HFS backup for virtual environments

vSphere 6.5, 6.7 and 7.0 are currently supported.

Features of Spectrum Protect for VE include:

  • "Forever incremental" image-level backups of virtual machines using VMware changed block tracking (CBT).
  • Client-side de-duplication (reduces network traffic).
  • Image-level restores of entire virtual machines.
  • Restores of individual files from image-level backups (using iSCSI).

There are some limitations.  The Spectrum Protect for VE client cannot back up virtual machines with the following properties:

  • Virtual machines with virtual disks, including RDM disks, greater than 2 TB.
  • Virtual machines with physical RDM disks (virtual RDM disks can be backed up).

There are Spectrum Protect for VE settings that allow these VMs to be backed up but unsupported disks will be skipped.  Contact hfs@ox.ac.uk for details.

The Service Level Description and a talk from the 2015 ICTF conference are available.  Access to the service is by application; contact the Service Desk via hfs@ox.ac.uk to request an account.

    Expand All

    Changed block tracking (CBT) enabled

    CBT must be enabled on the virtual machines that you wish to back up.  Without this, Spectrum Protect will always perform a full backup of a virtual machine which will consume a lot of resources at both the Spectrum Protect client and Spectrum Protect server.

    A suitable "data mover" VM

    This should, ideally, be installed on the vSphere infrastructure that you are planning to back up and needs to be running Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 (LTSC) or Windows Server 2019 (LTSC).  IBM's recommended hardware specification for the data mover VM is 16 cores (2.8 GHz) CPU with 8 GB of RAM.

    Firewall configuration

    When setting up Spectrum Protect for VE on a data mover, several ports are used for communication between the data mover and the vCenter server or vice-versa.  These ports need to be open in any host-based or dedicated firewall between the two machines and are listed in this table:

    Firewall configuration for Spectrum Protect for VE
    Source host Destination port Destination host Use Required?
    Data mover machine 443 vCenter server Communication between the data mover and the vCenter server. Yes
    Data mover machine 902 vCenter server Used for NBD (Network Block Disk) transport. If data mover machine is not a VM.
    VMs 3260 Data mover Default iSCSI port. If using iSCSI file-level restore.
    Data mover 3400 dsmdd3.hfs.ox.ac.uk Spectrum Protect backup traffic.  Destination host will be advised by HFS team on account set up. Yes
    Data mover 1500 dsmdd2.hfs.ox.ac.uk
    Spectrum Protect backup traffic.  Destination host will be advised by HFS team on account set up. Yes


    Also ensure that the data mover is able to resolve the fully qualified domain name (FQDN) of the ESXi host and the vCenter server.  Ping the ESXi host and vCenter server by name from the data mover and confirm it resolves the IP address.

    vCenter server and backup user

    Spectrum Protect for VE communicates with a vCenter server to perform VM backups. The user required for this needs some elevated privileges but does not need to be a full administrator. It is recommended that you set up a new vCenter user specifically for Spectrum Protect backup and restore.

    Please see the 'vCenter Server privileges required for the Data Protection for VMware vSphere GUI and data mover' page on the IBM support site, to find out which privileges the vCenter user will require.

    Please note that:

    • If you have not yet contacted the HFS team for a Spectrum Protect for VE account, please do this first by contacting the Service Desk via hfs@ox.ac.uk.
    • Depending which packages are installed, this procedure may require a reboot so take care if installing on a VM or machine that performs other tasks.

    If you are upgrading your existing IBM Spectrum Protect for VE, then please follow the steps described here.

    Otherwise, you will need to:

      Install Spectrum Protect for VE

      1. Download and extract the latest IBM Spectrum Protect for VE installer onto the "data mover" VM. You need up to 2 GB of free space for the files.

      2. Run spinstall.exe.

      3. Follow the prompts and accept the license terms.

      4. Accept the default installation location.

      5. For the Installation Type, choose Advanced installation, then Install the data mover feature only.

      6. Several IBM packages and possibly some prerequisites too (such as C++ redistributable packages).

      7. Follow the prompts, making sure to untick the Register as a vSphere Web Client plug-in option.

      Configuration tool

      This step is only required when performing a fresh Spectrum Protect for VE installation.

      1. Download the appropriate configuration tool:

      2. Run Config_tool.exe.

      3. Provide the information provided by the HFS team when requested by the displayed form.

      4. From the form select Help then Configure.

      5. Once the configuration is complete, select Exit.

      You have the following options to upgrade your existing Spectrum Protect / TSM for VE software:

      Upgrade from an old version (prior to 8.1.6)

      If your currently installed Spectrum Protect / TSM for VE software is prior to version 8.1.6:

      1. Download and install the latest version of Spectrum Protect for VE

      2. Download and run the self-extracting file certificates.exe on the data mover VM.

      3. Copy the unzipped four files into the folder C:\Program Files\tivoli\tsm\baclient, overwriting any existing files in that folder if necessary.

      4. Add any additional vCenter privileges for the HFS backup vSphere role.

      The configuration file tsm4ve.opt is located within C:\Program Files\Tivoli\TSM\baclient\.  We have tried to choose reasonable defaults, but you may want to adjust the following configuration options to suit your setup.


      This sets the list of VMs that you want to back up.  If the data mover is a VM on the vCenter server, you should not back it up via itself so add its name to the -VM part of DOMAIN.VMFULL.  To exclude virtual machines vm1vm2 and vm3 from the backups, give them as the value for -VM, separated by commas:

      DOMAIN.VMFULL  all-vm;-VM=vm1,vm2,vm3

      Note that if the VM name contains spaces, it should not be surrounded by quotes.  There should also be no spaces between VM names and the commas.  This applies to all DOMAIN.VMFULL options.

      To specify explicitly the VMs to back up, use the VM option.  For example to back up vm1vm2 and vm3, use:

      OMAIN.VMFULL vm=vm1,vm2,vm3

      VMs can also be specified by vCenter folder, host, host cluster and datastore.  To back up specific folders, use:

      DOMAIN.VMFULL  vmfolder=folder1,folder2,folder3

      To back up specific ESX/ESXi hosts, use:

      DOMAIN.VMFULL  vmhost=host1,host2,host3

      To back up specific host clusters, use:

      DOMAIN.VMFULL  vmhostcluster=cluster1,cluster2,cluster3

      To back up specific datastores, use:

      DOMAIN.VMFULL  vmdatastore=datastore1,datastore2,datastore3


      EXCLUDE.VMDISK excludes the specified virtual disk from backup.  For example, to exclude virtual disk "Hard Disk 2" of virtual machine "vmname":

      EXCLUDE.VMDISK vmname "Hard Disk 2"

      The second argument is the virtual disk's label, rather than the VMDK file.  The disk label can be obtained from the vSphere client or from the Spectrum Protect command line with:

      backup vm -preview vmname


      INCLUDE.VMDISK includes specific virtual disks in the backup of a virtual machine and creates an implicit exclude for all other virtual disks on that virtual machine.  For example, if you have a virtual machine named "vmname" with four virtual disks ("Hard Disk 1" to "Hard Disk 4"), the following would back up "Hard disk 1" and "Hard Disk 2" of "vmname" but not "Hard Disk 3" or "Hard Disk 4":

      INCLUDE.VMDISK vmname "Hard Disk 1"
      INCLUDE.VMDISK vmname "Hard Disk 2"

      The second argument is the virtual disk's label, rather than the VMDK file.  The disk label can be obtained from the vSphere client or from the Spectrum Protect command line with:

      backup vm vmname -mode=ifincr -preview


      Maximum number of VM backups to perform in parallel per instance of the Spectrum Protect client.


      Maximum number of VM backups to perform in parallel per ESX or ESXi host.


      Maximum number of VM backups to perform in parallel per datastore.

      The limit options can be used to ensure that parallel VM backups do not put too much load on any one part of your infrastructure.  If you have one ESX/ESXi host and one datastore then all the limits on parallel backups should be equal.

      Using the Spectrum Protect client GUI

      1. Launch the Spectrum Protect for VE client GUI on the data mover.

      2. Choose Actions Backup VM to display the Backup Virtual Machine window

      3. Expand the Virtual Machines item, then expand or click on the ESX/ESXi hosts:

      4. Select virtual machines to back up.

      5. Choose Incremental Forever - Incremental from the drop down, then Backup.

      6. Task List window displays the backup progress.

      7. For detailed information, select Report.

      Using the Spectrum Protect command line

      To back up all virtual machines specified in the DOMAIN.VMFULL option, start the Spectrum Protect for VE command line client and run:

      tsm> backup vm -mode=IFincr

      To back up a specific VM, run:

      tsm> backup vm 'vmname' -mode=IFincr

      Using the Spectrum Protect client GUI

      1. Launch the Spectrum Protect GUI client on the data mover.

      2. Select Actions > Restore VM to display the Restore Virtual Machine window.

      3. Choose a VM to display its available backups

      4. Select a backup then Restore.

      5. In the Restore Destination window:

        • To restore to the original location, ensure there is no VM with the same name in that location.

        • To restore to a new location, specify as much information as necessary.

        • Specifying only a new name will restore the VM to the original location with the new name.

      6. Select Restore.

      Using the Spectrum Protect command line

      • To restore a virtual machine to the same name and location as it was backed up from:

        tsm> restore vm 'vm name'

        You must ensure that the target VM name no longer exists.

      • To restore a virtual machine to its original location but with a new name:

        tsm> restore vm 'vm name' -vmname='new vm name'
      • To restore a VM to a new name and new location, specify both the name and location:

        tsm> restore vm 'vm name' -vmname='new vm name' -datacenter='data center name' -host='ESXi host name' -datastore='datastore name'

      Restoring individual files is achieved by using the Data Protection for VMware Recovery Agent.

      Using iSCSI

      The most flexible way to restore individual files is by using the Recovery Agent to export a backup as an iSCSI target which the iSCSI initiator on a virtual machine can then mount.

      1. Select New IBM Spectrum Protect server... from the drop down menu within IBM Spectrum Protect Server.

      2. Set the following, then OK:


        Server address dsmdd1.hfs.ox.ac.uk, dsmdd2.hfs.ox.ac.uk, dsmdd3.ox.ac.uk or dsmdd4.ox.ac.uk.  See the TCPServerAddress field within your tsm4ve.opt file.
        Server port See the TCPPort field in tsm4ve.opt.
        Node access method Asnodename (Or Direct if you do not have a ***-DM.* node).
        Authentication node The data mover name.  This is the NodeName setting in tsm4ve.opt.
        Password The password for the authentication node.
        Target Node (If present) The Spectrum Protect for VE target node.  This is the AsNodeName setting in tsm4ve.opt (this field won't be present if direct access method is being used).


      3. Within Select snapshot, choose the relevant backup by selecting the Virtual machine, Snapshot and Disk.

      4. Click Mount.

      5. Choose Mount as an iSCSI target, set a unique (on the data mover) iSCSI target name and the appropriate iSCSI initiator name which corresponds to the virtual machine that will connect to this iSCSI target.  Then OK.

        Note that:

        • port 3260 must be open between the computer and the initiator on any firewall.

        • the iSCSI initiator name can be obtained from the client virtual machine; for example, on a Windows VM, it can be obtained from the "iSCSI Initiator" configuration.

      6. The iSCSI target will now be listed in the Mounted Volumes list.  Configure the iSCSI initiator on the appropriate VM to mount the target as read-only and copy the required files to the VM using standard operating system tools.  This will vary for each operating system.

      7. When the iSCSI target is not needed any longer, unmount it and disconnect the iSCSI initiator from the target.  Select the target in the Recovery Agent and click Dismount.

      8. Select Close to exit the Recovery Agent.

      Although the above procedure was run on the Spectrum Protect for VE data mover it is possible to install the recovery agent on a VM to perform local mounts.  Contact the Service Desk via hfs@ox.ac.uk if you wish to do this.

      Get support

      Local IT support provide your first line of on-the-spot help



      Common requests and fault reports can be logged using self-service

         USE IT SELF-SERVICE    

         LOG A SUPPORT CALL    


      The central Service Desk is available 24x7 on +44 1865 6 12345


      If you do not have an SSO account you can use this form to contact the Service Desk