Backup/en

Introduction

What characterizes the TERRA CLOUD backup solution?

TERRA CLOUD Backup is a comprehensive data backup solution. All necessary components are provided by TERRA CLOUD.
This gives you a single point of contact for any questions or issues.

Communication between all components involved is always encrypted. Only a single agent needs to be installed on the server to be backed up.
It then connects to our data center via ports 8086 and 8087.
Since the connection originates from the server being backed up, no inbound firewall rules or NAT configurations are required.

Administration is handled via the multi-tenant TERRA CLOUD Backup Portal.
In this portal, you can view all servers linked to your account through agent registration.

The backup solution essentially consists of three components: Agent, Portal, and Vault:
The Agent is the software component that performs the backup on the system being protected. The Portal is used to administer and monitor these agents and to initiate restores. The Vault is the secure storage repository that receives and safely stores the backups. All backups are stored redundantly across two different data centers, distinguishing between a primary and a secondary vault.

Function overview

TERRA CLOUD Backup - Functional Overview
Fuse	Windows Agent	Linux Agent	vSphere Agent	Hyper-V Agent
Bare-Metal Restore*
Alterable backups (WORM)
Hybrid Cloud Backup (Satellite)
Backup of virtual systems (servers, VDI)
Backup deferral (initial backup)
Renewed Backup Attempts
Initialbackup ext. HDD/FTP
Protocol truncation (MS Exchange and MS SQL)
Microsoft VSS Support
Backup of physical systems (servers, clients)
Backup of network shares
Backup/Excluding Files and Folders
Threat Detection
Windows_Backup_Event_Triggers
High Frequent Backup - Hourly Backups
Restore
Bare-Metal Restore
Restore files and folders
Restore from another computer
Recovery to IaaS Cloud (DRaaS)
Rapid VM Recovery (Satellite Vault)
Rapid VM Recovery (Enterprise Vault)
Storage
Storage of backups for up to one year
Storage of backups for up to ten years
Automation
Script-based control
Automated BMR test restores
Fully Automated Setup
Patch management of the backup software
Monitoring
Interface for ext. Backup sensors
Mail notification via the backup portal
Backup History Graph

Included in TERRA CLOUD Backup Basic/Standard
Additionally included in TERRA CLOUD Backup Enterprise
Bare-metal restore (BMR) backups using a Windows agent on a Hyper-V host are not supported. For further information, please see here	*

Product presentation and initial setup

To make getting started with TERRA CLOUD Backup as clear as possible, the following diagram illustrates the complete setup process—ranging from the installation of the agent and its automatic configuration via the Backup Portal to the final installation of the TERRA CLOUD Backup agent.
It highlights the stages where the process can be significantly accelerated and standardized through features such as automatic agent configuration.

Following the diagram, we recommend familiarizing yourself with the fundamental concepts and functions of TERRA CLOUD Backup.
A good supplement to this is the recordings of the TERRA CASTs, which you can find here.

Requirements

Supported operating systems

Windows Agent

Windows Server:

• Windows Server 2025: Standard, Datacenter, Server Core
• Windows Server 2022: Essentials, Standard, Datacenter, Server Core
• Windows Server 2019: Essentials, Standard, Datacenter, Server Core
• Windows Server 2016: Essentials, Standard, Datacenter, Server Core

Windows Client:

• Windows 11: Home, Pro, Enterprise (Version 25H2)
• Windows 10: Home, Pro, Enterprise (Version 22H2)

Plug-ins:
Please refer to the supported platforms and applications of the respective plug-ins in the Agent Doku/Release Notes

Linux Agent

• Debian 13 (up to Update 2)
• Debian 12 (up to Update 12)
• Debian 11 (up to Update 11)
• Debian 10 (up to Update 13)
• openSUSE Linux 16 (up to Service Pack 0) A) B)
• openSUSE Linux 15 (up to Service Pack 6) A) B)
• Oracle Linux 10 (up to Update 1)
• Oracle Linux 9 (up to Update 7)
• Oracle Linux 8 (up to Update 10)
• Oracle Linux 7 (up to Update 9)
• Red Hat Enterprise Linux Server 10 (up to Update 1)
• Red Hat Enterprise Linux Server 9 (up to Update 7)
• Red Hat Enterprise Linux Server 8 (up to Update 10)
• Red Hat Enterprise Linux Server 7 (up to Update 9)
• Rocky Linux 10 (up to Update 1)
• Rocky Linux 9 (up to Update 7)
• Rocky Linux 8 (up to Update 10)
• SUSE Linux Enterprise Server 16 (up to Service Pack 0) A)
• SUSE Linux Enterprise Server 15 (up to Service Pack 7) A)
• SUSE Linux Enterprise Server 12 (up to Service Pack 5) A)
• Ubuntu Server 24.04
• Ubuntu Server 22.04
• Ubuntu Server 20.04
• Ubuntu Server 18.04

Notes:
Since CentOS Stream is a pre-release version of RHEL and does not have long-term stable releases, the Linux agent on CentOS Stream is not supported.

A) This platform is not supported when the BTRFS file system is used.
B) The Agent is supported on this platform, but BMR backups are not supported for an openSUSE 16.0 UEFI or openSUSE 15.6 UEFI system with a FAT16 EFI boot partition.

Supported file systems on Linux:

• ext2
• ext3
• ext4
• XFS
• GFS
• ReiserFS
• JFS

The BTRFS file system is not supported.

Supported Agent Versions

Windows Agent
Operating system	Agent version x86	Agent version x64	A notice
Windows Server 2003	7.34.4009a	7.34.4009a	EOL
Windows Server 2008 + R2	9.10.1013	9.30.1009	EOL
Windows Server 2012 + R2	-	9.30.1009	EOL
Windows Server 2016	-	9.50.6732	-
Windows Server 2019	-	9.50.6732	-
Windows Server 2022	-	9.50.6732	-
Windows Server 2025	-	9.50.6732	-
Windows 7	9.10.1013	9.30.1009	EOL
Windows 8 + 8.1	9.10.1013	9.30.1009	EOL
Windows 10	9.10.1013	9.50.6732	-
Windows 11	-	9.50.6732	-

Any operating system marked "EOL" can still be backed up using the corresponding agent version. However, neither Microsoft nor our software vendor offers support for these platforms. Please note that TERRA CLOUD can only provide "best-effort support." In the event of an error, we cannot rely on the software manufacturer for assistance.
It is strongly recommended to keep operating systems up to date. If an update is not possible, regular test restores should be performed.

Hyper-V Agent
Operating System	Agent Version x86	Agent Version x64	Note
Windows Server >= 2012 R2	-	9.40.1009	-

vSphere Agent
Operating System	Agent Version x86	Agent Version x64	Note
Windows Server from 2012 R2 to 2022	-	9.22.1011	-

Linux Agent
Operating system	Agent version x86	Agent version x64	A notice
Supported Linux distributions	8.90.1020	9.41.1020	See Release Notes for supported Linux distributions

Network configuration

Port overview TERRA CLOUD Backup
Protocol	Port	Source	Goal	Function	A notice
TCP	443	Agent	Portal	Automatic agent updates	185.35.13.210/32
TCP	2546	Agent	Vault	Connection to the Vault for data backup, synchronization and restore	*
TCP	8086	Agent	Portal	Registering an agent on the portal	185.35.13.210/32
TCP	8087	Agent	AMP	Management of agents via the portal	195.4.212.128/25

Port overview TERRA CLOUD Hybrid Backup
Protocol	Port	Source	Goal	Function	A notice
UDP	123	Satellite	Internet	NTP time synchronization	-
TCP	443	Satellite	Portal	Interface updates and Support Connect function	-
TCP	2547	Satellite	Basevault	Heartbeat / Management	OLD Satellite-Vault version <= 8.62*
TCP	12546	Satellite	Basevault	Heartbeat / Management	NEW Satellite-Vault version > 8.62*
TCP	12547	Satellite	Basevault	Data transfer for backup replication	*

* Note:
Access must be enabled for both the primary and secondary Vaults using their respective FQDNs and IP addresses.
You can find the public IP address of each Vault via the Vault Finder in the backup portal:
backup.terracloud.de → Quick Links → Vault-Finder

Vault

A vault is a virtual system that is operated in the TERRA CLOUD or a partner data center.
This system communicates with the backup agents and receives backups and stores them according to the defined retention periods.
Backup packages include access to a shared backup platform in the form of a Vault account.

Vault-Account

A Vault Account is a unique organizational unit on a Vault system; it is required for authenticating a Backup Agent with the Vault.
The Vault Account name is composed of your customer number at Wortmann AG and the name of your end customer in the TERRA CLOUD Center, written in capital letters.

Example:
12345-ENDKUNDEXY

You require the Vault Account—for instance, when creating a new Vault Profile—so that the Agent can use the data from the profile to authenticate itself with the Vault system.
The Vault Account is entered into the "Account" and "Username" fields.

General

Retention periods

TERRA CLOUD Backup offers you a data backup retention period of up to 365 days in the Standard license model.
The retention period of a data backup on the Vault is determined by the selected retention type.

Retention Types

A retention type consists of two parameters that determine the retention time of a data backup.

Online storage(days):
This parameter specifies the minimum number of days the data backup must be stored on the Vault.

Online copies:
This parameter specifies the minimum number of backup copies required for this backup job.

Important: Linking the parameters
In order for a data backup to be considered expired and to be removed, BOTH parameters must be exceeded.
The safeset must therefore be at least the defined X days old AND there must be at least Y data backups for the backup job.

Preconfigured retention types

The following retention types are pre-configured and automatically created during agent installation.
Please note that 50 safesets are included free of charge per backup job; additional backup points can be added for an extra charge.

Note:
Starting April 1, 2024, 50 safesets can be configured free of charge per backup job.

24-Hour (Hourly Backup):
This retention type is automatically created by a "Sub-Day" schedule and cannot be edited.
It is required for the function High Frequent Backup.
Backups are retained for a maximum of 24 hours.
48-Hour (Hourly Backup):
This retention type is automatically created by a "Sub-Day" schedule and cannot be edited.
It is required for the function High Frequent Backup.
Backups are retained for a maximum of 48 hours.

Daily (daily backup):
This retention type is suitable for one backup per day.
Backups are retained for a total of 30 days each, and the job must contain at least 30 backups.

4xDaily (four daily backups):
This retention type is suitable for four backups per day.
Backups are retained for a total of 10 days each, and the job must contain at least 40 backups.

Monthly (monthly backups):
This retention type is suitable for one backup per month.
The backups are retained for a total of 365 days each, and there must be at least 12 backups in the job.

Yearly (annual backup):
This retention type is suitable for one backup per year and must be used for Retention of backups for 10 years.
The backups are retained for a total of 3653 days each, and there must be at least 10 backups in the job.

Former default retention types

The following standard retention types have been used in the past for TERRA CLOUD backup and may still be stored on the systems:

Daily (7/7 Version):
This retention type is suitable for one backup per day.
In total, the data backups are kept for 7 days each and there must be at least 7 data backups in the job.

Weekly(weekly backup):
This retention type is suitable for one backups per week.
In total, the data backups are kept for 31 days each and there must be at least 5 data backups in the job.

Create individual retention types

If you do not want to use or add to the standard retention types, you have the option of defining your own retention types using the agent's advanced settings:

Consumption values for licensing

The consumption values of a TERRA CLOUD backup account consist of:

• Natively protected data set of backup jobs
• Number of protected systems
• Number of active safesets of the backup jobs

On the 15th calendar day of a month, the above-mentioned consumption values are determined and made available to you in the form of the consumption report on the 16th calendar day.

Consumption values of the active safe sets

50 active safe sets are included in the inclusive quota per backup job and can be distributed depending on the retention scheme and Schedule configuration.
In order for a safeset to be considered expired and to be deleted, the retention parameters “Online storage (days)” and “Online copies” must be exceeded.
This can result in more than 50 safesets being present in the vault at the time of consumption measurement because expired backups have not yet been removed from the vault.
The TERRA CLOUD backup license model therefore includes a free buffer zone of 10 safe sets.
If 61 or more safe sets are used, all safe sets above the inclusive quota will be invoiced.

Safeset consumption zones

Zone	Safe set number
Inclusive quota	01 - 50 safe sets
Buffer zone	51 - 60 safe sets
Additional consumption	61 - ∞ Safe sets

Portal

The configuration is carried out as an example as documented in the following sections. The administrator account “backupadmin@terracloud.de” was used for this configuration.
This corresponds to your specialist dealer administrator account (backup master account).

Structure of TERRA CLOUD Backup Portal

Description:
This diagram shows the structure of the Backup Portal. The upper level consists of the parent site, which you can recognize by its name consisting of your Wortmann AG customer number and your company name. Through this level, you can administer (child) sites and centrally access all portal functions. You can create users for both levels; these are shown in the diagram in green for the parent site and in blue for the end customer sites. Please create a separate site for your company, as indicated in the diagram with the NFR site.
You can then move the agents for your systems to this site or register them directly via a user within the site.

Note:
Please only register agents in the parent site if they will subsequently be moved to the associated customer site for further configuration.

Site

A "Site" is an administrative area within the TERRA CLOUD Backup Portal that represents an end-customer organization.
Sites enable the separation of your tenants and simplify the management of backed-up systems.
As soon as you book a backup package for a customer, we automatically create a (child) site for you, along with a registration user.
This user can be used exclusively to register new agents with the backup portal; logging into the backup portal itself is not possible with these credentials.
You can find the access details for this registration user under the "Users" tab within the respective site.

Manually create site

Should you ever need to create a site manually, you will find a button for this under the "Sites" tab.
This launches the site creation wizard.

Site name assigned

The first step is to assign a name to the new site.
We recommend, for example, combining your customer's name with their customer number from your ERP system (12345-EndCustomer).
Then click "Next".

Create user

Optionally, you can then create an additional user with admin rights for the customer's site; this user will also be able to log in to the backup portal.

Note:
You can find further information on the various user roles in the permissions concept. The screenshot below shows the configuration for a user with the "Admin" role.
Please note that you must assign agents to users who do not have the "Admin" user role.

Vault Profile

Once a TERRA CLOUD Backup package has been provisioned, you will receive the access credentials for your tenant's vault account.
These credentials are required for authentication between the agents and the vault (storage destination).
These credentials must be saved into a vault profile within the wizard.

Vault Name:
The vault name is the display name for the vault profile.
Recommendation:
For simplicity, we recommend using the vault's FQDN (e.g., vault-wmh2-P001.terracloud.de) as the vault name.
The chosen vault name serves only as a label and has no technical function.

Address:
Enter the vault's FQDN here (e.g., vault-wmh1-P001.terracloud.de).
Account:
Enter the provided vault account (e.g., 45814-ENDKUNDE).

Username:
Enter the provided vault account here as well (e.g., 45814-ENDKUNDE).
The account and username have been set up identically to simplify the setup process.

Password:
Enter the provided password; this vault password is used to authenticate the vault account and is not used to encrypt user data.

Automatic Agent Configuration

Finally, you have the option to enable automatic agent configuration so that new agents are configured automatically.

Prerequisites:
To have a backup job created fully automatically, an encryption password must be defined.
With automatic agent configuration, the encryption password is passed as the default encryption password during the installation process itself.

Please select a vault profile and a job template.
If you are logged in as a parent site user, you can choose from all the job templates you have previously created and saved at other (child) sites.

Summary

In the final step, you will receive a summary of the information entered.

Configure notification

You can subsequently configure email notifications for the site via the "Notifications" tab.
The specified address will receive a notification as soon as the selected events occur.

Please note that portal-based email notification is currently not available for all agents. See Function Overview

"Encryption password changed" option:
This can alert you, for example, in the event of unauthorized access—such as when an attacker attempts to gain access to future backups by changing the encryption password.
The encryption password cannot be changed retroactively for existing safesets.

Note:
Changes to the encryption password are also displayed in the "Status Feed".

The basic configuration for the (child) site is now complete.
You can subsequently review all settings made in the site creation wizard within the individual tabs of the respective (child) site and adjust them separately if necessary.

Create additional users

Just as in the Site Creation Wizard, you can also create additional portal users later from within the site via the "Users" tab.
In addition to creating another administrator, you have the option here to select other user roles.

Note:
You can find further information on the various user roles in the permissions concept.
The following screenshot shows the configuration for a user with the "User" role.
Please note that you can still assign agents to users who do not have the "Administrator" role.

Create job template for automatic agent configuration

You can create your own job templates by opening the "Automatic Agent Configuration" tab for the respective site.
Click "View" next to the existing job template and then create an editable copy of the template.
You can customize this copy as desired and use it for automatic agent configuration after saving it.

Note:
The start time for the data backup is randomly selected within the time windows of 18:00 – 21:00 and 02:00 – 06:00.
Example of a custom job template:

Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) must be enabled to protect access to the TERRA CLOUD Backup Portal.

MFA Process

• TOTP (Time-based One-Time Password)
  • The user employs an authenticator app, such as Microsoft Authenticator or Google Authenticator.
    The app generates time-based one-time codes that are entered during login.

Configure MFA

When creating a new user, the mandatory multi-factor authentication (MFA) requirement is enabled by default.
Consequently, the user is prompted to set up MFA upon their first login.

Since multi-factor authentication (MFA) was not previously mandatory, there may be user accounts where it has not yet been enabled.
These users must set up MFA subsequently.
To do this, the user first logs in to the TERRA CLOUD Backup Portal without having MFA set up.
Then, the Edit my profile entry is opened via the menu in the top right corner (three dots).

Multi-factor authentication can then be set up in the Two-factor configuration section.

Reset MFA

To reset two-factor authentication (MFA), please proceed as follows:

• If you haven't already done so, create a second user with administrator rights in the Backup Portal under Users.
• Then, log in using this second administrator account and, under Users, open the administrator account for which the MFA needs to be reset.
• Enable the option highlighted in red in the screenshot.

The next time this user logs in, two-factor authentication will need to be set up again.
You can remove the additional administrator account if desired once MFA has been successfully set up.

Authorization concept

This table shows the four different roles that can be assigned to a user, as well as the registration user automatically created by the TERRA CLOUD.
You can create users either within a site or at the reseller level in your parent site.
For further information, please refer to the diagram showing the structure of the TERRA CLOUD Backup Portal.

User and Portal Management	Read Only*	Execute Only*	User**	Administrator	Registration User***
Can assign agents to other users*
Move computers to another site
Delete backup jobs and computers from the vault
Agent Upgrade Center
Report function
Create additional users
Handling potential threats
Agent and backup management	Read Only*	Execute Only*	User**	Administrator	Registration User***
Register agents on the portal
Configure agents on the portal
Create and view schedules
Create and edit backup jobs
Advanced Agent Configuration***
Backup jobs and computers from the portal interface delete
Backup operation and recovery	Read Only*	Execute Only*	User**	Administrator	Registration User***
Start backup manually
Recovery carry out
Monitoring and information	Read Only*	Execute Only*	User**	Administrator	Registration User***
View last backup status
View/download log files
Statusfeed view
View backup job configuration

* Assignment required to administer the agent based on the role.

** Assignment of the respective agent is not necessary if it was registered on the portal by the user.

*** This user is automatically created when ordering a backup package.

**** Agent description, retention types, email notification, bandwidth limitation, Agent logs.

Computer

All registered systems are displayed in a table on the Computer tab. If you open the overview while logged in to a site, only the computers of the respective site (end customers) will be displayed.
This part of the portal offers you the opportunity to fully administrate, configure and much more with the agents in a multi-client capable manner.

Skipped backups

This function shows you whether and how many data backups were skipped.

A high rate of skipped backups can result from the following circumstances:

1. The intervals between data backups are too short and the next data backup is started during runtime.
2. A very long data backup duration ensures that the subsequent data backup is skipped.

Data backups may be skipped if the following two conditions are met together:

1. The backup job is executed more frequently than once per day, through multiple backups per day or the High-Frequent Backup.
2. A data backup is already in progress or the Vault is performing important maintenance work on the backup job.

Through the use of e.g. B. High-frequency backups, with up to 24 backups per day, the vault only has a short time window for maintaining the backup job.
To ensure that outdated data backups can be removed despite the high backup frequency, the agent is allowed to skip backups.

Skipped backup rate:
You will be shown the percentage of data backups skipped in the last 48 hours.
In this example, due to a misconfiguration, backups were made almost every minute to illustrate how this display works.

If you click on the value, you will be shown an overview of the data backups with information about whether they were skipped:

Move computer to another site

You can move as many computers as you want to another site using the Move Computers action.
This function makes it possible, for example, to assign systems that were accidentally registered in the Parent-Site to the end customer's site.
Please select the desired site for the selected computers:

Assign agents to users

Users who do not have the "Administrator" role must be assigned to agents who can be managed by them.
You can do this either via the user configuration within the site or via the Sites tab within your parent site.
In this example, only SERVER01 and SERVER02 have been assigned to the user for management.

Deletion of data backups

Delete computers from the portal and vault

You can have a computer's data backups completely deleted as an administrative user via the Backup Portal.

This type of deletion includes:

1. Deletion of the computer from the portal (online or offline computer)
2. Delete the backup of all backup jobs of this computer on the primary and secondary vault
3. Delete the registered computer on the Vault
   

Procedure for deleting a computer:

1. Select the desired system using the checkbox on the left side of the backup portal.
2. Under Actions, select Delete selected computer(s).
3. Switch to the “Completely Wipe Computer” option.
   
4. Enter "CONFIRM" in the input field of the dialog to confirm the deletion.

The deletion job will be executed after a quarantine period of 24 hours.

Cancel deletion job:
Within the quarantine period of 24 hours, you can select the computer as described above and cancel the deletion request using the "Cancel deletion of the selected computer(s)" action.

Delete backup jobs from the portal and vault

You can have the data backups of a backup job completely deleted as an administrative user via the Backup Portal.

This type of deletion includes:

1. Delete the backup job from the portal
2. Delete all data backups of the backup job on the primary and secondary vault
3. Delete the registered backup job on the Vault
   

Procedure for deleting a backup job:

1. Open the "Select Action" drop-down menu for the desired job under the "Job" tab of the respective computer.
2. Choose the “Delete Job” option.
3. Switch to the “Delete Job Completely” option (screenshot below).
4. Enter "CONFIRM" in the input field of the dialog to confirm the deletion.

The deletion job will be executed after a quarantine period of 24 hours.

Cancel deletion job:
Within the quarantine period of 24 hours, you can select the backup job as described above and cancel the deletion job using the "Cancel deletion" action.

Delete individual data backups (safesets) from the vault

As an administrative user, you can completely delete selected backups from a backup job via the Backup Portal.

This type of deletion includes:

1. Deleting the selected backup(s) from the backup job on the primary and secondary vaults, and if applicable, the satellite.

Procedure for deleting individual backups (safesets):

1. Open the "Select Action" drop-down menu for the desired job under the "Job" tab of the respective computer.
2. Select the "Delete Backup" option.
3. Select the safesets to be deleted and click "Delete" (image below).
4. Enter "CONFIRM" in the dialog box to confirm the deletion.
   

Note:

The deletion of individual backups (safesets) is executed immediately and cannot be stopped after confirmation. become!

Adjustment in the backup portal after a data migration

After migrating the data/backups to, for example, a dedicated vault system, the configuration must be adjusted in the backup portal.
After the migration, the backup agent should connect to another vault system and, if necessary, also use other access data for authentication.
The procedure differs slightly depending on the migration method. Please make the following adjustments after consultation in the migration process (support ticket).

Vault account migration

With this variant, the entire vault account is moved to another vault system. A vault account is an organizational unit for an end customer.
You will receive the access data and the name of the vault account when you provide the account, e.g. 12345-DEMO.
Please carry out the following steps after successfully moving the account:

1. For each agent, access the "Vault Settings" in the Backup Portal.
2. Edit the current vault connection and swap the FQDN of the old vault system with that of the new vault system.
3. Also customize the vault profile for this site.

The following screenshot shows the current vault connection that needs to be edited.

Migration of data to a new vault account

The prerequisite for this method is a new vault account, e.g. B. on a TCBE vault system. With this variant, only the affected computers and their backup jobs are moved.
Since authentication will now take place via the new account, all positions in the vault connection must be changed.

1. For each agent, access the "Vault Settings" in the Backup Portal.
2. Edit the current vault connection and replace all vault credentials with those of the new vault account.
3. Also adjust the vault profile of the affected site.

Reports

The reporting function gives you access to various data sets from the TERRA CLOUD backup via various preconfigured reports.
The underlying database receives new records twice a day through the TERRA CLOUD Vaults.
Please note that in connection with a TERRA CLOUD backup satellite, only data sets for the existing safe sets and consumption as of the base vault are available.
TERRA CLOUD backup satellites are not connected to the reporting function.

Requirements:
In order to view reports, the “Vault account” must be synchronized with the respective site.
Automatic synchronization of the Vault account – How it works:

• Below the “Vault Settings” is the Vault Registration (1)
• the “Vault Account” (2) will be transferred to the site (3)

For the synchronization to work, the following requirements must be met:

1. The Vault account may NOT be used across sites (same Vault account in different sites)
2. The agent was registered in a self-created site (https://backup.terracloud.de/Sites).

Different Vault accounts can be used within a site as long as they are not used in other sites.

Necessary permission of the user:
To access the Reports page, you must be logged in as a user with the Administrator role.
Reports can be scheduled and automatically sent by email (PDF, XLS, CSV).

Backup Verification Report

This report provides you with an overview of the most recently performed automated Recovery Tests by your vSphere Recovery Agents.
On the one hand, you have the option of exporting this view as a PDF document, and on the other hand, you can configure a regular export including email delivery using the "E-mail/Schedule" menu item.

Agent Upgrade Center

The Agent Upgrade Center offers you the opportunity to upgrade Windows agents from version 8.7x via the portal.

Update Individual Agents
You can select single systems via the “Computer” tab and initiate the agent update under “Actions”.

Status display
In addition to the current version, you can use the icon to see whether the agent can be updated (purple dot) or is currently being updated. As soon as an agent has been successfully updated, a checkmark will be displayed next to the version number. If you move the cursor to the symbol next to the version number, the respective meaning will be displayed, e.g. "New agent version available".
In the following screenshot you can see an agent that is currently being updated.

Update Agents for Entire Sites
To do this, access the Agent Upgrade Center via your master login and select the desired agent and then the respective sites.

Then select whether you want the agents to be updated automatically or immediately:

Backup Jobs

File-based backup

How it works

The backup software accesses the file system of the system to be backed up. The files are read and divided into 32KB blocks; a checksum is calculated for each of these blocks.
The delta can be determined in subsequent backups using the checksums. The blocks identified for backup are compressed and encrypted.

Fast File Scan

The "Quick File Scan" or "QFS Quick File Scanning" function allows the Windows agent to pre-filter files based on the timestamp (modified date) in the file system to determine the delta.
Files whose modification date is newer than the last backup are read in and compared with the delta file of the last backup using the calculated checksums of the 32KB blocks.
Only blocks that have not yet been backed up will be included in the backup.

Advantages and disadvantages file-based

Advantages:

1. BMR backup possible
2. Included as standard with the agent, no additional plugin is required
3. No reboot required after installation
4. Granular troubleshooting possible
5. Files/directories can be excluded
6. Can be administered from the agent console without portal access
7. Script-based restore possible via VPR file

Disadvantages:

1. Slower with lots of small files
2. Navigation via portal when restoring individual files
3. The OneDrive folder cannot currently be backed up.

Best Practice

1.In the best case scenario, use a file-based backup job only to back up individual files and folders.
2.Add the “Entire Server” option to existing file-based BMR backup jobs.
3.Use an image-based job to configure new BMR backups.
4. File-based backup jobs are only recommended for up to a million files; above a million files we recommend an image backup job.

Configure complex exclusions/inclusions in file-based jobs

The following instructions can be used for both local file-based backup jobs and UNC jobs (network shares).
When configuring one of the job types mentioned above, the portal can only be excluded or included to a limited extent.
Using the Backup Portal, you can only select one directory per exclusion entry in the job configuration and exclude folders and/or files in the respective subdirectory. This means that the entry only applies to the level below.

Example complex exclusion:
You want to exclude all directories that end with _Backup in a backup job because they Contains data backups that should not be included in the TERRA CLOUD backup.
D:\Data\*\*\*_Backup\*.*
In this exclusion there are two levels of different directories, each containing subdirectories ending in _Backup.
These directories and their contents are excluded using the syntax shown.
However, this complex exclusion expression cannot be configured in the portal and must therefore be copied manually into the job's configuration file.

Deposit exclusion in the job configuration:
1. Configure any exclusion
for the job 2. Stop both TERRA CLOUD Backup Agent
services 3. Open the JOBNAME.vvc file in the agent installation directory
4. Swap the exclusion created by step 1 with the one you want as in the following example
Exclude = "D:\*\*\*_Backup\*.*"
5. Start both services again
6. In the Backup Portal, check the job configuration and schedule and save it again if necessary 7. If you modify it manually, you will receive a warning in the Backup Portal, which you can simply confirm
8. After confirming the warning, please check whether the configuration has been applied as desired
For a complex inclusion, you can use these instructions analogously.

Ransomware Threat Detection

This file-based backup option allows the agent to scan the system for potential threats during backup.
If a possible threat is detected, the data backup is marked as a “potential threat”.
The current and all subsequent backups will retain this flag until one of the actions is taken.

Note:
The agent does not check for possible errors in a seed backup or the first backup Ransomware threats when threat detection is enabled in a job.

Handling potential threats

When ransomware threat detection is triggered, the following options are available via the "Manage potential threat" action:

1. Using the "Restore" option, you can configure a granular restore and—after the restore is complete—delete the flagged backup from the backup chain.

2. In the event of a false positive, you can select the "Delete potential threat warning" option and confirm the deletion of the warning.

Image-based backup

How it works

In contrast to a file-based backup job, which protects individual files and folders when backing up, an image job backs up all blocks of a selected volume.
It is possible to set up a BMR backup if all system-relevant volumes are backed up.

Changed Block Tracking

The image plug-in installs a changed block tracking driver, which requires a restart after installation. This can be used to determine which blocks have changed in relation to the last backup.

Advantages and Disadvantages Image-based

Advantages:

1. BMR backup possible
2. Faster for lots of small files
3. Recommended for natively protected data volumes of 1TB or more
4. Requires less processing power than file-based backup
5. Convenient Restore (Image is attached)
6. Navigation via Explorer when restoring
7. The OneDrive folder can be included in the backup
   

Disadvantages:

1. Exclusion of individual files and folders is not possible
2. Restore only possible on disks of the same size/larger
3. Restart required after plugin installation
4. No granular troubleshooting possible
5. ReFS is not supported

Best Practice

1. The restart can be done at a later point in time (usually after the end of work). The agent can be configured without restarting.
2. To protect the entire system, including the possibility of a bare metal restore, select the "Entire Server" and "BMR" options.
3. If data (such as local backups / dumps) needs to be excluded, you can move it to a separate volume and explicitly not include this volume in the backup set.

The "Entire Server" option cannot be used in this case.

UNC-Backup Job

Documentation

Complete setup instructions can be found in Chapter 5.4 of the Windows Agent User Guide at Agents Doku/ Release Notes (Documentation -> EN -> Windows Agent -> User Guide )

How it works

The Windows agent connects to the stored network share and saves the selected files. For authentication, a user must be provided with read and write permissions.

Best Practice

1. A UNC backup job should protect a maximum of 500,000 files or 1 TB of native data. If more data needs to be backed up, we recommend distributing it across several UNC backup jobs.
2. Since backing up a network share via a DFS namespace is not supported, we recommend backing up the server share directly without using the namespace.
3. Recommended backup method for files stored on NAS systems (e.g. from Synology, QNAP).

Schedule Recommendations

The schedule determines when a data backup should be started and with which retention type it should be saved.
The following articles go into more detail about various recommended schedule configurations.

Renewed backup attempts

The “Automatic restart for time-controlled backup” function offers the option of restarting an incorrect or failed data backup.
This can be particularly helpful if, for example, in the first backup attempt. B. a Microsoft VSS shadow copy cannot be created.
We recommend waiting a few minutes between backup attempts so that e.g. B. Load peaks can be avoided.

Daily and Monthly Backup

This schedule runs one backup per day, using a Daily or Monthly retention type.
The last calendar day uses the Monthly retention type, and all other days use the Daily retention type.
The time was configured identically due to the priority, so that every day except the last calendar day, line 1 does not apply and line 2 must be checked.
Since the conditions in line 2 are met on any other day, this is executed.
This configuration prevents daily and monthly backups from being created on the last calendar day.

Example configuration:

Four daily backups

This schedule runs four backups per day, with retention type "4xDaily".
The backup times were set at the beginning and end of the working day plus two additional backups within the working day.
In the example configuration below, the backup is performed on the hour at 6 a.m., 9 a.m., 12 p.m. and 3 p.m.
If the system data is changed 24/7, it is recommended to distribute it at equal intervals, e.g. E.g. 0/6/12/18

Example configuration:

Backing up clients using the Windows backup event triggers

Unlike a scheduled server backup, a client system's usage time can vary, making a fixed backup schedule less suitable.
The Windows backup event triggers, which start the data backup dynamically depending on the time of triggering, are suitable for these purposes.
The following Windows events can be selected as triggers:

Event:
1. Shutdown
Before the system is shut down or restarted, the user receives a message asking whether the data backup should be performed before shutdown.

2. Login
A user login starts the data backup.

Waiting time between backups:
The triggering can be limited to once or twice a day, for example. B. If you restart multiple times, you won't be asked for a backup every time you restart.

TERRA CLOUD BACKUP Enterprise: High Frequent Backup - Hourly backups

The High Frequency Backups feature enables hourly backups and thus an RPO of 60 minutes.
Hourly backups must be created with retention types Retention Types "24-Hours" and "48-Hours" using the "Intraday" schedule view.
In the example shown below, all 50 safesets of the inclusive quota are scheduled.
It was assumed that most changes to the data set are made between 9 a.m. and 5 p.m.

This schedule performs a total of eleven backups per day in the following distribution:

• Nine backups are performed hourly between 9 a.m. and 5 p.m. with the retention type "24-Hours"
• One backup at 8 p.m. with the retention type "Daily" or on the last calendar day "Monthly"

Note:
Please note that the hourly backups may only be used in conjunction with a TERRA CLOUD Backup Enterprise Vault.

Example configuration:

1. Please add a new line to your schedule using "Add schedule"
2. Select the "Intraday" schedule view for this line
3. Configure how often the high-frequency backup should back up within a day, e.g. every full hour between 9 a.m. and 5 p.m. (see screenshot)
4. Confirm the configuration with "OK".
5. Finally, you can decide how long the data backups should be kept using the two new retention types available, 24-hours and 48-hours

Full schedule:

TERRA CLOUD BACKUP Enterprise: 10 years retention

The sample schedule shown below includes all 50 safesets of the Included quota.
It is assumed that all documents to be archived will be stored on the system and backed up by December 31st.
This schedule performs one data backup per day at 11:30 PM with the following retention types:

• Daily on all days of the month except the last day
• Monthly on the last day of the month, from January to November
• Yearly on the last day of the year

Note on the Yearly Retention Type
The "Yearly" retention type was added as the default retention type in February 2026.

Sample Schedule:

Run job manually

If you wish, you can also run jobs manually.


Click “Start Backup”.


Completed backup process:


Since the agent is able to compress, in this case only 14.27 GB of data was transferred and stored in the vault for a complete Windows Server 2025 VM. The original size of the system is 33.95 GB.
This is an initial backup, as 33.95 GB is also stored under Changed.
We can also see under the “Jobs” tab that the backup process was completed successfully:


Further details can be viewed by clicking on “Completed” in the middle.

Defering function

The deferral function allows you to split the initial backup into multiple backup stages.
After the specified time window (e.g., 8 hours) has elapsed, an incomplete safeset is created.
The blocks not yet backed up are "deferred" and can be backed up in the next backup stage.
You will receive a warning at the end of the backup that the deferral is still active.
Please select the "Use deferral" option and specify a backup time window of at least 15 minutes to a maximum of 48 hours.
This function can be used for both manual and scheduled execution.

Important:
A backup with the resume function enabled results in an incomplete backup if interrupted.
For file-based backups, data successfully backed up prior to the interruption can be restored.
For image-based backups, however, restoration is only possible if the backup has been fully completed.

Recommendation:
The deferral function can be used exclusively for the initial backup. You can select the deferral during manual execution or specify it in the schedule. We recommend adding a reminder in the agent description that the deferral function is active in the schedule. After the first successful backup without deferral, you can remove the function from the schedule and the reminder from the agent description.

The deferral can be used to split the initial backup or seed backup into multiple backup operations. You will receive a warning in the log file until the backup job has completed completely. For a BMR job, BMR protection is only provided after the first successful completion without deferral.

Example:

Day 1:
The backup job is started with a deferral for the first time and completes the backup after a defined period of 8 hours, and Safeset 1 has been created.

Day 2:
The backup is started again and creates Safeset 2 after 8 hours.

Day 3:
On the third run, the backup job completes before the 8-hour period, Safeset 3 is created, and the seed backup is successfully completed.
The status of the backup job changes from "Deferred with Warnings" to "OK".

Windows Agent

Documentation Windows Agent

You can find extensive documentation and further information in Windows Agent User Guide.

Installation

Installation via Setup

Please download TERRA Backup Agent. To do this, log in to your portal and select the appropriate version under Downloads on the right.


Now start the installation on the server to be backed up. First select the desired language in which you would like to be guided through the installation.


On the "Support Information and Release Notes" page, click Next


Accept the license terms and click Next.


In the next installation step, select “Custom” and click Next.


The local logon credentials can usually be adopted. Click on Continue.


Select the desired installation directory. Then click Next.


In addition to the actual backup agent, other plug-ins can be installed. Depending on the type of server, individual Microsoft SQL database instances or Exchange mailboxes can be backed up.
Select the plug-ins you want and then click Next.


In the dialog box that follows, you can specify how the agent should encrypt the data. You can retain the default settings here.


Enter the email address and password of the registration users or the user created in 5.2.1. Confirm with Next.


In the next step, you can set a default encryption password. This is required if you wish to use automatic agent configuration.


Confirm with Install.


If you are then redirected back to agent registration, the access data you entered is probably incorrect or you are having problems with the
Network connection. First try pinging backup.terracloud.de. If this works, you can use Telnet to check whether port 8086 can be reached.


After 5 minutes at the latest, the server you just registered should appear under “Computer” within your portal.


On the right side under “Site Name” you can read “End Customer1” in our case. This is because we registered the agent with the user backupkunde@endkunde1.de,
which belongs to the “End Customer1” subsite. This way we can now filter for computers that belong to the “End Customer1” subsite. This allows you to quickly list all computers in an organizational unit.

Silent installation under Windows

The agent can also be installed in silent mode. This is helpful if the agent is to be rolled out automatically on multiple systems.

An example of the silent installation including the image plug-in:
Agent-Windows-x64-x-xx-xxxx.exe /s /v" REGISTERWITHWEBCC=True AMPNWADDRESS=backup.terracloud.de AMPUSERNAME=backupkunde@firmaXYZ.de AMPPASSWORD=password FEATUREVOLUMEIMAGE=ON /qn"

Explanation:
Agent-Windows-x64-x-xx-xxxx.exe: The agent (x64) setup is called.
REGISTERWITHWEBCC=True: The agent should be registered on the backup portal.
AMPNWADDRESS=backup.terracloud.de: The address of the backup portal is passed.
AMPUSERNAME=backupkunde@firmaXYZ.de: The user of the customer site is transferred.
AMPPASSWORD=password: The password you assigned for the customer site user.

Parameters for plugins:
Plug-ins can be added after the AMPPASSWORD separated by a space as in the example above. Image Plugin: FEATUREVOLUMEIMAGE=ON
Exchange Plugin (Legacy): FEATUREEXCHANGE=ON
Exchange Plug-in (From 2010): FEATUREEXCHANGE2010=ON
SQL Plugin: FEATURESQL=ON
Cluster plugin: FEATURECLUSTER=ON
Oracle Plugin: FEATUREORACLE=ON

Installation in another directory:
If required, please specify the following parameter directly after /s /v" to install in another directory:
SILENTINSTALDIR=\"Path Example:
SILENTINSTALLDIR=\"C:\Program Files\Example\

Silent Agent Registration

The following PowerShell command is sufficient to re-register the agent with the portal:
& "C:\Program Files\TERRA Cloud Backup\Agent\buagent.exe" -cmdline --reregister --amplogin 'backupkunde@firmaXYZ.de' --amppassword 'USERPW' --ampserver 'backup.terracloud.de' --ampport 8086 Note:
Please replace the placeholder values ​​with your actual TERRA CLOUD Backup portal login credentials.

Afterwards, the TERRA Cloud Backup services must be restarted once.
To do this, launch PowerShell with administrator privileges and enter the following command:
Get-Service -DisplayName "TERRA Cloud Backup*" | Restart-Service

Installation via PowerShell script

To achieve a fully automated installation of the TERRA CLOUD Backup Windows Agent, we developed the following PowerShell script and made it available in the download area of ​​the TERRA CLOUD Backup portal:



Functions:

• Port check TCP 8086/8087
• Check for pending restarts
• Download the current setup
• Install the agent and register it with the portal
• Initiate automatic agent configuration, if configured in the portal
  

Administrator rights in PowerShell are required to run this script. It may also be necessary to unlock the script file after downloading by right-clicking and selecting Properties.

Parameters:
SiteUser: Site username
SiteUserPassword: Site user password
JobEncryptionKey: Encryption password for jobs to be created, provided automatic agent configuration has been configured on the customer site

Plug-in Parameters:
ExchangeLegacy: Exchange Plug-in (Legacy)
Exchange: Exchange Plug-in (2010 and later)
SQL: SQL Plug-in
Cluster: Cluster Plug-in
Oracle: Oracle Plug-in

Execution via PowerShell (without plug-ins):
.\Install-TCBWindowsAgent.ps1 -SiteUser "register@terracloud.de" -SiteUserPassword "Password123!" -JobEncryptionKey "Terra456#"

Execution via PowerShell (with plugins):
.\Install-TCBWindowsAgent.ps1 -SiteUser "register@terracloud.de" -SiteUserPassword "Password123!" -JobEncryptionKey "Terra456#" -SQL
.\Install-TCBWindowsAgent.ps1 -SiteUser "register@terracloud.de" -SiteUserPassword "Password123!" -JobEncryptionKey "Terra456#" -Exchange

Associate Agent with Vault

Every newly registered computer is initially displayed as “Not configured” in the portal. First, at least one vault (data safe) must be assigned to the computer.
Click on the server you want to configure (DC in this example). This will open the settings for this computer. Then click on “Configure manually” on the right.


Now click on “Add Vault” on the right.
Then select the Vault profile created in 4.2.1 under “Vault profile”, in our case this is “Vault_Endkunden1”. All fields should then be automatically filled with the set values.


The agent establishes a test connection to the vault.
If the connection cannot be established, for example because incorrect access data was entered, you will receive an error message.
If everything is OK, the vault will now appear under the “Vault Settings”.

In addition to the portal, the Windows agent can also be started via command line or script.
Agent scripting is recommended, for example, to stop non-VSS-capable databases before backup (MySQL, MariaDB, etc.)

Create job

Create file-based backup job

Click on the “Jobs” tab. Then click “Create new job for local system”.


The “Create new job” window opens.

Please first give the job a name. The name “BMR” (for Bare Metal Restore) is used in the example.
The default encryption algorithm is AES 256 bit, which is considered very secure.

Then enter an encryption password (maximum 31 characters). Resetting an encryption password is not possible!
In the middle area you will find the directory structure that the agent transmits to the portal.
Here you can easily select all the directories and folders you want to back up.
In this example, the BMR and Entire Server options have been configured.
This not only backs up the actual system files, but also the bootloader. This means you can restore an entire server later.
With the “Bare Metal Restore” the entire c:\ system partition is backed up in addition to the data required for booting.
On the right you will then see the backup set.
Objects marked with “+” are saved.
If you would like to exclude individual data from the backup,
select the file and click “Exclude”. Objects marked with “-” are excluded from the backup.
Confirm the setting by clicking on “Create job”.
A window will then automatically open to configure the schedule.

Create image-based backup job

Requirement:
The image plug-in must be installed on the system. If the plug-in is not yet installed, you can run the agent setup again and use the "change" option to install the plug-in later.

Create job:
In the backup portal, please select the image job under "Select job task" as shown in the following screenshot:

Configure job:
In this screenshot you can see an example configuration from an image job. In this, the “Bare Metal Restore” and “Entire Server” options were selected and included in the backup set.
Instead of showing the file system, the agent only shows individual volumes.

Application Aware Backup' option:
In addition to a BMR backup, this option also enables the transaction logs of a Microsoft SQL Server to be truncated and backed up. In order to use this, you must provide the access data required for the SQL instance. We recommend not using this option and using your own SQL job for a comprehensive backup of a SQL instance.

Entire Server' option:
If you add this option to the backup set, all partitions (volumes) of a system will be included in the backup. This excludes removable storage media (e.g. external hard drives or USB sticks). Partitions (volumes) added later are automatically included; there is no need to adjust the configuration.

Note:

For an image-based backup job, BMR protection is automatically provided by the "Entire Server" option, but in order to be able to offer a standard configuration for file- and image-based backup jobs, the option was changed BMR additionally added in the screenshot above. 

Create UNC Backup Job

In the TERRA CLOUD Backup Portal, first navigate to Computers and select the relevant computer.
Then, switch to the Jobs tab and select Select job task → Create UNC file job.

In the window that follows, enter the required access credentials to establish a connection to the UNC share.
The Domain field is optional and is only required if a domain is needed for authentication.

Once the connection is successfully established, you will proceed to the actual job configuration.
Assign a Name for the backup job and enter the desired Encryption password.
You can optionally provide a Password hint.
Next, you can define the desired Backup set.
To do this, expand the previously entered UNC share in the central area and select the folders or files to be backed up.
Then click Include to add the selected data to the backup set.
If necessary, you can also define Exclusions to omit specific files or folders from the backup.

You can use the UNC credentials button to modify the previously entered access credentials for the UNC share if needed.
Additional UNC shares can be added to the backup job using the Add UNC share button.

Advanced Agent Configuration

Individual settings can be configured for each computer. These include, for example: B. Mail notification and bandwidth limitation.
Go to “Computer” in the portal. Select a server and then click on “Advanced” to make specific settings.


Options:
Under this point you can add a description to the system, for example: B. to store the ticket number in the description in a support case.
We recommend the option “Log errors and stop backup” for current Windows agents; this is the default setting after installation or update.
The option "Log errors and continue backup" offers the advantage that backups can also be carried out if, for example, B. VSS problems can sometimes go through.
The files not backed up in this job will result in an increased delta afterwards.

Retention Types:
The currently stored retention types are displayed here; after installation, "4xDaily", "Daily", "Monthly" and "Yearly" are stored by default.
You can use this tab to create your own storage types, which you can then choose from in the schedule.
When configuring, please note that 50 safe sets per job are included free of charge.

Notifications (agent side):
As of August 2021, the “Notifications” tab is only available if an agent-side mail notification is already configured.
This agent function has been replaced by the Notification via the TERRA CLOUD Backup Portal.

Enable agent-side notification manually:
If you want to continue using agent-side notification, you can configure it using the following steps.
1. Stop the "TERRA Cloud Backup Agent" and "TERRA Cloud Backup BUAgent"
services on the desired system. 2. Open the "global.vvc" file in the TERRA CLOUD Backup Agent
installation directory. 3. Please add the following lines, if they are not present, after the curly braces of the "OpenFile" block:

  notification {
  MailOnError = True
  MailOnFailure = True
  MailOnSuccess = True
  }

4. Start the services "TERRA Cloud Backup Agent" and "TERRA Cloud Backup BUAgent"
on the desired system. 5. Open the TERRA CLOUD Backup Portal and update your browser if necessary. 6. Complete the configuration using the “Notification” tab, which is now visible again.
Performance:
Bandwidth limitation and execution priority can be configured under this point.
According to current knowledge, changing the execution priority has no noticeable effect, so we recommend keeping the default value.
Bandwidth limitation is particularly recommended for weak connections during your customer's working hours.
At least 1.5 Mbps should be allocated for a backup.

Agent log files:
Under this tab you can view all global (cross-job) log files of the agent, which can be helpful for troubleshooting.
For example, log files of the BUAgent can be viewed; this service (TERRA Cloud Backup BUAgent) is responsible for the agent's communication with the backup portal.

Agent Update

The TERRA CLOUD Backup Agent can be updated as follows:
Windows (manually):

• Starting with agent version 8, the agent can be updated directly via the setup of the newer agent version.
• When you start a setup of a newer agent, you will be asked if you want to perform an update.

Windows (Agent Upgrade Center):
You can update multiple agents centrally via the TERRA CLOUD Backup Portal. Instructions can be found at:
Agent Upgrade Center

Restoring a Backup Job

Restore from a file-based backup

You can use the calendar button to select the safe set from which you wish to restore data.
Then, enter the job's encryption password.
Clicking the "Hint" button displays your password hint.

You can select the folders and files to be restored using the checkboxes—choosing either entire folders or individual files.
Clicking "Include" then adds them to the restoration process.

The search function allows you to look for specific files without having to manually locate the full file path.
This supports the wildcard characters * (representing any number of characters) and ? (for a single character).
However, the question mark cannot be used for umlauts (ö, ä, ü).

Select the desired files and add them to the recovery operation by clicking "Include selected".
To search for files in a specific folder within the backup, enter the desired path into the "Search path" field.

When you include a folder in a recovery operation, its subdirectories and files are included by default as well.
If you wish to recover only a portion of the subdirectories or files, you can add filters to the inclusion set.
For example, it is possible to recover only files with the .doc or .docx extension from a folder.

When you exclude a folder from a recovery operation, its subdirectories and files are excluded by default as well.
If you wish to exclude only a portion of the subdirectories or files, you can add filters to the exclusion set.
For instance, you can set a filter to exclude only files with the .exe extension within a folder from the recovery.



You have the options to restore the files to the original location or to an alternative location.
If you decide to use an alternative storage location, you can use the folder button to select the desired storage location.
You also have the options to overwrite existing files, not overwrite (this adds a numeric extension, e.g. .0001), rename incoming files and rename existing files.

Overwrite existing data

If you try to restore multiple files with the same name to an alternate location and select Overwrite Existing Files, only the last file restored will be retained.
Other files with the same name will be overwritten. To add a numeric extension (e.g. .0001) to a recovered filename, select Do not overwrite existing files.
For example, if you restore a file named "filename.txt" to a location where there is a file with the same name, an extension is added to the restored file name (for example, "filename.txt.0001").

Under no circumstances should you select the entire C: volume and let it overwrite the existing volume. This will result in serious damage to the system!

Rename existing files

To add a numeric extension (e.g. .0001) to an existing filename, select Rename Existing Files.
For example, if you restore a file named "filename.txt" to a location where there is a file with the same name, an extension is added to the existing file name (for example, "filename.txt.0001").
The name of the restored file is still “filename.txt”.

Advanced Recovery Options

Locked File Options

When restoring data from a local job, you can specify whether locked files should be overwritten by restored files with the same name.
To do this, select one of the following options:

• "Yes, overwrite locked files"
  

Files in the system that are locked during recovery will be overwritten with the recovered files upon reboot. This option must be enabled for system state or system volume restores.

• "No, do not overwrite locked files"
  

Files in the system that are locked during recovery will not be overwritten with the recovered files with the same name upon reboot.

Streams

When you run backups, information from your files is captured in different streams.
The original data created by a user is called a data stream.
Other information such as security settings, data for other operating systems, file references and attributes are stored in separate streams.
When restoring data from a local job, you have the following options to choose from:

• "Restore all streams"
  

Restores all information streams. Use this option when restoring files to a system with an identical platform.

• "Restore data streams only"
  

Select this option for cross-platform restores. With this option, conflicts do not arise due to system-specific data streams.

Protocol options

From the list, select one of the following logging levels:

• Files: Provides more detailed information and is typically used for troubleshooting. Provides information about files that are being restored.
  
• Directory: Provides less detailed information than the Files logging level. Provides information about folders that will be restored.
  
• Summary: Provides top-level information including Vault/Agent version and backup size.
  
• Minimal: Provides top-level information including Vault/Agent version.
  

Changing the logging level only affects log files that are created afterwards. Log files that have already been created are not affected by this change.

Performance options

To use all available bandwidth for recovery, select "Use all available bandwidth."
Bandwidth throttling determines how much bandwidth an agent can consume for backups and restores.
For example, you can limit traffic so that online users are not impacted and allow unrestricted usage at night so that scheduled backups or restores can occur as quickly as possible.
Bandwidth throttling values are set at the machine (or agent) level and apply to backups and restores.
When three jobs are running simultaneously on a computer, each job receives 1/3 of the specified maximum bandwidth.
Possible bandwidth settings: Maximum bandwidth (upper limit) in MB per second that the agent is allowed to consume for all backups and restores.
Period of time during the day when throttling is activated. Only one time window can be specified.
There is no throttling outside the time window. The days of the week that throttling is enabled.
Once the bandwidth throttling window begins during an ongoing backup or restore, the maximum bandwidth is dynamically applied to the running process.
If the throttling window ends while a backup or restore is in progress, bandwidth throttling is removed.
If you change an agent's bandwidth settings while a backup or restore is in progress, the new settings do not affect the ongoing process.
The bandwidth settings are applied when the backup or restore starts and are not changed afterwards.

Restore from another computer (file based)

It is possible to restore some or all of the data backed up on one computer to another computer with the same characteristics.
To restore the data from another computer, you can redirect the data from a backup job in the Vault to another computer.
If the data was backed up with a plug-in, the same plug-in and the corresponding installation (e.g. Microsoft SQL) must also be present on the target computer.
The new computer then downloads information from the vault to restore the data to the new computer.
Example: Computer A backs up its data with Job A, Computer B restores Job A's data (Computer A's data) to Computer B.

Restore from an image-based backup

You can choose whether you want to restore a complete partition or individual files or folders.
Select the manufacturing you want and click “Configure Source Next”.

Volume Recovery

Select the desired volume to be restored.



Next, select an existing volume to restore to.
Click “OK” and then click “Run Restore” to start the restore process.

File or folder recovery

Select the volume from which individual files or folders should be restored and assign a valid drive letter. (Please do not use A & B)
Now click on “Mount Volumes”. The backed up volume is mounted on the affected agent and you can restore the required files or folders to a local volume by dragging and dropping them.
Under “Duration of inactivity”, set a generous time limit for how long the drive should be mounted. By default we recommend the value 60 minutes.

Restore from another computer (image based)

You can restore successfully backed up data to another computer with the same agent configuration.
To do this, you can transfer/copy existing backup jobs in the Vault to another computer.
Since an image job is a plugin job, the image plugin must exist on the target agent.

Example: Computer A is down/no longer in use, but now you need to restore data from Computer A. To do this, copy the job from computer A to computer B to perform a restore.

Select Computer B in the backup portal.
From the Select Job Task menu, click Restore from Another Computer.
The Restore from Another Computer dialog box opens.


In the "Vaults" list, select the vault in which the backup of Computer A was stored. If the restore is to be carried out across vaults, the agent must first be registered with the source vault.
Once the correct vault is selected, you will find Computer A in the Computers tab.
After computer A is selected, you will find its job in the Jobs tab.
Confirm with OK once a selection has been made.
The portal attempts to download required job information to Computer B. Once these are downloaded, the job will appear in Computer B's Jobs tab.
A recovery process will start automatically. Once you have selected the desired restore here and entered the encryption password to decrypt required information, you can proceed with a normal image-based restore.




If an error occurs while downloading the job information, the restore cannot continue.
This can happen if the job information is not available or a required plugin is not installed on the target computer.
Make sure the required plugin is installed on the target computer before repeating the process. (Change installation via Agent Setup or via the "Select job task" action)

Bare Metal Restore

A "bare metal restore" is a complete restoration of a backed up system, including all components required for the boot process (e.g. the bootloader).

Disaster recovery options

The following flow chart shows you possible workflows and recommendations for action for various Disaster Recovery scenarios.

Export drivers of a secured system

You can export all drivers of a system using the following instructions:

1. Create a directory in which the drivers should be stored, e.g. (C:\Drivers)
2. Run this command with administrative permission in CMD:

dism /online /export-driver /destination:"C:\Driver"

You can add the exported drivers when creating a new restore iso. If complications arise during a BMR test restore, we recommend exporting the drivers of the protected system as described above and adding them to the restore ISO. Please keep this ISO or drivers separately.

Create Restore ISO

To perform a bare-metal restore, you need a restore ISO (.iso file). The restore ISO is based on Windows PE and includes the recovery software for the TERRA CLOUD backup solution; this software launches automatically once the system boots from the ISO. You can create this ISO yourself and use it for the bare-metal restore of all your systems.

Download:
Please download the Bootable Media Creator from the backup portal.

Installation:
Install the Bootable Media Creator; this also requires the Windows Assessment and Deployment Kit (ADK).
The Bootable Media Creator setup guides you through the installation of the ADK components by default.












































The image can be created very easily after installation.
First, launch the Bootable Media Creator and simply select a destination directory at the bottom.


In this step, you can add drivers exported via Exporting drivers by selecting the driver directory using the "add" button.
Now click "Continue" to create the image.








The image can now, for example, be burned to a CD or attached to a virtual machine.

Perform restore

The following instructions demonstrate a typical BMR restore within a virtual machine.
The BMR restore ISO must be mounted to the virtual machine beforehand.
Legacy network adapters must be used for both VMware and Hyper-V.
After restarting the machine, you must connect to it via the console.
The following screen will then appear:


First, configure the time zone and desired language, then click "Next".


In the next window, accept the license terms and click "Next".


By default, the "System Restore" process obtains an IP address from a DHCP server.
If no DHCP server is available, or if you wish to assign the IP address manually, click "Settings" in the main menu.
Select the network interface and then click "Properties". Assign an IP address and confirm by clicking "Apply".






We recommend subsequently pinging the vault via the command prompt to ensure it is reachable.
The command prompt can then be minimized so that it remains available for further adjustments (e.g., diskpart) during the rest of the restore process if needed.

To perform a restore operation, click "Restore My System" in the main menu. Click "Next" in the wizard.


On the following page, enter your vault (data storage) details and confirm by clicking "Next". The system restore process will now attempt to establish a connection to the vault.


On the following page, you will see all computers associated with your account. Select the computer you wish to restore. Then click "Next".


On the following page, you will see all backup jobs associated with this computer. Select the job you wish to restore. Then click "Next".


In the next step, you can select which safeset to restore. Select the desired safeset and then click "Next".
Next, enter the encryption password and click OK to confirm.




In the next step, you can select the volumes to be restored.
You can drag the individual partitions down into the "Destination" field or use the AutoMap button.
Then click "Next".

Note:
You can only drag down the light blue partitions; the gray partitions are created automatically.




In the final step, you can review the settings. Then, check the box next to "Click here to confirm the restore plan" and click "Next".


The restore process begins.






Once the restore process has successfully completed, click "Next" to close the window and launch the Repair Wizard.


Here, you can check whether any software components requiring an additional driver have been detected.
If the status is "OK" and a green checkmark is visible for each item, you can close the wizard by clicking **Close**.

Linux Agent

Documentation Linux Agent

You can find extensive documentation and further information in Linux Agent User Guide.

Preparing the installation for a bare metal backup

The bare metal backup of the TERRA CLOUD Backup Linux agent requires the software Relax and Recover, in a supported version, on the system to be backed up.
We recommend installing the software via the package manager of the respective distribution and, if necessary, updating it to the supported version.
The currently supported version of Relax and Recover can be found in the release notes of the TERRA CLOUD Backup Linux agent.

Please note that TERRA CLOUD cannot provide support for the installation or commissioning of the Relax and Recover software.

Installation

Step 1: Please download the TERRA Backup Agent.
To do so, log in to the TERRA CLOUD Backup Portal and copy the link address of the required agent (32 or 64 bit) from the download area.
Please download the agent setup, e.g., using the wget command and the copied link address.

Step 2: Unpack the archive with tar -xzvf PACKAGE-NAME.tar.gz.

Step 3: Then change to the unzipped agent directory and start the installer shell script using ./install.sh

Step 4: Please first read and confirm the license agreement and follow the instructions of the installation wizard to configure the installation.
In the screenshot of the example installation, the default settings for the following queries have been selected:

1. Installation directory /opt/BUAgent
2. Language Email notification (deprecated agent email notification)
3. Encryption method

You can accept the default values ​​by confirming the queries with ENTER.

Step 5: Indicate whether a Bare Metal Restore backup is desired.
If you answer YES, please note that a supported version of Relax and Recover must already be installed on the system.
The default value for the Relax and Recover directory is /usr/sbin/rear.

Step 6: Register the Linux Agent on the TERRA CLOUD Backup Portal:

1. Portal address = backup.terracloud.de
2. Portal connection port = 8086 (default value)
3. Portal username = User of the end customer's site
4. Portal password = Password of the user on the end customer's site

Step 7: Please check the TERRA CLOUD Backup Portal to see if the Agent has been successfully registered on your end customer's site.

Restore a backup job

After backing up data from a system, you can select “Restore” under “Actions” in the backup jobs.

Recovery from a file-level job

Use the calendar button to select the safeset from which you wish to restore data.
Enter the job's encryption password. Clicking the "Hint" button displays your password hint.
You can select the folders and files to be restored using checkboxes and then include them in the recovery process by clicking "Include".
The search function allows you to search for specific files without having to look up the file path.
Wildcard characters are supported: * (for any number of characters) and ? (for a single character).
However, the question mark cannot be used for a German umlaut (ö, ä, ü).
Select the relevant files and add them to the recovery selection by clicking "Include selected".
To search for files within a specific folder in the backup, enter the desired path in the "Search path" field.
When you include a folder in a recovery, its subdirectories and files are also included by default.
If you wish to restore only a portion of the subdirectories or files within a folder, you can add filters to the inclusion set.
For example, you can add a filter to restore only files with a .txt or .log extension from a folder.
When you exclude a folder from a recovery, its subdirectories and files are also excluded by default.
If you wish to exclude only specific subdirectories or files within a folder, you can add filters to the exclusion set.
For example, you can add a filter to exclude only files with the .sh extension within a folder from the restore process.



You have the option to restore the files to their original location or to an alternative location.
If you choose an alternative location, you can select the desired destination using the folder button.
You also have options to overwrite existing files, not overwrite them (in which case a numeric extension, e.g., .0001, is added), rename incoming files, or rename existing files.

Overwrite existing data

If you attempt to restore multiple files with the same name to an alternate location and select the option to overwrite existing files, only the last file restored will be retained.
Other files with the same name will be overwritten. To add a numeric extension (e.g., .0001) to a restored filename, select the option not to overwrite existing files.
For example, if you restore a file named "filename.txt" to a location where a file with the same name already exists, an extension (such as "filename.txt.0001") will be added to the restored filename.

Do not, under any circumstances, select the entire root volume and allow it to overwrite the existing volume. Doing so will cause severe system corruption!

Rename existing files

To add a numeric extension (e.g., .0001) to an existing filename, select "Rename existing files."
For example, if you restore a file named "filename.txt" to a location where a file with the same name already exists, an extension is added to the existing filename (e.g., "filename.txt.0001").
The name of the restored file remains "filename.txt".

Advanced recovery options

Options for locked files

When restoring data from a local job, you can specify whether locked files should be overwritten by restored files with the same name.
To do this, select one of the following options:

• "Yes, overwrite locked files"
  

System files that are locked during the restore process will be overwritten by the restored files upon restart. This option must be enabled for System State or system volume restores.

• "No, do not overwrite locked files"
  

System files that are locked during the restore process will not be overwritten by the restored files with the same name upon restart.

Streams

When performing backups, information from your files is captured in various streams.
The original data created by a user is referred to as the data stream.
Other information—such as security settings, data for other operating systems, file references, and attributes—is stored in separate streams.
When restoring data from a local job, you have the following options:

• "Restore all streams"
  

Restores all information streams. Use this option when restoring files to a system with an identical platform.

• "Restore data streams only"
  

Select this option for cross-platform restores. This option avoids conflicts caused by system-specific data streams.

Protocol Options

Select one of the following logging levels from the list:

• Files: Provides more detailed information and is typically used for troubleshooting. Provides information about files being restored.
  
• Directory: Provides less detailed information than the "Files" logging level. Provides information about folders being restored.
  
• Summary: Provides high-level information, including the vault/agent version and backup size.
  
• Minimal: Provides high-level information, including the vault/agent version.
  

Changing the logging level affects only log files created after the change. Existing log files are not affected by this change.

Performance Options

To use the entire available bandwidth for recovery, select "Use all available bandwidth."
Bandwidth throttling determines the amount of bandwidth an agent is permitted to use for backups and recoveries.
For example, you can limit data traffic to avoid impacting online users, while allowing unrestricted usage at night so that scheduled backups or recoveries can complete as quickly as possible.
Bandwidth throttling values ​​are configured at the computer (or agent) level and apply to both backups and recoveries.
If three jobs run simultaneously on a computer, each job receives one-third of the specified maximum bandwidth.
Available bandwidth settings: Maximum bandwidth (upper limit) in MB per second that the agent may use for all backups and recoveries.
Daytime period during which throttling is active. Only one time window can be specified.
No throttling occurs outside this time window. The days of the week on which throttling is active.
If the bandwidth throttling time window begins while a backup or recovery is in progress, the maximum bandwidth limit is dynamically applied to the running process.
If the throttling time window ends while a backup or recovery is in progress, bandwidth throttling is lifted.
If you modify an agent's bandwidth settings while a backup or recovery is running, the new settings do not affect the active process.
Bandwidth settings are applied when the backup or recovery starts and are not modified subsequently.

Bare Metal Restore

Preparation

To perform a bare-metal restore, the `Bare_Metal_Restore_Image_xxxxx.iso` file—created during the BMR backup—is required.
You can find this file in the system's root directory (/).
If the ISO is not visible, the of the Relax and Recover tool or the BMR backup was unsuccessful.

Implementation

• Boot the target system from the mentioned ISO and select Recover Systemname .

• Log in as the root user; no password is required.

• Next, start the BMR restore agent by running ./bmragent.

• Enter your vault (data storage) details. The system restore process will now attempt to establish a connection to the vault.

• Select the computer you wish to restore.

• Select the job you wish to restore.

• In the next step, you can choose which safeset to restore. Select the desired safeset.

• Then, enter the encryption password and set the prompt to yes using the left arrow key.

• Next, confirm the disk mapping. Option 1 is selected by default.

• Finally, confirm the disk layout. Option 1 is selected by default.

• Next, you must confirm the Disk Recreation Script. Option 1 is selected by default.

• In the next step, you must confirm that the storage on the target system will be wiped. Option 1 is selected by default.

• Finally, you will receive a summary of the changes to the target system's storage, which you must confirm. Option 1 is selected by default.

• The BMR recovery process now begins. Depending on the amount of data, bandwidth, and vault load, this may take some time.

• Once the recovery is complete, you must confirm the recovery of the initrd and the reinstallation of the bootloader. Option 1 is selected by default.

• This completes the BMR restore.

Assign alternative static IP for a BMR restore

By default, a BMR restore restores the original network configuration.
If you would like to assign an alternative configuration, for example to carry out a test restore, we recommend starting the system without network access first.
With a Hyper-V, for example, you could initially boot into the recovery ISO without a connected external vSwitch. After adjusting the network configuration, you can connect the VM to the vSwitch. This ensures that the system never goes online with the old IP address. Please follow these steps to adjust the network configuration before restoring:

1. Boot into the Restore ISO and initiate the restore until the step where you are asked to run ./bmragent.
2. Find the name and configuration of the network interface using ip address show
3. Take the interface offline by e.g. ip link set name of network interface down
4. Delete the old IP address that you determined in the first step, e.g. ip address del 172.29.4.24/22 dev name of the network interface
5. Configure a new IP address using, for example, the following command ip address add 172.29.4.29/22 dev name of the network interface
6. Take the network interface back online after customization
7. Finally, configure the default gateway using, for example, ip route del default and then ip route add default via 172.29.4.1 dev name of the network interface

In this screenshot you can see an example of step 1 from the instructions:

vSphere Recovery Agent

vSphere Recovery Agent Documentation

You can find extensive documentation and further information in vSphere Recovery Agent User Guide.

Installation

Please run the vSphere Recovery Agent setup on a Windows Server system with access to the VMware environment (vCenter or standalone ESXi host). Please note the recommendations from the section Best Practice. Please follow the instructions in the vSphere Recovery Agent InstallShield. In the last step of the installation, you register the system using the user and password entered in your end customer's created site. You can find a detailed description of the installation process in the User Guide linked above.

Agent configuration

After successful installation and registration on the TERRA CLOUD Backup Portal, you can now add the system to the vault as described in Add system to the vault.

Connection to the vSphere environment

Please enter and save the access data for the vSphere environment (vCenter or standalone ESXi host) in the “credentials” fields. You will receive immediate feedback as to whether the access data provided is correct or whether the area can be reached.

Changed Block Tracking

This agent function is already activated after installation and allows quick and efficient delta backup of the virtual machines.
For more information about this technology, see VMware's Knowledge Base.

Automated recovery tests

Enabling the Verify backup on completion option will perform a recovery test via quick VM restore after each backup completes. After the virtual machine boots, a screenshot of the login mask is created and saved in the TERRA CLOUD Backup Portal. To use this feature, the rapid VM recovery requirements must be met. Please store the temporary data store on which the VM can be started for the test recovery and the desired ESXi host.

Example configuration:

Create vSphere Backup Job

Once you have finished installing and configuring the agent, you can create a new "Job for VMware vSphere".
The following screenshot shows an example of a new job for a vSphere environment. Please enter a job name and optionally a description and the encryption password.
You can either include all virtual machines in the backup by selecting the "Virtual Machines" level, so all virtual machines are included recursively. This option offers the advantage that new virtual machines are automatically added to the backup job.
Alternatively, you can select individual VMs and add them to the backup set.

Optional:Advanced Settings:

Enable application consistent backup

As soon as you "enable application consistent backup" an application consistent snapshot can be created based on a Microsoft VSS snapshot.
We recommend enabling this option for all virtual machines with a Windows guest operating system.

Truncate database transaction logs

In addition to application-consistent backup, transaction logs from Microsoft Exchange or SQL Server instances can be truncated.

Enable Threat Detection

When backing up active virtual machines with Windows guest operating systems, the vSphere Recovery Agent can scan the system for active ransomeware.
We recommend enabling this option for all virtual machines with a Windows guest operating system.
The Enable Threat Detection option requires guest operating system credentials.

Verify this backup job upon completion

Following the backup, a recovery test of the virtual machines is performed via fast VM recovery.
Please note that this function must be set up in the Agent Configuration.
Furthermore, this option is only visible if the prerequisites for Rapid VM Recovery are met.

Global VM Credentials

The entered access data will be used for all virtual machines in the backup set.

Guest OS Credentials

If you would like to assign access data individually for each virtual machine, you can enter these in the backup set below the virtual machine by displaying the input field using the blue arrow.

Rapid VM Recovery

The Rapid VM Recovery option allows you to start a VM directly from the backup.
Downtime can be drastically reduced thanks to this rapid access; additionally, the feature is suitable for performing a recovery test in just a few minutes.

Prerequisites:

• Available only in conjunction with a TERRA CLOUD Backup Satellite or TERRA CLOUD Backup Enterprise Vault.
• Each ESXi host must have a software iSCSI adapter.
• The datastore where the VM is started can be located on local, iSCSI, or vSAN storage.
• A datastore intended as the migration target for a VM can be located on an NFS share, in addition to the storage types mentioned above.
• A minimum of two datastores must be available in total.
• vSphere Recovery Agent 8.82 or higher.
• The Windows Server hosting the VRA must have the "iSCSI Target Server" Windows feature installed.
  

Example configuration of an ESXi host for Rapid VM Recovery:

In the screenshot below, an iSCSI software adapter has been added via vCenter using the "Add Software Adapter" option.

Additionally, a VMkernel adapter without the service role enabled was added, as shown in the following screenshot:

Procedure: Once all prerequisites are met, an additional option—"Virtual Machine option using Rapid VM Recovery"—becomes available under "Restore":

You then proceed to the recovery configuration.
Here, in addition to selecting which VM to restore, you can also define which datastore should be used.
The following screenshot shows the "Rapid VM Recovery Datastore," which was configured specifically for tasks such as recovery and functional testing.
During the recovery process, you can migrate the VM to a different datastore—for example, the one hosting your production systems.

Best Practice

• Install the vSphere Recovery Agent in its own Windows Server VM; if possible, this will only be used for management or backup
• Keep the vSphere Recovery Agent VM highly available via vSphere HA
• Use a satellite for TERRA CLOUD backup to be able to use Rapid VM Recovery
• Place the vSphere Recovery Agent VM on the same subnet as the vCenter Server Appliance
• Enable the "Application Aware Backup" option in the backup job
• Use Change Block Tracking to back up virtual machines; this setting can be found under the "vCenter Settings" tab.

Hyper-V Agent

Documentation Hyper-V Agent

The following sections contain, among other things, information about setting up and configuring the TERRA CLOUD Backup Hyper-V agent.
You can find extensive documentation and further information in the Hyper-V Agent User Guide

Installation

The following concise guide outlines the essential steps for setting up the TERRA CLOUD Backup Hyper-V Agent.

Setup sequence:
1. Install TERRA CLOUD Backup Hyper-V Agent Management
2. Configure the Management Agent in the Backup Portal (establish connection to the Hyper-V environment, add the computer to the vault)
3. Install TERRA CLOUD Backup Hyper-V Agent Host

Single-host Hyper-V systems:
In this scenario, you can install both the TERRA CLOUD Backup Hyper-V Management Agent and the Host Agent directly on the Hyper-V host ("root"/"parent" partition).
However, please still observe the setup sequence listed above.

Hyper-V clusters:
Because the TERRA CLOUD Backup Hyper-V Agent is split into two software components (Management and Host), it is ideally suited for use in a cluster environment.
We recommend installing the Management Agent in an administrative VM within the Hyper-V cluster; this allows it to run on different hosts and ensures high availability via the failover cluster.
After completing setup steps 1 and 2, you can proceed to step 3 and install the TERRA CLOUD Backup Hyper-V Agent Host on all nodes of the Hyper-V cluster.

TERRA CLOUD Backup Hyper-V Agent Management:

Setup step 1
Please run the installer on the desired system and follow the on-screen instructions.
In the final step—as with all other TERRA CLOUD Backup agents—you configure the registration with the TERRA CLOUD Backup Portal.
You can either select a user within the site who has sufficient permissions, or register the system to your parent site and move it later.

Setup Step 2
Once installation is successfully completed, the system should appear under the selected site in the backup portal.
Please follow the instructions in the backup portal to establish a connection to the Hyper-V environment and subsequently add the computer to the vault.

Installing the TERRA CLOUD Backup Hyper-V Agent Host:

Setup Step 3
After successfully configuring the Hyper-V agent in Step 2, you can install the host agent on all nodes of the Hyper-V cluster or on the standalone host.
For a cluster installation, specify the FQDN of the system where the management agent is active in order to establish a connection to it.
Once installation is successful, the respective node should appear as "online" under the "Hosts" tab in the backup portal.

Restoring a Backup Job

The Hyper-V Agent allows you to restore either individual files and folders from a virtual machine or the entire virtual machine.
When restoring files, the virtual machine is mounted as a read-only file share.
This enables you to copy the desired files and folders directly from the backup without having to restore the entire virtual machine.

Note:
Restoring individual files and folders is supported exclusively for Windows VMs.
This feature is not available for Linux VMs.
For Linux VMs, only the complete virtual machine can be restored.

First, navigate to Computers in the Backup Portal and select your Hyper-V server.

Next, switch to the Virtual Machines tab and click Select action → Restore for the desired VM.

Various restore options are available in the subsequent dialog.

VM Recovery

To restore a complete virtual machine, please select Virtual Machines.

The following information is required for the subsequent steps:

• New VM Name
  • Specify the name for the virtual machine to be restored.
    If the original VM still exists on the host, please provide a new name that differs from the existing VM's name.
    If it no longer exists, please leave the field blank; in this case, the virtual machine's original name will be used automatically.
• Backup Set
  • Select the desired backup set and then enter the encryption password you assigned.
• Destination
  • Select the destination drive where the virtual machine is to be restored.
    We recommend using the root directory of a disk (without a subpath) initially and moving the VM to the desired directory via Hyper-V Manager after the restore is complete.
• VM Identity
  • Specify how the VM ID of the virtual machine to be restored should be handled.
    You can retain the original VM ID, generate a new VM ID, or have a new VM ID generated automatically if the original VM ID already exists on the target system.
    We recommend retaining the original VM ID. This allows the existing backup chain to continue seamlessly after the restore.
• Host
  • Select the Hyper-V host or cluster node where the virtual machine is to be restored.
    If no Hyper-V cluster is used, only the local host is available for selection. Additionally, you can specify whether the restored virtual machine should start automatically after the restore is complete and whether the VM should be connected directly to the network.
    

The restore process then begins.

Upon successful completion, you will find the restored VM both on the selected target drive and in the Hyper-V Manager of the target Hyper-V server.

Recovery of files and folders

To restore files and folders, please select Files and folders.

You will then need to provide the following information:

• Backup set
  • Select the desired backup set and then enter the encryption password you assigned.
• Inactivity duration
  • Use this value (in minutes) to specify how long the file share should remain active during periods of inactivity.
    We recommend setting this value to 90 minutes.

The next window displays the status of the file share.
As soon as the status changes to **Processing...**, the release becomes available.

By default, the file share is mounted at C:\RestoreMount.

If you wish to change this default path, you can find further information in the following wiki article:
Link

Rapid VM Recovery

The Instant VM Recovery option allows you to start a VM directly from the backup.
Downtime can be drastically reduced thanks to this rapid access; additionally, the feature is suitable for performing a recovery test in just a few minutes.

Requirements

1. Hybrid TERRA CLOUD backup with a TERRA CLOUD Backup satellite or TERRA CLOUD Backup Enterprise
2. Hyper-V Checkpoints must be enabled for the secured VMs (for more information, see: Hyper-V Checkpoints)

Implementation

First, navigate to Computers in the Backup Portal and select your Hyper-V server.

Next, switch to the Virtual Machines tab and click Select Action → Restore for the desired VM.

Various restore options are available in the subsequent dialog.
For a quick restore of the virtual machine, please select Virtual machine using rapid VM restore.

The following information is required for the subsequent steps:

• Backup set and encryption password
  • Select the desired backup set and then enter the encryption password you assigned.
    
• Restore VM name
  • Specify the name for the virtual machine to be restored here.
    If the original VM is still on the host, please provide a new name that differs from the existing VM's name.
    If it is no longer present, please leave the field blank. In this case, the virtual machine's original name will be used automatically.
    
• Volume
  • Here you can select the target drive where the virtual machine is to be temporarily mounted.
    
• Target host
  • Select the Hyper-V host or cluster node where the virtual machine is to be restored.
    If no Hyper-V cluster is used, only the local host is available for selection.
    
    

Additionally, you can specify whether the restored virtual machine should automatically start and connect directly to the network once the restoration is complete.

The virtual machine restoration process then begins.

Once the restoration status changes to Rapid VM recovery in progress, the new virtual machine becomes visible on the target host in Hyper-V Manager and is ready for immediate use.

In our example, the new VM appears as VM01-rvmr-2026-Aug-05-09-35-34.

If you no longer need the provisioned VM, you can cancel the rapid VM recovery by clicking Cancel rapid VM recovery in the process details window within the Backup Portal.

VM Migration

Optionally, you can migrate the virtual machine to the target storage—and thus permanently to the target host—during the recovery process.
To do this, select the Migrate VM option within the process details in the Backup Portal.
The migration settings will then open; select the Permanent Volume there.
We recommend initially using the root directory of a storage drive (without a sub-path) and moving the VM to the desired directory via Hyper-V Manager after the migration is complete.
Then, start the migration by clicking Start migration.

During the migration, the status of the virtual machine in Hyper-V Manager indicates that it is being moved to local storage.

Once the status Restored VM has been migrated appears in the Backup Portal process details, the migration is complete.

This is also visible in Hyper-V Manager, as the virtual machine's migration status is no longer displayed.

Reduce number of VMs per backup run

The TERRA CLOUD Backup Hyper-V Agent backs up up to 16 virtual machines per Hyper-V host simultaneously within a single job.

Preparation:

1. Stop the "TERRA CLOUD Backup Hyper-V Agent Management Service"
2. Stop the "TERRA CLOUD Backup Hyper-V Agent Host Service" on all hosts managed by the management component
3. Navigate to the following directory of the management component (default path: C:\Program Files\TERRA CLOUD Backup\Hyper-V Agent Management\Data\Configuration)
4. Create a backup copy of the file "AgentCoordinator.cfg" and save it outside the agent directory
5. Navigate to the following directory of the host component (default path: C:\Program Files\TERRA CLOUD Backup\Hyper-V Agent Host\Data\Configuration)
6. Create a backup copy of the file "AgentWorker.cfg" and save it outside the agent directory
7. Repeat step 6 for all host agents connected to the management agent

Editing the configuration:

1. Open the management agent's configuration file "AgentCoordinator.cfg" (default path: C:\Program Files\TERRA CLOUD Backup\Hyper-V Agent Management)
2. Add the [Advanced] section with the parameter MaximumConcurrency and the desired value, e.g. ...5 in JSON format (see screenshot below) and save the file.
3. Open the host agent configuration file "AgentWorker.cfg" (default path: "C:\Program Files\TERRA CLOUD Backup\Hyper-V Agent Host\Data\Configuration").
4. Change the value of the setting "MaximumConcurrency": 16, to the value specified in step 1 within AgentCoordinator.cfg.
5. Repeat steps 3–4 for all host agents connected to the management agent.
6. Start the "TERRA CLOUD Backup Hyper-V Agent Management Service".
7. Start the "TERRA CLOUD Backup Hyper-V Agent Host Service" on all connected hosts.

Screenshot for editing step 2:

Note:
Please note that the value must not be configured higher than the default value of 16.
If the services fail to start after these adjustments, please perform a rollback using the backups you created.

Changing the mount point for data recovery

The Hyper-V agent allows you to restore not only entire virtual machines but also individual files and folders.
For file-level recovery, the selected virtual machine is mounted as a network share.
This enables you to conveniently browse its file system using Windows File Explorer and restore the desired files or folders.
By default, the network share is mounted at C:\RestoreMount.
You can change this path to a different folder or drive via the Windows Registry.

Procedure:

• Open the Registry Editor with administrative privileges.
• Navigate to the following registry path: HKEY_LOCAL_MACHINE\SOFTWARE\EVault\InfoStage\Agent
• Create a new String Value named MountAlternatePath.
• Enter the desired target path as the value, for example:
  E:\RestoreMount
• Restart both TERRA CLOUD services.

Note:
If the specified folder does not yet exist, it will be created automatically during the recovery process.

Transferring configuration to another Hyper-V host

Use this guide if a Hyper-V host has been replaced and existing backup jobs need to be transferred to the new host.

Prerequisites

• The original Hyper-V host appears as Offline in the backup portal.
  • This is the case, for example, if the Hyper-V agent components have been uninstalled.
• The Hyper-V management component is installed on the new Hyper-V host.
• The new Hyper-V host has already been registered with the TERRA CLOUD backup portal.

If the original Hyper-V host has already been deleted

If you have already deleted the original Hyper-V host visually from the backup portal, it must first be restored.
To do this, open the Computers section, right-click on Online & Offline, and then select Deleted.



The deleted Hyper-V host should now be visible.
Select it and restore it using Actions → Restore selected Hyper-V computer.

Implementation

• If you have not already done so, install the Hyper-V management component on the new Hyper-V host and register it with the TERRA CLOUD Backup Portal.
• In the Backup Portal, go to Computers and open the settings for the new Hyper-V host.

• Select the option Restore a previous Hyper-V agent.

• Under Select an offline agent for restoration, choose the original Hyper-V host.

• Enter or correct the login credentials for the new Hyper-V host and save the settings.
  • Make sure to enter localhost in the Address field. This ensures the host remains accessible even if its IP address changes.

Important Rework

Hinweis

After restoration, some settings must be re-entered or verified for security reasons.
If these steps are not performed, backup jobs will not execute correctly.

• Re-enter the password for each vault registration.
• Re-enter the encryption password for each backup job.
• Reactivate scheduled jobs via the agent's action menu if necessary.

Once all passwords have been entered and communication has been successfully verified, please install the Hyper-V host component on the new Hyper-V host.

Conclusion

Finally, verify the following points:

• The Hyper-V agent appears as Online in the backup portal.
• The Hyper-V host appears as Online on the Hosts tab.
• All backup jobs have been successfully imported.
• All required passwords have been re-entered.
• Communication between the Agent Host Service and the Agent Management Service is working.
• Scheduled backup jobs are enabled (if desired).

Backup satellites

Description and Benefits

The backup satellite is a hardware appliance or a virtual machine that is used in your end customer's network and can receive backups via the local network.
The satellite provides you with all vault functions, e.g. providing volumes from an image backup.
The rental devices or virtual machines are made available to you by the TERRA Cloud and are billed monthly, depending on their size and performance, in addition to the required backup packages.
By using a satellite, you can implement a hybrid cloud backup solution, as backups are stored locally on a satellite and subsequently replicated to a data center.
This backup concept offers the following advantages:

• Fast backup and restore, thanks to a locally connected vault system (satellite)
• No acquisition costs, as the hardware is provided to you
• Time decoupling between backup and replication is possible
• Restoration is possible independently of the data center
• Initial backup can be carried out directly against the satellite
• Your customer's bandwidth can be used optimally
• Fast VM restore of the Hyper-V agent or vSphere recovery agent

Commissioning

After ordering your backup package including satellites, you will receive an email with the access data as soon as the vault account has been provided on the Basevault.
You will receive a separate notification after the satellite has been deployed and shipped to you.
After receiving the satellite, the following steps must be carried out (hardware satellites):

• Set up and launch satellite in your end customer's network
• You can reach the satellite interface via the local address of the satellite (either static IP or DHCP)
• Please note that the satellite interface can be accessed via HTTPS and may need to be enabled in the browser first
• You can use the interface to change the access data in the user administration and, if necessary, adjust the network configuration
• Please deactivate the bypass mode using the Deactivate bypass mode function 10.3.1.3
• The satellite is now prepared for productive use and must be saved as a backup target in the agents' vault settings (local IP of the satellite)
• Initial backups can optionally be carried out directly against the satellite

Commissioning a satellite VM:

• You will receive a Hyper-V VM container from TERRA Cloud Support, which you can import and virtualize under Hyper-V
  • Please note that only Hyper Hosts are compatible with the Windows Server 2022 operating system or higher!
• Disk/network allocation must be done via Hyper-V Manager / VM Connect
• The remaining steps of commissioning a satellite VM are similar to commissioning a normal satellite

Satellite interface

System

Registration

You can access the following interface in your browser using the satellite's IP address.
There are two different users available, the image shows the administrative user who has
unrestricted access.
In addition, there is a user who only has read rights; you can set the access data at a later date.
The default login details for the admin user are:

User = admin
Password = terra

Informations

The Information item shows you the dashboard with all the important vital indicators of the hardware, e.g. CPU, RAM or hard drive utilization.
The satellite mode is also visible. A distinction is made between two modes, the active and inactive bypass mode.
With active bypass, the satellite rejects all agent requests, so communication for backups, restores, synchronizations or job creation takes place via the basevault. Accordingly, the Basevault address must be stored in the portal under the Vault Settings tab.
With the inactive bypass, the satellite is activated and accepts all agent requests, thereby enabling communication for backups, restores, synchronizations or job creation takes place via the satellite. Accordingly, the IP address of the satellite must be stored in the portal under the Vault Settings tab.

Hard disk capacity:
Green = Between 0% and 85%
Orange = From 85% to 95%
Red = From 95% to 99.99%

Features

System functions:
Under Functions you will find a list of the relevant services stored on the satellite. Please check whether all services are running.
If a service is stopped, you can start it using the Play symbol. Please do not restart any services while the satellite is running.

Satellite functions:
You can use this interface to shut down the satellite, restart it, or manually start a replication process.

Disable bypass:
A satellite with bypass mode activated cannot accept backups and delegates them to the base vault. Please deactivate bypass mode so that the satellite can accept backups.



Activate Support Connect:
With this switch you allow TERRA CLOUD support to access the satellite via remote maintenance.

Branding

This function allows you to adapt the satellite interface to your company's CI.
The configuration only needs to be carried out on one satellite, as you can export it and import it on other satellites.
There is also the option to add your own logo.

Maintenance

Vault maintenance checks the satellite's data stock every day at 9:23 a.m. for safesets that have exceeded their retention period; the number of retention days and copies must be exceeded. Expired safesets are deleted from the satellite. You can adjust the start time of this maintenance if necessary.

Updates

You can search the satellite interface directly for current updates and import them.

XML View

This menu item will take you to the XML output of the satellite in a new tab. This output lists all relevant information of the satellite and can be monitored.
You can incorporate this link into your own monitoring solution or use ready-made sensors. You can find ready-made sensors for Server-Eye and PRTG Network Monitor, the sensors can be found under the search term “Terra Cloud Backup”.
Homepage Server-Eye

Replication

Connectivity

This overview shows you the status of the connection to the Basevault. The satellite transmits a "heartbeat" to the basevault at regular intervals.
In addition, the connection to the backup portal and the base vault is checked via ping and Telnet. This ensures that all necessary ports are activated for the satellite.< br> During replication, for example, the outgoing network traffic rate can also be monitored.

Replication Status

This overview shows you which safesets are still outstanding for replication to the data center; these are processed as if in a queue.
On the right side you can click through the satellite's current inventory and view more detailed information about individual safe sets, such as the compressed
Size or whether this safeset has already been replicated.

Bandwidth limitation

You can configure a bandwidth limit for satellite replication. Please note that after an adjustment, the replication service restarts and ongoing replications are aborted.
If the connection is weaker, we recommend configuring the "Quality of Service" on the firewall for the satellite and assigning it a low priority.
This setting on the firewall ensures that, for example, on a holiday, the
. can be replicated with full bandwidth Bandwidth allocation is therefore more flexible than a fixed bandwidth limit.

Replication Schedule

The replication schedule allows you to control whether to replicate immediately after a newly created backup and after
defined schedule or exclusively according to a configured replication schedule. This option is particularly recommended if
should be backed up during your customer's working hours, but replication should only start after working hours.
In this image you can see the configuration for a replication schedule that initiates a replication operation every day around 8 p.m.:

Safeset Management

Special configurations can be made on the satellite via Safeset Management; if configured incorrectly, these can affect the function of the satellite.
Changes can only be made after activation via the slider and may only be made after consultation with support.

Backup data

You can use the satellite interface to delete entire systems, jobs or individual backup sets (safesets).
The deletion only applies to satellites; the data in the data center on the respective base vault remains unaffected.
Safe sets are displayed online; they are highlighted in black and can be selected by clicking in the checkbox.
Online safesets are characterized by the fact that they are stored locally on the satellite and are directly available there.
Safesets that are grayed out and cannot be selected are offline safesets.
An offline safeset represents a backup that does not exist on the Satellite, but still exists on the Basevault.
Only meta information about these safesets is stored on the satellite.

Procedure for deletion:

System level deletion:
a) Check in the interface's job monitor that no process is running for the affected system. (If the Job Monitor tab is not available, update to the latest interface version)
b) Select the systems to be deleted and carry out the “Delete marked entries” action c) Wait until the affected system is grayed out from the overview. (It may take some time)
d) Check the capacity of the satellite and start a quick storage optimization

Job level deletion:
a) Check in the interface's job monitor that no process is running for the affected job. (If the Job Monitor tab is not available, update to the latest interface version)
b) Mark the job to be deleted by selecting it and carry out the “Delete marked entries” action
c) Wait until the affected job has disappeared from the overview/grayed out. (It may take some time)
d) Check satellite capacity. If unchanged, start quick memory optimization

Safeset level deletion:
a) Check in the interface's job monitor that no process is running for the affected job. (If the Job Monitor tab is not available, update to the latest interface version)
b) Select the safe sets to be deleted and carry out the “Delete marked entries” action c) Wait until all affected safe sets have disappeared from the overview/grayed out. (Depending on the size, the process can take a lot of time)
d) As soon as all safesets have disappeared/grayed out, start quick storage optimization

Job Monitor

You can view open or already completed processes in the Job Monitor.
Backups or restores can be monitored, as can replication processes.
The following screenshot shows a satellite that currently has no open jobs:


Jobs on the screenshot:
Maintenance Host = This process represents maintenance on the satellite, this process should always be displayed
Satellite Replication Service = Behind this process is the active replication service, this process should always be displayed
Satellite Replication - Upload Satellite Statistics = In the screenshot, this process is set to "Inactive" because it was completed successfully. In this job, the satellite passed information to the basevault.

User management

Within the user management you can define passwords for a total of two users.
Which users are stored in total?

1. Admin: This user has full access and is intended for administration of the satellite.
2. User: This user only has read permission and can be issued to the end customer as required.

Network configuration

You can use the network configuration to pass on your desired settings directly to the satellite or use the “Activate DHCP” function.
As soon as DHCP has been activated, the network configuration assigned by the DHCP server will be displayed.

Initial backup FTP upload / send data carrier

Booking

The two processes can be added when initially booking a backup package or later in the order.

Implementation

Prerequisites:

• The backup agent is installed on the target system and registered in the portal.
• The backup job and schedule are configured as desired.
• To prevent the external storage medium from being included in the backup, the "Entire Server" option has been temporarily removed from the job configuration.
  Instead, the backup is performed by manually selecting the individual drives. The external storage medium must not be selected.
• The backup job schedule is disabled to prevent the agent from automatically attempting to back up to the vault.
  

Procedure:
1.) Start the backup to the vault to transfer metadata.
This transmits information required by the vault for the import process.
The process can be stopped as soon as the status "Processing" appears.

2.) Create the folder structure in the target directory.
To ensure smooth identification, please create the following folder structure:
\$ACCOUNTNAME$\$COMPUTERNAME$\$JOBNAME$

Example path:
E:\45814-ENDKUNDE\WIN-VKEE7ONL8FG\BMR

As the data involved is always encrypted, an incorrect folder structure would result in a written inquiry and, consequently, a delay in the process.

3.) Start the backup to the previously created path.
The procedure in the portal is as follows:

FTP Upload

Please ensure that the dataset is complete.
Each job is divided into backup fragments that are numbered sequentially; all fragments except the last one are 1,048,576 KB in size.
Only the first fragment (SafesetNumber.SSI or 00000001.SSI) differs in its filename from the remaining files.



Before uploading, check the initial backup log for any anomalies.
If you encounter irregularities or have questions, please contact our support team before sending or uploading the dataset.

The created initial backup can then be uploaded to the TERRA Cloud FTP server.

For example, the FileZilla Client can be used for the upload.
The necessary access credentials will be provided by us after the booking has been received in the Center.

Once the upload is complete and has been verified, please send us a brief confirmation regarding the previously transmitted information.

Following successful verification, we will notify you as soon as there are updates regarding the import.

Send in data carrier

Please ensure that the dataset is complete.
Each job is divided into backup fragments that are numbered sequentially; all fragments except the last one are 1,048,576 KB in size.
Only the first fragment (SafesetNumber.SSI or 00000001.SSI) differs in its filename from the remaining files.



Before shipping, check the initial backup log for any anomalies.
If you encounter irregularities or have questions, please contact our support team before sending in the storage medium.

If the initial backup completed successfully but an error message appears in the log file after the successful completion notice, we recommend consulting the following Wiki article:
SSET-E-04104 The request failed. The remote server reported the following error: RPC-E-FAILED, general RPC error / UTIL-W-05229 Configuration files could not be uploaded: File could not be uploaded. C:\Program Files\TERRA CLOUD Backup\Agent\Jobname.status.cfg

Once all outstanding questions and issues have been resolved, the storage medium can be sent to the following address, together with the completed submission form:

TERRA CLOUD GmbH
Hankamp 2
32609 Hüllhorst

Notifications regarding the import or shipping status of the storage medium are handled via automated business processes.

Under no circumstances should you send us unencrypted raw data belonging to your end customer!

Such data will be returned to the sender unprocessed.

Backup Export

In order to save data on a local medium, for example for long-term backup, we can export your backups. The export is encrypted and in the so-called vault format, so that the exported data must be read in with additional software before an agent can process and restore it.

Please note that this is a paid process. Further information about the process (offer, procedure, etc.) is available from our cloud sales department: cloud@wortmann.de
As soon as you have received the desired data set, you can continue with the steps below.
It should also be noted that it is not possible to export backups via the Hyper-V agent.

The required software can be found at:
Secondary Restore Server

Secondary Restore Server

The Secondary Restore Server reads the exported data and presents it as a virtual vault in the existing network.

• Please navigate to the folder structure of the exported data in the Secondary Restore Server
• Store the data of the exported vault account, e.g. B. (45814-END CUSTOMER), as well as the vault account password
• Start sharing via the Secondary Restore Server (Start)
• Agents can then access the share as if it were a normal vault.

Restore individual files (Secondary Restore Server)

Once the data has been presented on the network, you can proceed as follows:

BMR Restore(Secondary Restore Server)

For instructions on how to initiate a BMR, see: Bare Metal Restore Once the data has been presented on the network, you can proceed as follows:

Agent Skripting

Windows Agent

Address Windows Agent via command line

Please first change to the agent's installation directory in CMD or PowerShell, by default this is 'C:\Program Files\TERRA Cloud Backup\Agent\'
To start a backup, the following parameters must be passed to VV.exe:

• VV.exe backup JOBNAME /retention=RetentionName (CMD)
  
• .\VV.exe backup JOBNAME /retention=RetentionName (PowerShell)
  

You can use the /retention=RetentionName parameter to determine which retention type should be used.
Please replace "RetentionName" with the name of the retention period, which you can view in the Advanced Agent Settings.

Address Windows Agent via script

The desired commands can be stored in a script.
Recommended formats are .bat and .cmd

Scripts can be extended as desired, e.g. to store pre- and post-commands, i.e. commands before or after the backup.

Example script:
@echo off
cd "C:\Program Files\TERRA Cloud Backup\Agent"
echo "Start backup" >> backuplog.txt
VV.exe backup BMR /retention=Daily
echo "Backup performed" >> backuplog.txt

Run script before shutdown

You can integrate your created script into the system's pre-shutdown event with the following configuration. This is particularly recommended for client systems that are not consistently in use.
Please carry out the following steps to store a script:

1. Open Local Group Policy Editor (WIN + R "gpedit.msc")
   
2. Store your created script under "Computer Configuration -> Windows Settings -> Scripts (Startup/Shutdown)
   
3. Click "Shutdown" and add your script via "Add".
   
4. Please adjust the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\gpsvc\PreshutdownTimeout
   
5. This key defines the length of the pre-shutdown event, which is set to 15 minutes by default. Please increase this value so that a backup can be created during this time.
6. In the Local Group Policy Editor, please navigate to "Computer Configuration -> Administrative Templates -> System -> Scripts
   
7. Adjust the "Specify maximum wait time for Group Policy scripts" setting. You can enter a value of up to 32,000 seconds or 0 for an infinite waiting time.
8. Please note that you have adjusted the rights accordingly.
   

We have described further information about this in the following Wiki article: PreshutdownTimeout Value Authorization

boxed

Create new custom command

This option gives you the opportunity to add a schedule to scripts that have already been created via the backup portal.

When you create a new custom command, the agent checks whether there are scripts stored in the agent directory in the "ScheduleScripts" batch files subfolder.
The standard path to this directory in which a script for this function can be stored:
C:\Program Files\TERRA Cloud Backup\Agent\ScheduleScripts
In the following screenshot you can see a selected script with a configured schedule:

Recommendation: A custom command's schedule can only be created as a single-line schedule. Please check our Best Practice for agent scripting to avoid this disadvantage.

Agent Skripting Best Practice

The backup agent can be tailored to specific application scenarios through the use of scripts. We recommend using the following guide as a basis for your scenario.

Preparation:
What needs to be prepared before using the following scripts?

1. Install the agent on the system to be protected
2. Link the system to the vault in the Backup Portal
3. Create backup job(s) without a schedule

Step 1: Create a batch file
Create a batch file (.bat) with the following structure:
powershell.exe -ExecutionPolicy Bypass -File "Path to PowerShell script\agentscripting_retention.ps1"
Please adjust this batch file later to match the path and name you have assigned to the PowerShell script.
Copy the created batch script into the following folder within the agent's installation directory:
C:\Program Files\TERRA Cloud Backup\Agent\ScheduleScripts (default)
In the Backup Portal, for the relevant system, click on "New custom command" under "Select job task".

Using this function, you can select a stored batch script and assign a schedule to it; please configure the desired time (e.g., 10 PM).

Function:
This batch file will subsequently be launched by the backup agent itself according to the schedule.
The batch file launches PowerShell and the second script.
Since PowerShell is significantly more extensive and flexible, the first script serves solely to invoke PowerShell.

Step 2: Create PowerShell script
In this step, you create the PowerShell script that is triggered by the batch script from Step 1.
This script calls the backup agent to perform a backup.
Additionally, it allows for the use of different retention periods and the inclusion of pre- and post-commands.

Content:
Please create a PowerShell script (.ps1) with, for example, the following content:

Set-Location "C:\Program Files\TERRA Cloud Backup\Agent"
$date = Get-Date
$currentday = $date.Day
$lastday = [DateTime]::DaysInMonth($date.Year, $date.Month)
if ($lastday -eq $currentday){
Placeholder for pre-commands
.\VV.exe backup NameOfBackupJob /quickscan=true /retention=Monthly
Placeholder for post-commands
}
else{
Placeholder for pre-commands
.\VV.exe backup NameOfBackupJob /quickscan=true /retention=Daily
Placeholder for post-commands
}

Function:
This PowerShell script switches to the agent's installation directory and checks the current date.
If the date matches the total number of days in the month (the dynamic last day of the month), a backup with the retention type "Monthly" is performed.
On all other days, the retention type "Daily" is used.

Advantages of this implementation:

1. You can utilize the full range of PowerShell functions and customize this base script as desired customize for your customers
2. The schedule can be created via the Backup Portal and does not need to be implemented via the script
3. You can use pre- and post-commands to stop databases prior to the backup if they cannot be brought into a consistent state using VSS technology

Linux Agent

In addition to the portal, the Linux agent can also be accessed via created scripts.
You can contact the agents directly via a created script. As in the following example script (CustomScript.sh):
nano CustomScript.sh
cd /opt/BUAgent
./VV backup RootDir
In the example, RootDir is the backup job name.
The script (e.g.: CustomScript.sh) must then be given the appropriate rights. To do this, please execute the following command:
chmod +x CustomScript.sh

Optionally, you can schedule scripts via the Backup Portal by completing the following steps:

• Under Linux, by default, no folder called "ScheduleScripts" is created in the installation directory. Please create this with e.g. mkdir ScheduleScripts
  
• Place the created script (.bat or .cmd) in the agent directory in the newly created ScheduledScripts folder
• In the Backup Portal, select "Create a new custom command" via "Select job task" and select your script
• Create a schedule for the script

Automatic Bare Metal System Restore Test (ABSRT-Tool)

General

Regular BMR test restores are essential for the quality management of a backup strategy.
However, manual tests are time-consuming and therefore costly; automation offers a solution here, reducing the required effort to configuration and monitoring.

The ABSRT tool creates virtual machines using Microsoft Hyper-V, equipped with a prepared restore ISO.
Data that would normally need to be entered during a manual restore—such as the system name or the vault system address—is read from a CSV file and applied during the recovery process.

The most recent safeset is dynamically selected for the recovery test.
Once the automated configuration is complete, a full restore is performed, including booting up the system after successful completion.

To further increase efficiency, you can parallelize the recovery process by including data for multiple BMR backup jobs in the CSV file.

Due to compatibility issues, the current version of ABSRT is supported only on Windows Server operating systems.

Requirements

1. Participation in the TERRA CLOUD Backup Certified Specialist Training
2. At least one Microsoft Hyper-V host with corresponding free capacity for the test VMs
3. The test VMs require access to a DHCP server
4. An external vSwitch must be available
5. Certified Specialist ABSRT license (available upon request from Support)

Setup

When you start the ABSRT tool for the first time, the tool will ask you for a Certified Specialist ABSRT license:

After you have entered a valid license, the installation path selection appears:

The following required components are then checked/installed:

1. Hyper-V Installation
2. If configured, VeraCrypt

If software components are missing, they are installed automatically by the tool.
If the Hyper-V component is installed, a restart must be performed.

Preparation of the CSV file

You can create the CSV file via our TERRA CLOUD Technical Center.
Please feel free to consult the following wiki article for details: Link

If you do not currently have access to the Technical Center, you can also create the CSV file manually.
To do this, locate the "Backups.csv" file in the "CSV" folder (e.g., at C:\ABSRT\CSV); you can use this file as the basis for your configuration.

Important! The first line serves as a legend and must not be modified!

Example:
Vaultaddress,Vaultaccount,Vaultaccountpassword,Computername,Jobname,EncryptionPassword,VHDXCapacity,VMGeneration,OSVersion,VHDXStorage,VSwitchName,AmountOfPhysicalDisks,SendEmail
==> vault-wmh1-wp01.terracloud.de,00000-RESELLER,RtHKha451!HjioplÖ03,DC,BMR,hdakzeogsz1,300,2,2019,D,extern,3,n

Note:
If the encryption password contains a comma, the entire password must be enclosed in double quotation marks.

Example of an encryption password containing a comma:
"Ghgui385as,"

Explanation of parameters

Vaultaddress
FQDN of the vault system

Vaultaccount
Vault account; you can find this in your vault profile, for example

Vaultaccountpassword
You received this password in the provisioning confirmation

Computername
Computer name on the vault system; this does not necessarily have to match the name displayed in the Backup Portal—please check your reseller report if in doubt

Jobname
Name of the backup job

EncryptionPassword
The encryption password for the selected backup job

VHDXCapacity
Enter the size of the restored volume here; if the system has multiple volumes, please enter the size of the largest one in GB.

VMGeneration
Please ensure that the VM generation matches that of the source system.
The generation specified in the CSV determines the algorithm used to assign volumes during the recovery process.

OSVersion
As of agent version 9.40, there are two recovery media options, selected via the OSVersion entry.
This refers to the operating system version of the source system. The following values ​​are permitted: 7|10|11|2008|2012|2016|2019|2022|2025

VHDXStorage
Please specify the drive letter for the VHDX storage location.

VSwitchName
Name of the external vSwitch; you can find this in the Virtual Switch Manager.
If only one external vSwitch exists, you can also use the value <default>.

AmountOfPhysicalDisks
Please specify the number of physical or virtual disks the source system has.
Note: ABSRT currently supports systems with a maximum of four disks.

SendEmail
An optional switch used to configure email notifications (n ​​= no, y = yes).

If you wish to restore multiple systems simultaneously, simply add further lines starting from line 3. The legend line does not need to be copied.

Implementation

After launching ABSRT and preparing the environment, you can choose between a "standard" execution on the Hyper-V host
or preparing configuration ISOs to automate recovery at a different location (e.g., in our IaaS environment):

Convert

First, you are prompted to specify the storage location for the ISO files.
Since the ISOs are very small, C:\temp\ is set as the default destination path:

Next, you must select the desired CSV file:

Once the conversion is complete, you will find the ISO files at the selected location:

Recovery Test

The standard recovery test begins directly with the selection of a CSV file:

Subsequently, the VMs are created and started based on the CSV parameters so that the automatic recovery takes place:

Restoration outside the ABSRT environment

Once you have created the config ISOs using the Convert function, you can create a new VM shell at your chosen destination.
Importantly, a DHCP server is also required in the network of the target VM shell for the restoration to proceed.
The VM shell must have two DVD drives; the standard restore ISO is required in one drive, and the config ISO in the other:

Booting from the restore ISO initiates the automatic restoration process.
Once the restoration is complete, the process pauses at the driver overview screen.
Before restarting, ensure that both ISO files are removed from the DVD drives.

Monitoring

During the recovery, another process is started which checks the status of the recovery based on the heartbeat of the virtual machine.
As soon as a heartbeat is present, a screenshot of the connection window is created and stored in the ABSRT directory under "Screenshots".
If the SendEmail option has been selected, the screenshot is also sent to the specified email address.

Email notification ABSRT

To use the email notification, you must edit and fill out the file C:\ABSRT\smtp.xml:

The script checks in advance whether the required fields have been filled in. If an entry has not been filled in, the notification is skipped.

VeraCrypt

Activate function later:
Remove VeraCrypt REG key under HKEY_LOCAL_MACHINE\SOFTWARE\ABSRT\ Start ABSRT.exe again and activate VeraCrypt

Deactivate the function later:
If necessary, remove containers under C:\ABSRT\VeraCrypt Remove VeraCrypt REG key under HKEY_LOCAL_MACHINE\SOFTWARE\ABSRT\ Start ABSRT.exe again and say no to VeraCrypt

Rebuild CSV Container:
Remove container under C:\ABSRT\VeraCrypt Start ABSRT.exe again and enter the password for the new container

Script-based handling ABSRT

The following parameters can only be used via PowerShell:

-Install [Switch] - "C:\Users\Administrator\Desktop\ABSRT.exe -Install -DebitorNumber 12345 -License D133763385BAEFBFF9673C63Ab [-Vera Terra001!]"
-> Performs an automated installation of the ABSRT tool. The -Vera parameter is optional.

IMPORTANT: If the Hyper-V role has not yet been installed, an automatic restart will occur after the installation is complete!

-Password [String] - "C:\Users\Administrator\Desktop\ABSRT.exe -Password Terra001!"
-> Ensures that the VeraCrypt container is mounted automatically. If the password is incorrect, a manual query is made.

'-CSV [String] - "C:\Users\Administrator\Desktop\ABSRT.exe -Password Terra001! -CSV V:\CSV\TestCSV.csv [-NoPause]"
-> Ensures that the CSV file is selected automatically. Please always specify the complete path of the CSV + file extension. (Shift + right click -> "Copy as path" can be used for this)

-Uninstall [Switch] - "C:\Users\Administrator\Desktop\ABSRT.exe -Uninstall"
-> Performs a complete uninstallation of the ABSRT tool. However, the Hyper-V role is not uninstalled. Please make sure that you only perform the uninstallation once no VM created by ABSRT exists in the Hyper-V Manager.

-Manual [Switch] - "C:\Users\Administrator\Desktop\ABSRT.exe -Manual -Vaultaddress vault-wmh1-0002.terracloud.de -Vaultaccount 00000-RESTORE -Vaultaccountpassword wD5c9mP7-3bL1337l1th8W7xaB0T0m -Computername RESTORE -Jobname RESTORE -EncryptionPassword Terra001! -VHDXCapacity 1000 -VMGeneration 2 -OSVersion 2019 -VHDXStorage D -VSwitchName <default> -AmountOfPhysicalDisks 4 -SendEmail n"
-> Can be used as an alternative to the CSV selection. All parameters are required.

-ConvertCsvToIso [Switch] - "C:\Users\Administrator\Desktop\ABSRT.exe -ConvertCsvToIso -ISODestination C:\temp\ -CSV C:\Users\Administrator\Desktop\RESTORETEST.csv [-NoPause]"
-> Performs the conversion of CSV files to configuration ISOs.

Backup Assistant

The TERRA CLOUD Backup Assistant is a proprietary development by TERRA CLOUD.

Note:
Please note that the tool is no longer being maintained as of the end of 2025.

Status

On the right side of the tool you will find information about the "Connections" and "Software" versions.
If a connection to the portal servers is not possible, please check the corresponding Ports.
You can also install or update the TERRA CLOUD Backup Windows Agent using the Backup Assistant.

Agent Installation

If the Backup Agent is not yet installed on the affected system, it can be downloaded and installed using the tool.
Please first enter the login credentials of a Backup Portal user located on the corresponding customer site.
If you would like automatic job setup, you can check this box directly there. All you need to do is enter an encryption password.
Further information on automatic agent configuration can be found here.



After you have selected the required plugins and accepted the license agreement, the latest Backup Agent will be downloaded and installed in the background.

Initial backup

This feature represents the same options that are available for the initial backup tool. This tool is presented in the following Video

Agent functions

The "Backup Jobs" function allows you to execute previously created backup jobs of the installed Windows Agent and to view the log files of the performed backups..

Backup Reset

This function removes metadata (e.g. the delta information) from the job directory of the selected backup job.
After deletion, the tool performs a synchronization to recreate the removed metadata. This process may take some time.
This process may be necessary to resolve various error patterns.

Example:
delta assignment file is damaged

Support Bundle

With the support bundle, all necessary information and logs such as VSS logs, system event logs and backup job logs are brought together and packed into a .zip file.
This can help us find the cause in various support cases.

Monitoring

“Monitoring” tab in the TERRA CLOUD Backup Portal

This feature of the TERRA CLOUD Backup Portal provides a comprehensive overview of the status of all backup jobs.
Additionally, active agent processes (ongoing backups, restores, etc.) are displayed.
This overview can be accessed across all customers via the parent site or within a specific site, thereby focusing on a particular end customer.
In addition to the backup status, the Last completed backup column is particularly useful for sorting backup jobs based on the time of the last successful backup.
This makes it easy to quickly identify jobs for which no backup has been successfully completed for an extended period.

A new addition is the Backup History Graph, a visual representation of the backup history over the past 28 days.
This view displays 28 colored status bars visualizing the backup status for each day, providing a quick overview of the backup history.
Hovering your mouse cursor over a bar allows you to view further details regarding the backups performed on that specific day.

Note:
Please note that only past days are displayed; i.e., the first bar on the far right shows the status from yesterday.

The colors indicate the following:

• Green
  At least one backup started on that day completed successfully without any warnings or errors.
• Yellow
  At least one backup started on that day completed with warnings or was deferred.
  However, no backup completed successfully without warnings or errors.
• Red
  At least one backup started on this day finished with errors, failed, was aborted, or could not back up any data.
  No backup was successfully completed on this day.
• Gray
  No backup was performed for the relevant backup job on this day; scheduled backups were skipped, are still in progress, or no backup activity took place.
  In some cases, this status may also appear briefly if a backup has just successfully completed but the status information in the portal has not yet fully updated.

Active processes:
You can identify active processes by the circle consisting of two arrows and the adjacent number; clicking the icon takes you directly to the process overview.

Export of the monitoring overview by email

You can schedule regular export in various file formats for the monitoring view using the 'Email/Schedule' drop-down menu.
For an automatic evaluation of a monitoring or ticket system, you can e.g. B. select the file format 'CSV'.
If you want an export for a single end customer, you can configure this via a site user with the "Administrator" role.
To do this, please log in to the backup portal with the site user and configure the export within this end customer. The export from the following example includes the backup jobs of all sites/end customers.

Evaluate job status in XML file

The Windows, Linux and vSphere Recovery Agent store information about the last backup status and e.g. B. the backup size in an XML file.
The following paths refer to the default installation directory.

Linux Agent:
/opt/BUAgent/<JOBNAME>/BackupStatus.xml

Windows Agent:
C:\Program Files\TERRA Cloud Backup\Agent\<JOBNAME>\BackupStatus.xml

vSphere Recovery Agent:
C:\Program Files\vSphere Recovery Agent\<JOBNAME>\BackupStatus.xml

Possible results for "<agentdata:result></agentdata:result>":

• UNKNOWN: The job status is currently unknown.
  
• COMPLETED: The job is completed or completed with errors/warnings.
  
• CANCELLED: The job was canceled manually.
  
• FAILED: The job failed, please check the log files.
  
• NO_FILES: No backup could be performed because no files are protected by this job.
  

Consumption Reports

The TERRA CLOUD provides you with various reports to monitor the consumption values relevant to the license model.

TERRA CLOUD Backup Reseller Report

This report shows you the consumption values of all your end customers' backup accounts.
The data refers to the 15th calendar day of a month and forms the billing basis for the respective month.
The report is sent to the Backup Master Account / Cloud Master Account (TERRA CLOUD Center) from the 16th calendar day of a month.

Example excerpt from the Reseller Report

TERRA CLOUD Backup Billing Report

In addition to the TERRA CLOUD Backup Reseller Report, you will receive the TERRA CLOUD Backup Billing Report in CSV file format.
The consumption values for billing the TERRA CLOUD backup are summarized for you in this report for each end customer.
We recommend this report as the basis for automated billing, e.g. B. also for the TERRA CLOUD Backup Enterprise license model.

Content of the report:
Active vault Vault: The name of the active vault
account Native protected data in GB: The sum of the end customer's natively protected data volume
Computer amount: The sum of the device licenses
Additional safesets: The sum of the additional paid safesets

TERRA CLOUD Backup Customer Report

Optionally, you can add an end customer report to your TERRA CLOUD backup order in the TERRA CLOUD Center.
In this report, you or your end customer will receive a weekly consumption overview and the status of the backups.
The presentation corresponds to the reseller report, but only includes the data records for the respective end customer.