Backup & Recovery Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A backup is a restore you have practised

RPO is how much work you can bear to lose, which sets how often you copy. RTO is how long you can bear to be down, which sets how you restore and whether the copy is online. Write both in hours or days before you buy a disk. A tool that copies every night supports an RPO of about a day, not of five minutes.

3-2-1 is a planning shape: three copies, on two kinds of media, with one copy somewhere that a single room cannot destroy. The generator on this site drafts that sentence from the numbers you type. It does not copy your files. A sync folder that can overwrite yesterday with today's delete is not the third copy unless versions or a delay protect it.

The database companion on the DBA desk is the application-consistent database backup. This page is the server: files, images, and the decision of which databases you are not dumping with a naive file copy. A file copy of an open database file is a file, not a restore.

Test the restore onto a spare host or a spare directory. A restore onto the only copy is not a test. Time the restore. If it misses the RTO, the plan is wrong even though the job exited 0.

A lab copy you can restore without the original

Pick one directory on the lab host, such as /srv/www/edge. Copy it to a second disk or a second host you operate. Keep a third copy that is not in the same room, even if the third copy for the lab is a disk you unplug and put in a drawer. The storage calculator sizes that disk from the data plus the retention. Add room for growth. A disk that is 100 percent full fails the next copy.

Delete a test file from the original, or restore into an empty directory, and confirm the file comes back from the copy. Time it. Write the minutes in the ticket next to the RTO. If you only listed the files in the backup catalog, you have not restored.

Name what is excluded. Caches, temporary build trees, and secrets you rotate rather than archive. A secret that must be restorable is stored as a secret, with a mode from the permissions guide, not as a line in a world-readable dump.

The schedule of the copy uses the scheduling guide. It does not run at the same minute as the heavy report if that collision is the performance problem you already saw.

A change you can finish

Production adds the real paths, the real offsite copy, and a calendar for the restore drill. The first drill is part of calling the system backed up. Until the drill happens, you have a copy job.

Rollback of a bad backup change is the previous job definition. You do not delete the only good copy while testing a new tool.

Write RPO and RTO in hours or days.
List the paths and the databases that need an application-consistent method.
Size the media with the calculator, including growth and retention.
Put a copy on different media and a copy that can leave the room.
Restore a test file to a spare place and time it.
Schedule the job as a user that can read the paths and nothing extra.
Put the next drill date in the ticket.

Mistakes that outlive the command

backup and recovery fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A sync that propagates deletes, called a backup.
A snapshot on the same volume, called a backup.
A file copy of a live database file.
A successful job log and no restore.
One disk in the same chassis as the only other copy.
A backup account that is a full administrator because the share denied a narrower account.
Retention so short that the mistake is discovered after the good copy has rotated away.
Testing the restore by overwriting the only original.

Decisions to write down before the window

One decision for backup and recovery: RPO and RTO are numbers. The schedule matches the RPO. The timed restore matches the RTO, or the RTO is revised. Three copies, two media, one that a single room cannot destroy. The generator's sentence matches the disks you actually have. Databases use the method the DBA guide names, not a copy of open files. The restore target is spare space. The original stays put during a test. The backup account can read the paths and cannot administer the domain or the host beyond that. Retention is longer than the time it usually takes someone to notice a mistake. Secrets in the backup are protected like secrets. A ticket does not contain them. The schedule avoids the collision you already measured. A drill date exists. The previous job is kept until the new job has one successful restore. And a second person saw the restored test file, not only the job status.

Backup checks before you say the system is covered

Confirm this before you call the change done: RPO and RTO are written in the ticket. The paths in the job match the paths in the ticket. A database is not backed up as an open file copy. Media size includes retention and growth. A copy exists on a second kind of media. A copy exists that a single-room loss would not take. A test file was restored to spare space. The restore was timed. The job account is not an all-powerful account. The next drill date is on a calendar. A snapshot was not counted as one of the three copies. A second person opened the restored file. The old copies were not deleted to free space for the test. The hostname in the prompt matches the hostname in the ticket for backup and recovery. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for backup and recovery happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.

Companion: DBA: Database Backup & Recovery Guide.