Backup & Recovery Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A backup is a restore you have practised

RPO is how much work you can bear to lose, which sets how often you copy. RTO is how long you can bear to be down, which sets how you restore and whether the copy is online. Write both in hours or days before you buy a disk. A tool that copies every night supports an RPO of about a day, not of five minutes.

3-2-1 is a planning shape: three copies, on two kinds of media, with one copy somewhere that a single room cannot destroy. The generator on this site drafts that sentence from the numbers you type. It does not copy your files. A sync folder that can overwrite yesterday with today's delete is not the third copy unless versions or a delay protect it.

The database companion on the DBA desk is the application-consistent database backup. This page is the server: files, images, and the decision of which databases you are not dumping with a naive file copy. A file copy of an open database file is a file, not a restore.

Test the restore onto a spare host or a spare directory. A restore onto the only copy is not a test. Time the restore. If it misses the RTO, the plan is wrong even though the job exited 0.

A lab copy you can restore without the original

Pick one directory on the lab host, such as /srv/www/edge. Copy it to a second disk or a second host you operate. Keep a third copy that is not in the same room, even if the third copy for the lab is a disk you unplug and put in a drawer. The storage calculator sizes that disk from the data plus the retention. Add room for growth. A disk that is 100 percent full fails the next copy.

Delete a test file from the original, or restore into an empty directory, and confirm the file comes back from the copy. Time it. Write the minutes in the ticket next to the RTO. If you only listed the files in the backup catalog, you have not restored.

Name what is excluded. Caches, temporary build trees, and secrets you rotate rather than archive. A secret that must be restorable is stored as a secret, with a mode from the permissions guide, not as a line in a world-readable dump.

The schedule of the copy uses the scheduling guide. It does not run at the same minute as the heavy report if that collision is the performance problem you already saw.

A change you can finish

Production adds the real paths, the real offsite copy, and a calendar for the restore drill. The first drill is part of calling the system backed up. Until the drill happens, you have a copy job.

Rollback of a bad backup change is the previous job definition. You do not delete the only good copy while testing a new tool.

Write RPO and RTO in hours or days.
List the paths and the databases that need an application-consistent method.
Size the media with the calculator, including growth and retention.
Put a copy on different media and a copy that can leave the room.
Restore a test file to a spare place and time it.
Schedule the job as a user that can read the paths and nothing extra.
Put the next drill date in the ticket.

Mistakes that outlive the command

backup and recovery fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A sync that propagates deletes, called a backup.
A snapshot on the same volume, called a backup.
A file copy of a live database file.
A successful job log and no restore.
One disk in the same chassis as the only other copy.
A backup account that is a full administrator because the share denied a narrower account.
Retention so short that the mistake is discovered after the good copy has rotated away.
Testing the restore by overwriting the only original.

Decisions to write down before the window

Decision 1 for backup and recovery. RPO and RTO are numbers. The schedule matches the RPO. The timed restore matches the RTO, or the RTO is revised. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 2 for backup and recovery. Three copies, two media, one that a single room cannot destroy. The generator's sentence matches the disks you actually have. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 3 for backup and recovery. Databases use the method the DBA guide names, not a copy of open files. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 4 for backup and recovery. The restore target is spare space. The original stays put during a test. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 5 for backup and recovery. The backup account can read the paths and cannot administer the domain or the host beyond that. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 6 for backup and recovery. Retention is longer than the time it usually takes someone to notice a mistake. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 7 for backup and recovery. Secrets in the backup are protected like secrets. A ticket does not contain them. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 8 for backup and recovery. The schedule avoids the collision you already measured. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 9 for backup and recovery. A drill date exists. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 10 for backup and recovery. The previous job is kept until the new job has one successful restore. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Decision 11 for backup and recovery. A second person saw the restored test file, not only the job status. Write that decision in the ticket before you change the host. The proof is the smallest command or screen that confirms it, recorded with the hostname and the time. If the host disagrees, the ticket changes. A second change does not go on top of a failed check. The rollback is the previous value you wrote down, not a reboot that hides which line mattered.

Backup checks before you say the system is covered

Check 1 in Backup checks before you say the system is covered. RPO and RTO are written in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 2 in Backup checks before you say the system is covered. The paths in the job match the paths in the ticket. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 3 in Backup checks before you say the system is covered. A database is not backed up as an open file copy. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 4 in Backup checks before you say the system is covered. Media size includes retention and growth. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 5 in Backup checks before you say the system is covered. A copy exists on a second kind of media. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 6 in Backup checks before you say the system is covered. A copy exists that a single-room loss would not take. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 7 in Backup checks before you say the system is covered. A test file was restored to spare space. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 8 in Backup checks before you say the system is covered. The restore was timed. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 9 in Backup checks before you say the system is covered. The job account is not an all-powerful account. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 10 in Backup checks before you say the system is covered. The next drill date is on a calendar. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 11 in Backup checks before you say the system is covered. A snapshot was not counted as one of the three copies. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 12 in Backup checks before you say the system is covered. A second person opened the restored file. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 13 in Backup checks before you say the system is covered. The old copies were not deleted to free space for the test. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 14 in Backup checks before you say the system is covered. The hostname in the prompt matches the hostname in the ticket for backup and recovery. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 15 in Backup checks before you say the system is covered. The result line includes the time and the person, not only the command. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 16 in Backup checks before you say the system is covered. You can point at the rollback value without searching a chat history. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Check 17 in Backup checks before you say the system is covered. Done is a sentence a second person can repeat: the proof for backup and recovery happened, and the next host is not started early. Record the device name, the result, and the time on the same line. If the result does not match this check, stop and fix the ticket before you add another change. The rollback for this check is the previous value you wrote down, not a reboot. A reboot hides whether the check was the one that mattered. When the check passes, move to the next one. When it fails, the incident is this check.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar. A published page is linked. The others are named until they are published.

The content plan also names a companion in another desk: DBA: Database Backup & Recovery Guide.