I am hoping to copy my Continuous Incrementals to a DR site, to be paired up there with Fulls which will be shipped via Fedex. I'd like to have a batch perform this process each night. The remote office is a very very slow link (T1 from all the way on the other coast).

My O/S partitions are very constant- yet I am getting Incrementals on the order of 2GB at times. I did notice a defrag job in the Task Scheduler library for Windows 2008 Server, which I have shut off. But even on days when the defrag did not run, I am getting the larger-than-expected files. I did a search and nothing appreciable changed on the O/S partition.

 What do I do to troubleshoot this? Any ideas?

Well, it's hard to say exactly what's changing.  One way you could find out is to mount two of your incrementals where ~2GB changed from one to the next incremental and then do a full file compare of the entire mounted volumes of the two mounted incrementals to find out which files are being altered.  Just a thought.  I think you could probably use BeyondCompare's free trial for this.  Anyone else have suggestions?

If there were any previous backup product installed (e.g. BESR etc.), make sure their filter driver was removed completely during any uninstall. If the driver is left on the system it can screw up the ShadowProtect incremental tracking.

Regards

FT

I have this at one particular SBS2008 site also.  At this stage I'm thinking it's because I forgot to setup a fixed size paging file to a different partition.  It's being created on C drive and adjusted dynamically by Windows.

I'm going to setup the page file settings correctly are restart the server over the weekend, this should narrow it down.

Ah ha! Pagefile! I was circling that possibility!

 Someone on this forum suggested to turn off Exchange Circular Logging. Following instructions from Google, I did this and it made a tremendous difference. I'm running SBS 2003 with SQL too.

 Another way to find out what is writing to the disk is a free utility from Microsoft called Process Explorer. I love this tool. It will tell you just about everything there is to know about what is running on your system.

On some of my servers where the C: system drive caused large incrementals, it was related to AV definition updates, sometimes occurring several times a day with large def files copied to multiple places.

Yeah could certainly be that.

Changed paging file location, disabled windows shadow copies on C, turned of indexing of C, disabled WSUS and am still getting large incrementals of C.  Particularly the first one in the morning - several hundred MB's in size.

I'm using Trend WFBS 6.1 and the updates do stack up.  Although Trend say that their releases are Tuesday and Saturday - unless a critical threat is identified in between.

Yes, the servers I had problems with were all running Trend WFBS. I briefly experimented with their "smart scan" feature, but the constant data churn on the server created huge incrementals...the smart scan feature downloads updates at intervals at least hourly then rebuilds the entire pattern database each time. If you're using Smart scan, turn it off and there will be a huge improvement in your incremental sizes.

Even with the conventional scan updates, the default is to check for updates every hour. There are usually 2 or 3 major updates released per day. The downloaded pattern defs get saved on the server for distribution, then the server makes a copy for its own AV agent. If you are using the version of WFBS-A for Exchange, the server makes another copy of the defs for the Exchange agent. That's a lot of data churn.

At one site I manage which is set up for remote off-site transfers of the backup images, I have had to reduce the update frequency to daily to be able to manage the bandwidth requirement.

 I'm using Kaspersky security here, and it downloads anti-spam and anti-virus updates hourly. The 75th percentile for my hourly incrementals for the last two weeks is 350 MB, and the average is 616 MB. I use NT Backup to make a system state backup every weeknight, and defragment every day as well. MS Shadow copies are kept on another disk that is not backed up (it's easy for users to restore their own data with Shadow Copies), and indexing is enabled on only the files and documents that are really needed.

I use SuperFlexible (superflexible.com) to copy offsite every 20 minutes. There is a 3 Mb link going offsite, although for some reason it almost never seems to go above 1.5 Mb/s.

 Anyway, maybe that's TMI, but maybe it will help you or someone else.

In your case, I think defragmenting is probably a big part of your issue. Defragmenting will certainly change blocks and increase the size of Incrementals. There's a lot of discussion of defragging on this site and its effects, and recommendations for dealing with it.

 I am going to look at my AV updates, my Shadow Copy settings, and a couple of other things suggested here. Thank you!

 Sorry for not being clear. I am happy with the size of my incremental files. I know that defragmenting is increasing the size of them, but not defragmenting makes the server slow down. By defragmenting every day, I don't have to face a day of reckoning -- trying to transfer huge incremental files.

 I just found this http://www.storagecraft.com/kb/questions.php?questionid=198 that says Exchange Circular Logging is not needed. I just followed the instructions here http://www.storagecraft.com/kb/questions.php?questionid=198 and re-enabled Circular Logging. It will be interesting to see the effect on the size of my incrementals.

Ben

Regarding SuperFlexible. We are using the FTP ability of this brilliant little program to do the same as you. We found that messing with the FTP library setting can make a huge difference in the maximum speed of the upload. Also, if it applies, sometimes running 2 transfers in parallel gives you more upload speed than just one on its own.

Out of interest, how long do you dare run continuous incremenetals so far? Do you regularly test and verify?

 That's interesting about FTP. I'll give that a try.

 I'm using continuous incrementals. I verify the images every week (mount and verify that I can see files). If there is ever a problem (corruption) with the chain, I can delete incrementals in the chain back until the corrupt file, and SP will rebuild the chain at the next backup. I've had to do this before. It's slow, but not a big deal. I also use the ImageManager to collapse incrementals. I'm still tweaking the settings on that. Hint: run ImageManager onsite and remotely, and don't transfer the collapsed (CD) files.