image:: images/screenshots/pbs-gui-tape-drives.png
333 :alt: Tape Backup: Drive list
335 Linux is able to auto detect tape drives, and you can get a list
336 of available tape drives using:
338 .. code-block:: console
340 # proxmox-tape drive scan
341 ┌────────────────────────────────┬────────┬─────────────┬────────┐
342 │ path │ vendor │ model │ serial │
343 ╞════════════════════════════════╪════════╪═════════════╪════════╡
344 │ /dev/tape/by-id/scsi-12345-sg │ IBM │ ULT3580-TD4 │ 12345 │
345 └────────────────────────────────┴────────┴─────────────┴────────┘
347 .. image:: images/screenshots/pbs-gui-tape-drives-add.png
349 :alt: Tape Backup: Add a tape drive
351 In order to use that drive with Proxmox, you need to create a
352 configuration entry. This can be done through **Tape Backup -> Drives** in the
353 GUI or by using the command below:
355 .. code-block:: console
357 # proxmox-tape drive create mydrive --path /dev/tape/by-id/scsi-12345-sg
359 .. Note:: Please use the persistent device path names from inside
360 ``/dev/tape/by-id/``. Names like ``/dev/sg0`` may point to a
361 different device after reboot, and that is not what you want.
363 If you have a tape library, you also need to set the associated
366 .. code-block:: console
368 # proxmox-tape drive update mydrive --changer sl3 --changer-drivenum 0
370 The ``--changer-drivenum`` is only necessary if the tape library
371 includes more than one drive (the changer status command lists all
374 You can display the final configuration with:
376 .. code-block:: console
378 # proxmox-tape drive config mydrive
379 ┌─────────┬────────────────────────────────┐
381 ╞═════════╪════════════════════════════════╡
383 ├─────────┼────────────────────────────────┤
384 │ path │ /dev/tape/by-id/scsi-12345-sg │
385 ├─────────┼────────────────────────────────┤
387 └─────────┴────────────────────────────────┘
389 .. NOTE:: The ``changer-drivenum`` value 0 is not stored in the
390 configuration, because it is the default.
392 To list all configured drives use:
394 .. code-block:: console
396 # proxmox-tape drive list
397 ┌──────────┬────────────────────────────────┬─────────┬────────┬─────────────┬────────┐
398 │ name │ path │ changer │ vendor │ model │ serial │
399 ╞══════════╪════════════════════════════════╪═════════╪════════╪═════════════╪════════╡
400 │ mydrive │ /dev/tape/by-id/scsi-12345-sg │ sl3 │ IBM │ ULT3580-TD4 │ 12345 │
401 └──────────┴────────────────────────────────┴─────────┴────────┴─────────────┴────────┘
403 The Vendor, Model and Serial number are auto detected and only shown
404 if the device is online.
406 For testing, you can simply query the drive status with:
408 .. code-block:: console
410 # proxmox-tape status --drive mydrive
411 ┌────────────────┬──────────────────────────┐
413 ╞════════════════╪══════════════════════════╡
415 ├────────────────┼──────────────────────────┤
417 ├────────────────┼──────────────────────────┤
419 ├────────────────┼──────────────────────────┤
421 ├────────────────┼──────────────────────────┤
422 │ alert-flags │ (empty) │
423 ├────────────────┼──────────────────────────┤
425 ├────────────────┼──────────────────────────┤
427 ├────────────────┼──────────────────────────┤
428 │ manufactured │ Fri Dec 13 01:00:00 2019 │
429 ├────────────────┼──────────────────────────┤
430 │ bytes-written │ 501.80 GiB │
431 ├────────────────┼──────────────────────────┤
432 │ bytes-read │ 4.00 MiB │
433 ├────────────────┼──────────────────────────┤
434 │ medium-passes │ 20 │
435 ├────────────────┼──────────────────────────┤
436 │ medium-wearout │ 0.12% │
437 ├────────────────┼──────────────────────────┤
438 │ volume-mounts │ 2 │
439 └────────────────┴──────────────────────────┘
441 .. NOTE:: Blocksize should always be 0 (variable block size
442 mode). This is the default anyway.
445 .. _tape_media_pool_config:
450 .. image:: images/screenshots/pbs-gui-tape-pools.png
452 :alt: Tape Backup: Media Pools
454 A media pool is a logical container for tapes. A backup job targets
455 a single media pool, so a job only uses tapes from that pool.
459 A media set is a group of continuously written tapes, used to split
460 the larger pool into smaller, restorable units. One or more backup
461 jobs write to a media set, producing an ordered group of
462 tapes. Media sets are identified by a unique ID. That ID and the
463 sequence number are stored on each tape of that set (tape label).
465 Media sets are the basic unit for restore tasks. This means that you need
466 every tape in the set to restore the media set contents. Data is fully
467 deduplicated inside a media set.
470 .. topic:: Media Set Allocation Policy
472 The pool additionally defines how long backup jobs can append data
473 to a media set. The following settings are possible:
475 - Try to use the current media set (``continue``).
477 This setting produces one large media set. While this is very
478 space efficient (deduplication, no unused space), it can lead to
479 long restore times, because restore jobs need to read all tapes in the
482 .. NOTE:: Data is fully deduplicated inside a media set. This
483 also means that data is randomly distributed over the tapes in
484 the set. Thus, even if you restore a single VM, data may have to be
485 read from all tapes inside the media set.
487 Larger media sets are also more error-prone, because a single
488 damaged tape makes the restore fail.
490 Usage scenario: Mostly used with tape libraries. You manually
491 trigger new set creation by running a backup job with the
494 .. NOTE:: Retention period starts with the existence of a newer
497 - Always create a new media set (``always``).
499 With this setting, each backup job creates a new media set. This
500 is less space efficient, because the media from the last set
501 may not be fully written, leaving the remaining space unused.
503 The advantage is that this procudes media sets of minimal
504 size. Small sets are easier to handle, can be moved more conveniently
505 to an off-site vault, and can be restored much faster.
507 .. NOTE:: Retention period starts with the creation time of the
510 - Create a new set when the specified Calendar Event triggers.
512 .. _systemd.time manpage: https://manpages.debian.org/buster/systemd/systemd.time.7.en.html
514 This allows you to specify points in time by using systemd like
515 Calendar Event specifications (see `systemd.time manpage`_).
517 For example, the value ``weekly`` (or ``Mon *-*-* 00:00:00``)
518 will create a new set each week.
520 This balances between space efficiency and media count.
522 .. NOTE:: Retention period starts when the calendar event
525 Additionally, the following events may allocate a new media set:
527 - Required tape is offline (and you use a tape library).
529 - Current set contains damaged or retired tapes.
531 - Media pool encryption has changed
533 - Database consistency errors, for example, if the inventory does not
534 contain the required media information, or it contains conflicting
535 information (outdated data).
537 .. topic:: Retention Policy
539 Defines how long we want to keep the data.
541 - Always overwrite media.
543 - Protect data for the duration specified.
545 We use systemd like time spans to specify durations, e.g. ``2
546 weeks`` (see `systemd.time manpage`_).
548 - Never overwrite data.
550 .. topic:: Hardware Encryption
552 LTO-4 (or later) tape drives support hardware encryption. If you
553 configure the media pool to use encryption, all data written to the
554 tapes is encrypted using the configured key.
556 This way, unauthorized users cannot read data from the media,
557 for example, if you loose a tape while shipping to an offsite location.
559 .. Note:: If the backup client also encrypts data, data on the tape
560 will be double encrypted.
562 The password protected key is stored on each medium, so that it is
563 possbible to `restore the key <tape_restore_encryption_key_>`_ using
564 the password. Please make sure to remember the password, in case
565 you need to restore the key.
568 .. NOTE:: We use global content namespace, meaning we do not store the
569 source datastore name. Because of this, it is impossible to distinguish
570 store1:/vm/100 from store2:/vm/100. Please use different media pools
571 if the sources are from different namespaces with conflicting names
572 (for example, if the sources are from different Proxmox VE clusters).
574 .. image:: images/screenshots/pbs-gui-tape-pools-add.png
576 :alt: Tape Backup: Add a media pool
578 To create a new media pool, add one from **Tape Backup -> Media Pools** in the
579 GUI, or enter the following command:
581 .. code-block:: console
583 // proxmox-tape pool create <name> --drive <string> [OPTIONS]
585 # proxmox-tape pool create daily --drive mydrive
588 Additional options can be set later, using the update command:
590 .. code-block:: console
592 # proxmox-tape pool update daily --allocation daily --retention 7days
595 To list all configured pools use:
597 .. code-block:: console
599 # proxmox-tape pool list
600 ┌───────┬──────────┬────────────┬───────────┬──────────┐
601 │ name │ drive │ allocation │ retention │ template │
602 ╞═══════╪══════════╪════════════╪═══════════╪══════════╡
603 │ daily │ mydrive │ daily │ 7days │ │
604 └───────┴──────────┴────────────┴───────────┴──────────┘
606 .. _tape_backup_job_config:
611 .. image:: images/screenshots/pbs-gui-tape-backup-jobs.png
613 :alt: Tape Backup: Tape Backup Jobs
615 To automate tape backup, you can configure tape backup jobs which
616 write datastore content to a media pool, based on a specific time schedule.
617 The required settings are:
619 - ``store``: The datastore you want to backup
621 - ``pool``: The media pool - only tape cartridges from that pool are
624 - ``drive``: The tape drive.
626 - ``schedule``: Job schedule (see :ref:`calendar-event-scheduling`)
628 For example, to configure a tape backup job for datastore ``vmstore1``
631 .. code-block:: console
633 # proxmox-tape backup-job create job2 --store vmstore1 \
634 --pool yourpool --drive yourdrive --schedule daily
636 The backup includes all snapshots from a backup group by default. You can
637 set the ``latest-only`` flag to include only the latest snapshots:
639 .. code-block:: console
641 # proxmox-tape backup-job update job2 --latest-only
643 Backup jobs can use email to send tape request notifications or
644 report errors. You can set the notification user with:
646 .. code-block:: console
648 # proxmox-tape backup-job update job2 --notify-user root@pam
650 .. Note:: The email address is a property of the user (see :ref:`user_mgmt`).
652 It is sometimes useful to eject the tape from the drive after a
653 backup. For a standalone drive, the ``eject-media`` option ejects the
654 tape, making sure that the following backup cannot use the tape
655 (unless someone manually loads the tape again). For tape libraries,
656 this option unloads the tape to a free slot, which provides better
657 dust protection than inside a drive:
659 .. code-block:: console
661 # proxmox-tape backup-job update job2 --eject-media
663 .. Note:: For failed jobs, the tape remains in the drive.
665 For tape libraries, the ``export-media`` option moves all tapes from
666 the media set to an export slot, making sure that the following backup
667 cannot use the tapes. An operator can pick up those tapes and move them
670 .. code-block:: console
672 # proxmox-tape backup-job update job2 --export-media
674 .. Note:: The ``export-media`` option can be used to force the start
675 of a new media set, because tapes from the current set are no
678 It is also possible to run backup jobs manually:
680 .. code-block:: console
682 # proxmox-tape backup-job run job2
684 To remove a job, please use:
686 .. code-block:: console
688 # proxmox-tape backup-job remove job2
690 .. image:: images/screenshots/pbs-gui-tape-backup-jobs-add.png
692 :alt: Tape Backup: Add a backup job
694 This same functionality also exists in the GUI, under the **Backup Jobs** tab of
695 **Tape Backup**, where *Local Datastore* relates to the datastore you want to
696 backup and *Media Pool* is the pool to back up to.
702 Many sub-commands of the ``proxmox-tape`` command line tools take a
703 parameter called ``--drive``, which specifies the tape drive you want
704 to work on. For convenience, you can set this in an environment
707 .. code-block:: console
709 # export PROXMOX_TAPE_DRIVE=mydrive
711 You can then omit the ``--drive`` parameter from the command. If the
712 drive has an associated changer device, you may also omit the changer
713 parameter from commands that need a changer device, for example:
715 .. code-block:: console
717 # proxmox-tape changer status
719 should display the changer status of the changer device associated with
726 By default, tape cartridges all look the same, so you need to put a
727 label on them for unique identification. First, put a sticky paper
728 label with some human readable text on the cartridge.
730 If you use a `Tape Library`_, you should use an 8 character string
731 encoded as `Code 39`_, as defined in the `LTO Ultrium Cartridge Label
732 Specification`_. You can either buy such barcode labels from your
733 cartridge vendor, or print them yourself. You can use our `LTO Barcode
734 Generator`_ app to print them.
736 Next, you need to write that same label text to the tape, so that the
737 software can uniquely identify the tape too.
739 For a standalone drive, manually insert the new tape cartridge into the
742 .. code-block:: console
744 # proxmox-tape label --changer-id <label-text> [--pool <pool-name>]
746 You may omit the ``--pool`` argument to allow the tape to be used by any pool.
748 .. Note:: For safety reasons, this command fails if the tape contains
749 any data. If you want to overwrite it anyway, erase the tape first.
751 You can verify success by reading back the label:
753 .. code-block:: console
755 # proxmox-tape read-label
756 ┌─────────────────┬──────────────────────────────────────┐
758 ╞═════════════════╪══════════════════════════════════════╡
759 │ changer-id │ vtape1 │
760 ├─────────────────┼──────────────────────────────────────┤
761 │ uuid │ 7f42c4dd-9626-4d89-9f2b-c7bc6da7d533 │
762 ├─────────────────┼──────────────────────────────────────┤
763 │ ctime │ Wed Jan 6 09:07:51 2021 │
764 ├─────────────────┼──────────────────────────────────────┤
766 ├─────────────────┼──────────────────────────────────────┤
767 │ media-set-uuid │ 00000000-0000-0000-0000-000000000000 │
768 ├─────────────────┼──────────────────────────────────────┤
769 │ media-set-ctime │ Wed Jan 6 09:07:51 2021 │
770 └─────────────────┴──────────────────────────────────────┘
772 .. NOTE:: The ``media-set-uuid`` using all zeros indicates an empty
773 tape (not used by any media set).
775 If you have a tape library, apply the sticky barcode label to the tape
776 cartridges first. Then load those empty tapes into the library. You
777 can then label all unlabeled tapes with a single command:
779 .. code-block:: console
781 # proxmox-tape barcode-label [--pool <pool-name>]
787 To manually run a backup job click *Run Now* in the GUI or use the command:
789 .. code-block:: console
791 # proxmox-tape backup <store> <pool> [OPTIONS]
793 The following options are available:
795 --eject-media Eject media upon job completion.
797 It is normally good practice to eject the tape after use. This unmounts the
798 tape from the drive and prevents the tape from getting dusty.
800 --export-media-set Export media set upon job completion.
802 After a successful backup job, this moves all tapes from the used
803 media set into import-export slots. The operator can then pick up
804 those tapes and move them to a media vault.
810 Restore is done at media-set granularity, so you first need to find
811 out which media set contains the data you want to restore. This
812 information is stored in the media catalog. If you do not have media
813 catalogs, you need to restore them first. Please note that you need
814 the catalog to find your data, but restoring a complete media-set does
815 not need media catalogs.
817 The following command lists the media content (from catalog):
819 .. code-block:: console
821 # proxmox-tape media content
822 ┌────────────┬──────┬──────────────────────────┬────────┬────────────────────────────────┬──────────────────────────────────────┐
823 │ label-text │ pool │ media-set-name │ seq-nr │ snapshot │ media-set-uuid │
824 ╞════════════╪══════╪══════════════════════════╪════════╪════════════════════════════════╪══════════════════════════════════════╡
825 │ TEST01L8 │ p2 │ Wed Jan 13 13:55:55 2021 │ 0 │ vm/201/2021-01-11T10:43:48Z │ 9da37a55-aac7-4deb-91c6-482b3b675f30 │
826 ├────────────┼──────┼──────────────────────────┼────────┼────────────────────────────────┼──────────────────────────────────────┤
827 │ ... │ ... │ ... │ ... │ ... │ ... │
828 └────────────┴──────┴──────────────────────────┴────────┴────────────────────────────────┴──────────────────────────────────────┘
831 A restore job reads the data from the media set and moves it back to
832 data disk (datastore):
834 .. code-block:: console
836 // proxmox-tape restore <media-set-uuid> <datastore>
838 # proxmox-tape restore 9da37a55-aac7-4deb-91c6-482b3b675f30 mystore
848 To restore a catalog from an existing tape, just insert the tape into the drive
851 .. code-block:: console
853 # proxmox-tape catalog
856 You can restore from a tape even without an existing catalog, but only the
857 whole media set. If you do this, the catalog will be automatically created.
860 Encryption Key Management
861 ~~~~~~~~~~~~~~~~~~~~~~~~~
863 .. image:: images/screenshots/pbs-gui-tape-crypt-keys.png
865 :alt: Tape Backup: Encryption Keys
867 Proxmox Backup Server also provides an interface for handling encryption keys on
868 the backup server. Encryption keys can be managed from the **Tape Backup ->
869 Encryption Keys** section of the GUI or through the ``proxmox-tape key`` command
870 line tool. To create a new encryption key from the command line:
872 .. code-block:: console
874 # proxmox-tape key create --hint "tape pw 2020"
875 Tape Encryption Key Password: **********
876 Verify Password: **********
877 "14:f8:79:b9:f5:13:e5:dc:bf:b6:f9:88:48:51:81:dc:79:bf:a0:22:68:47:d1:73:35:2d:b6:20:e1:7f:f5:0f"
879 List existing encryption keys:
881 .. code-block:: console
883 # proxmox-tape key list
884 ┌───────────────────────────────────────────────────┬───────────────┐
885 │ fingerprint │ hint │
886 ╞═══════════════════════════════════════════════════╪═══════════════╡
887 │ 14:f8:79:b9:f5:13:e5:dc: ... :b6:20:e1:7f:f5:0f │ tape pw 2020 │
888 └───────────────────────────────────────────────────┴───────────────┘
890 To show encryption key details:
892 .. code-block:: console
894 # proxmox-tape key show 14:f8:79:b9:f5:13:e5:dc:...:b6:20:e1:7f:f5:0f
895 ┌─────────────┬───────────────────────────────────────────────┐
897 ╞═════════════╪═══════════════════════════════════════════════╡
899 ├─────────────┼───────────────────────────────────────────────┤
900 │ created │ Sat Jan 23 14:47:21 2021 │
901 ├─────────────┼───────────────────────────────────────────────┤
902 │ modified │ Sat Jan 23 14:47:21 2021 │
903 ├─────────────┼───────────────────────────────────────────────┤
904 │ fingerprint │ 14:f8:79:b9:f5:13:e5:dc:...:b6:20:e1:7f:f5:0f │
905 ├─────────────┼───────────────────────────────────────────────┤
906 │ hint │ tape pw 2020 │
907 └─────────────┴───────────────────────────────────────────────┘
909 The ``paperkey`` subcommand can be used to create a QR encoded
910 version of a tape encryption key. The following command sends the output of the
911 ``paperkey`` command to a text file, for easy printing:
913 .. code-block:: console
915 proxmox-tape key paperkey <fingerprint> --output-format text > qrkey.txt
918 .. _tape_restore_encryption_key:
920 Restoring Encryption Keys
921 ^^^^^^^^^^^^^^^^^^^^^^^^^
923 You can restore the encryption key from the tape, using the password
924 used to generate the key. First, load the tape you want to restore
925 into the drive. Then run:
927 .. code-block:: console
929 # proxmox-tape key restore
930 Tepe Encryption Key Password: ***********
932 If the password is correct, the key will get imported to the
933 database. Further restore jobs automatically use any available key.
939 LTO tape drives require regular cleaning. This is done by loading a
940 cleaning cartridge into the drive, which is a manual task for
943 For tape libraries, cleaning cartridges are identified using special
944 labels starting with letters "CLN". For example, our tape library has a
945 cleaning cartridge inside slot 3:
947 .. code-block:: console
949 # proxmox-tape changer status sl3
950 ┌───────────────┬──────────┬────────────┬─────────────┐
951 │ entry-kind │ entry-id │ changer-id │ loaded-slot │
952 ╞═══════════════╪══════════╪════════════╪═════════════╡
953 │ drive │ 0 │ vtape1 │ 1 │
954 ├───────────────┼──────────┼────────────┼─────────────┤
956 ├───────────────┼──────────┼────────────┼─────────────┤
957 │ slot │ 2 │ vtape2 │ │
958 ├───────────────┼──────────┼────────────┼─────────────┤
959 │ slot │ 3 │ CLN001CU │ │
960 ├───────────────┼──────────┼────────────┼─────────────┤
962 └───────────────┴──────────┴────────────┴─────────────┘
964 To initiate a cleaning operation simply run:
966 .. code-block:: console
970 This command does the following:
972 - find the cleaning tape (in slot 3)
974 - unload the current media from the drive (back to slot 1)
976 - load the cleaning tape into the drive
978 - run drive cleaning operation
980 - unload the cleaning tape (to slot 3)