Huge differential set sizes

[cmv]

We have 4 servers being backed up currently (2 RAWS and 2 RALUS). The schedule is to do a full backup on Saturday morning, and then differentials based on file modification time on Sunday-Friday mornings.

We're noticing that the differentials tend to be very large proportionate to the amount of data that would actually change in that timeframe - one server, a domain controller, has a 13GB full backup and a 9GB differential! For another server, I manually ran a full backup (27GB), and even the differential 5 hours later was still 310MB - there should be far fewer data modifications overnight on a server that sees the majority of its workload during the day. The full and differential jobs for each server have the same selections, so we can safely guess that the differential is not backing up data that is not in the full. Again, we are certain that there is not that much data changing. What could be the cause of the huge differential backup sets?

[pkh]

Have you taken a look at the files that are backed up during the differential backup and verified that they are indeed backed up although they are not modified?

Are there any AV scanning on the problem server between your full and differential backup.

Unlike incremental backups, note that differential backups backup all files which are modified since the last full backup, regardless of the number of differential backups that you have done since the full backup.

[Sush---]

In this case I would suggest you use the Archive bit option for your Windows server and Modified time backup method for Linux servers.

Surely this will make some changes in the byte count and will be more accurate.

Thanks,

-Sush...

[cmv]

I noticed that one of the Linux servers has differential sets identical to the full size. The full and differential jobs are failing because of characters that the file system seems to have trouble reading (ö, é, etc). However, except for the small number of files that do that, the job appears to otherwise complete. Would the fact that the full job failed, even though it was only a few files with problems, make the differentials large and attempt to do everything?

As for AV, the Windows servers have SEP 11.

[cmv]

Thank you for this suggestion. We are still looking at this problem and I will post here with our results after doing this for a few days.