Exchange online streaming backups…

In Exchange 2003 and revisions prior the most common backup taken of an Exchange server leveraged the ESE Online Streaming APIs.  The use of ESE Online Streaming APIs carried forward into Exchange 2007 as customers migrated backup solutions to utilize the more common Volume Shadow Services method of backup for Exchange.  Exchange 2010 has fully deprecated the ESE Online Streaming APIs in favor of Volume Shadow Services.

A ESE Online Streaming backup occurs through three methods:

1)  Local shared memory.

2)  Remote TCP

3)  Remote RPC

Customers utilizing Windows 2003 / Exchange 2003 and Windows 2003 / Exchange 2007 can fully utilize any of the backup methods supported by NTBackup or a third party backup vendor.  Customers utilizing Windows 2008 / Exchange 2007 will not be able to take advantage of either Remote TCP or Remote RPC backups.  In other words, remote backups utilizing the online streaming API where the operating system is Windows 2008, regardless of what operating system the backup session initiates on or from, are explicitly not supported. 

The following are references to the support statements regarding remote streaming backups and Windows 2008:

https://msexchangeteam.com/archive/2008/03/05/448338.aspx

https://technet.microsoft.com/en-us/library/aa998870(EXCHG.80).aspx

Note:

Remote streaming backups or restores are not supported on or from Windows Server 2008.

Questions have recently been raised – how can I determine if my backup application is attempting to utilize a remote streaming backup against Windows 2008?

By default administrators attempting to utilize NTBackup from a Windows 2003 server or other workstation supporting NTBackup will always utilize a remote backup interface to the Exchange Server installation on Windows 2008.  The most common remote backup interface is TCP with failback to RPC should TCP not function.  For third parties this is dependent on the product installed.

The type of backup that is being performed will cause an event to be logged in the application log.  The following are sample events that occur when a REMOTE backup operation is being performed against an Exchange installation:

Time: 11/2/2009 12:26:02 PM
ID: 908
Level: Information
Provider: ESE BACKUP
Machine: <SERVER>
Message: Information Store (4816) Backup data transfer method is TCP/IP.

Event ID : 909
Raw Event ID : 909
Record Nr. : 277957
Category : Backup
Source : ESE BACKUP
Type : Information
Generated : 1/7/2009 12:42:04 AM
Written : 1/7/2009 12:42:04 AM
Machine : <SERVER>
Message : Information Store (4908) Backup data transfer method is RPC.

If either of these events are logged on the Windows 2008 server the type of backup that is being performed is NOT SUPPORT (regardless of the overall success or failure of the backup).  Unfortunately there are no supported workarounds to restore this functionality.

For customers utilizing Windows 2008 and desiring to retain an ESE Online Streaming API backup the only option for Exchange 2007 is the use of a third party product.  By default Windows 2008 does not include a backup technology capable of leveraging the ESE Online Streaming API.  Later revisions of Exchange 2007 introduced extensions to Windows Server Backup allowing Volume Shadow Services backups of Exchange 2007 to occur.  It is also not supported to port NTBackup from Windows 2003 to Windows 2008 for the purposes of Exchange ESE Online Streaming API backups.

Third party backup vendors leveraging the ESE Online Streaming API are able to do so by implementing a Local Shared Memory backup.  This is most commonly archived by installing a backup agent on the Windows 2008 server.  In these instances the backup server contacts the local backup agent.  The local backup agent establishes a local ESE Online Streaming API backup session.  The data is then read from the Information Store by the backup agent, where it is subsequently transmitted to the backup server. 

When a local shared memory backup is occurring the following event may be noted in the application log:

Event ID : 907
Raw Event ID : 907
Record Nr. : 24708
Category : Backup
Source : ESE BACKUP
Type : Information
Generated : 8/29/2007 12:20:36 AM
Written : 8/29/2007 12:20:36 AM
Machine : <SERVER>
Message : Information Store (3324) Backup data transfer method is shared memory (64kb).

To try to help clarify here is a sample chart that may assist:

Customer are encouraged to evaluate backup methods that leverage the VSS Exchange aware backup methods for Exchange 2007 and Exchange 2010.