DHCP, Task: Verify previous day's backup job

Task: Verify previous day's backup job

Purpose

The purpose of this process is to give guidance on how to verify the integrity of the daily scheduled backup job. Regardless of the utility used to provide backup service to the DHCP server, the operations team should verify each backup job after its completion. This verification allows the operations team to resolve issues with backups that may put the organization at risk of data loss.

Procedure 1: Verify the backup job is completed

You can use Event Viewer to verify whether a backup job started or completed, and if there were errors encountered during the backup operation.

1. Start Event Viewer.
2. Right-click Application Log, select Properties, highlight View, and select Filter.
3. In Event Source, click the drop-down menu, select NTBackup, and click OK.
4. Search for the following events:

   ● Event 8000: This event signals the start of a backup on a volume. You should receive this event for each volume in the backup job.

   ● Event 8001: This event signals the end of a backup on a volume. You should receive n - 1 of this event for a backup job, where n is equal to the number of volumes in the backup job. When a volume has backed up successfully, Event 8001 will be logged as an informational event. When errors are encountered backing up a volume, the 8001 event will be logged as an error event.

   ● Event 8019: This event signals the end of the backup operation. You should receive one 8019 event per backup job.

Procedure 2: Review the backup log

Backup logs can be vital to troubleshooting and recording status of the backup operation. The default setting in Windows Server 2003 is for backup logs to contain summary information - for example, loading a tape, starting the backup, files backed up, bytes backed up, or failing to open a file. Some operations environments require more detailed information, such as which files are being backed up for a particular backup job.

For more detailed logging in the backup logs

1. Start the Backup utility.
2. On the Tools menu, click Options.
3. In the Options window, click the Backup Log tab, select Detailed, and click OK. Backup logs will now contain detailed information regarding the backup operations.

To review the backup log

1. Start the Backup utility.
2. On the Tools menu, click Reports.
3. In the Backup Report dialog box, select the previous night’s backup report, and click View.

Procedure 3: Report problems in backup to incident management

Use the incident management process to record one of the following conditions in your environment. This procedure gives guidance on some of the steps that should be followed when filling out the incident management report.

• Event 8000 is not logged in the application log. When this occurs, the DHCP server is at risk of data loss. Verify the backup job has not been deleted. Review the start time for the job to verify it has not been modified.
• Event 8000 is not logged for all volumes on the server. When this occurs, a volume is at risk of data loss. Review the backup configuration for the backup job to see if the volume has been removed from the backup job. Check the change management database to see if the volume has been removed from the backup job.
• Event 8001 is logged as a warning event in the application log. Review the backup log by searching for the “Warning:” string in the body of the log. Record what the warning is and the reason for the warning.
• Event 8019 is not logged in the application log. This means the backup job is still running. Review the application log and record the last volume to trigger a successful 8001 informational event. Record the last volume to trigger an 8000 event.

Dependencies

● Backup jobs are logged to disk.

● Incident management process.

Technology Required

● Backup utility

● Third-party backup software