Forum Discussion

Grayc's avatar
Grayc
Level 4
12 years ago
Solved

Differential Job now Running FULL backups!

Here's a wierd situation I'm having:

I'm using BE2012 SP2 and have a backup job that has two methods:  a FULL and a Differential.  This job was created about 3 months ago and ran as I wanted it to until Wednesday of last week.

When I checked the Differential job results that ran Wednesday night, the Differential job was was still in progress.  I found this to be pretty odd since the average Differential run is under 30 minutes and averages about 50 GB in size.  The original fileshare size is 1.2 TB, which takes about 20-22 hours to complete when I run a FULL job over the weekends.

Here's the wierd part:  Now when a Differential job is running, it literally performs a FULL backup of this 1.2 TB fileshare!  The job was not edited or anything.

Does anyone have an explanation as to why this is now happening?  I have another network that this very same phenomenon has started happening on too.

2012
Backing Up
Backup and Recovery
Backup Exec
Backup Exec (media server only)
Windows Server (2003-2008)
  • Grayc's avatar
    Grayc
    12 years ago
    Turns out it a Symantec Endpoint Protection (SEP) issue. Everytime SEP runs on the Windows fileshare, it changes the update sequence number (USN) change journal on each file residing on that particular fileshare. Further research showed that the fileshare server's registry was missing an entry that prevents SEP from changing the USN change journal. The following DWORD was added to our 64-bit server: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\NoFileMod where the value data was set to "1".
  • Jaydeep_S's avatar
    Jaydeep_S
    Level 6
    12 years ago

    The Incremental and Differential typically run with reference to the archive bit set on the files. Has anything changed the archive bit settings on your file shares? Antivirus software is where, I would start investigating. Also, is there any onther type of Backup being performed (outside Backup Exec)?

  • lmosla's avatar
    lmosla
    Level 6
    12 years ago

    In addition to what Jaydeep reccommended  try recreating your job in case it got corrupt somehow.

    Also run all of you updates and push out them out to your remote servers

  • pkh's avatar
    pkh
    Moderator
    12 years ago

    Where is your fileshare located? If it is on a NAS which does not have RAWS/RALUS loaded, then this behaviour is expected.  Incremental/differential backups are not supported on machines/devices which do not have RAWS/RALU loaded.

    In addition to the earlier advice, it is not just the archive bit method that will be thrown off if you have AV scanning.  The modified time method is also affected.

  • Grayc's avatar
    Grayc
    Level 4
    12 years ago
    Turns out it a Symantec Endpoint Protection (SEP) issue. Everytime SEP runs on the Windows fileshare, it changes the update sequence number (USN) change journal on each file residing on that particular fileshare. Further research showed that the fileshare server's registry was missing an entry that prevents SEP from changing the USN change journal. The following DWORD was added to our 64-bit server: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Symantec\Symantec Endpoint Protection\AV\NoFileMod where the value data was set to "1".
  • pkh's avatar
    pkh
    Moderator
    12 years ago
    If you had told us that you are using SEP and the modified time method, I would have pointed you to my blog below which document this problem https://www-secure.symantec.com/connect/blogs/incremental-backups-become-full-backups
  • Grayc's avatar
    Grayc
    Level 4
    12 years ago
    Consulted our server team. The registery was updated.