Chapter 17 — Backups and recovery
Lesson map
Lesson 17 published. Map, example, EX049.
flowchart TD
N0["Learning outcomes"]
N1["17.1 What to back up"]
N2["17.2 The 3-2-1 idea"]
N3["Lab — Checking backup age"]
N4["17.3 Reading the result"]
N5["17.4 Testing restores"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
N6 --> EX["Worked example"]
EX --> Q["Exercise EX049"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["17.1 What to back up"]
N2["17.2 The 3-2-1 idea"]
N3["Lab — Checking backup age"]
N4["17.3 Reading the result"]
N5["17.4 Testing restores"]
N6["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX049"]
[Learning outcomes]
|
v
[17.1 What to back up]
|
v
[17.2 The 3-2-1 idea]
|
v
[Lab — Checking backup age]
|
v
[17.3 Reading the result]
|
v
[17.4 Testing restores]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX049]
Learning outcomes
You will (1) design backups for servers; (2) check backup success; (3) test restores.
17.1 What to back up
The file server holds staff documents, and the management information system holds pupil records. Both need daily backups. The directory servers replicate between each other, but still need a backup in case a mistake replicates too. CIS Controls v8 Control 11 covers data recovery, including automated backups, protection of backup data and testing.
The print server is backed up too, though its configuration matters more than any data it holds. Tomás lists, for each of the six servers, what must be restorable and how quickly, because restoring the management system before teaching resumes matters far more than restoring the print queue.
17.2 The 3-2-1 idea
A common rule is three copies, on two kinds of media, with one off site. The trust keeps nightly backups on a backup server, a weekly copy in a cloud storage service, and one copy offline that cannot be changed from the network. The offline copy matters because ransomware can encrypt anything it can reach.
The cloud copy protects against fire or flood at the school, while the offline copy protects against something that reaches the network and the cloud account together. Tomás checks that the offline copy is really disconnected between uses rather than mapped as a drive on the backup server.
Lab — Checking backup age
"""Check age of last successful backup per server against a 1-day target (stdlib only)."""
last_ok_hours = {"web01": 20, "files01": 22, "mis01": 70, "print01": 26, "dc01": 12, "dc02": 14}
late = {s: h for s, h in last_ok_hours.items() if h > 24}
for s, h in last_ok_hours.items(): print(f"{s:8} {h:3d} h {'LATE' if h > 24 else 'ok'}")
print(f"late {len(late)} of {len(last_ok_hours)}: {sorted(late)}")
Run with python3 lab_backupage.py. Verified output:
web01 20 h ok
files01 22 h ok
mis01 70 h LATE
print01 26 h LATE
dc01 12 h ok
dc02 14 h ok
late 2 of 6: ['mis01', 'print01']
17.3 Reading the result
Two of six servers have backups older than the one-day target: mis01 at 70 hours and print01 at 26 hours. The print server is a minor concern because it holds little data; the management system is serious. Dev finds that mis01's backup job failed when the database was locked during a software update and nobody saw the failure email.
The lab only reports age, so it cannot tell a failed job from one that never ran, which is why Dev reads the backup software's own log for mis01. The failure email existed, but it reached an address nobody watched.
17.4 Testing restores
A backup that has never been restored is a hope, not a plan. Each term, Dev restores a sample folder from the file server and a copy of the management system database to a test machine, records how long it took and checks the data open correctly.
Restoring to a test machine rather than the live server means a mistake in the test cannot overwrite current data. The time taken matters as much as success, because a restore of the management system that takes a whole school day is a planning fact the trust needs to know in advance.
Worked example
After fixing mis01's job and sending failure alerts to a shared mailbox, the next run of the lab shows all six servers within target.
Synthetic case. Figures are synthetic.
Errors and limits
Backup success emails are easily ignored; a check that lists only failures is more likely to be read.
Exercises
- EX049 — Offline copy. Why keep one backup copy offline? Rubric: 3 = ransomware cannot reach or change it;; 2 = safety;; 1 = vague;; 0 = none.
- EX050 — Lab findings. Which servers were late and which matters more? Rubric: 3 = mis01 and print01, mis01 more due to pupil data;; 2 = names both;; 1 = wrong;; 0 = none.
- EX051 — Restore test record. List three things to record in a restore test. Rubric: 3 = what, time taken, data verified;; 2 = two;; 1 = one;; 0 = none.
Synthesis
Backups need protection, monitoring of success and regular restore tests.
Continue studying — chapter 17 of 30
← Chapter 16 (draft) · Course chapter index · Chapter 18 (draft) →