Encryption in Netbackup and dedupe ratio

I have it on good authority that if encryption at rest is enabled in MSDP, then this results in what appears to MSDP to be new versions of de-duped segments - and so, if your pool is low on space - then you could very quickly run out of space.

Extrapolating this, says to me, that if your backup schedules are well established AND your used space is over 49% (assuming you still have the default HWM of 98%) then you run the very real risk of the MSDP filling up and going off-line - before the MSDP pool has had a chance to expire/remove dereferenced segments.

thank you very much for the link, this is really useful.

so I can enable encryption on media server to encrypt the backup data on MSDP pool..right ?

does it requie license ?

Hi,

Yes you can ebable it on the MSDP pool. It does not require a license.

thanks a lot for help.

Pleasure

Hi SDO,

So basically all content would consider new, and won't dedupe? Have you seen this happen, any notes?

Well, my understanding is that, post enablement of encryption at rest - then de-dupe carries on as before - it's just that immediately after enabling encryption at rest (and restarting PureDisk) then any segments which may have previously been eligible for dedupe will not no longer match because they are now encrypted.  However, subsequent encrypted segments which do match will de-dupe.  I guess it's bit like having your MSDP pool fill up from new again.

Not actually seen it.  No notes.  Was warned about it verbally from a Symantec person, who also recommended (obvious now) that when considering enabling encryption at rest, that it should be done/actioned/implemented before using the MSDP pool in earnest.

Makes sense if you think about it. Thanks

And thinking further - this means that MSDP is going to experience increased workload (de-referencing) and increased IO (dereferencing and removing) - until all of the old unencrypted dereferenced segments have been removed... so an MSDP pool may appear to run slower - but any 'apparent' slowness cannot be solely attributed to the CPU impact of having enabled encryption - until all of the the old unencrypted segments have been expunged.  Only after this will any 'CPU' overhead of encryption become slightly clearer.

I have also been told that the CPU and RAM impact of enabling MSDP encryption at rest within a NetBackup Appliance is fairly low - because the CPUs encrypt in hardware - and because the segments and fingerprints are in RAM when encryption occurs.  As for the impact on other 'roll your own' installations of MSDP, no-one can comment, unless you check the server specs in detail.