IT Services

TSM for Virtual Environments


1. Introduction

TSM for Virtual Environments ("TSM for VE") is a new HFS service for backing up Virtual Machines that are running in a VMware vSphere infrastructure.

Features of TSM for VE include:

The Service Level Description is available here.

2. Prerequisites

2.1. A suitable "proxy" machine

This can be installed on the vSphere infrastructure that you are planning to back up. The machine needs to be running Windows 7 or 2008R2 and will need at least 2 GB of RAM. You will also need to have version 4 of the .NET Framework installed to run the installer. A suitable version is included in the TSM for VE distribution package.

2.2. Firewall configuration

When setting up TSM for VE on a proxy machine, several ports are used for communication between the proxy machine and the vCenter server or vice-versa. These ports need to be open in any host-based or dedicated firewall between the two machines and are listed in Table 1. Firewall configuration for TSM for VE.

Table 1. Firewall configuration for TSM for VE
Source host Destination port Destination host Use Required?
Proxy machine 443 vCenter server Communication between the proxy machine and the vCenter server. Yes
Proxy machine 902 vCenter server Used for NBD (Network Block Disk) transport. If proxy machine is not a VM.
vCenter server 1527 Proxy Machine Used for the vCenter plugin. Required if installing vCenter plugin. If installing vCenter plugin.
VMs 3260 Proxy Machine Default iSCSI port. If using iSCSI file-level restore.
Proxy machine 3400 TSM backup traffic Yes
vCenter server 9080 Proxy Machine Used for the vCenter plugin. If installing vCenter plugin.

2.3. vCenter server and backup user

TSM for VE communicates with a vCenter server to perform VM backups. The user required for this needs some elevated privileges but does not need to be a full administrator. It is recommended that you set up a new vCenter user specifically for TSM backup and restore. To add a new role suitable for backup and restore operations, perform the following steps:

  1. Log into the vCenter server with the vSphere client.

  2. Navigate to [Home] > [Roles] and click Add Role.

  3. The Add New Role dialogue box is displayed:

    Figure /hfs/help/images/tsm4ve-vCenterAddNewRoleDialog.png [Screenshot of the vCenter Add New Role dialogue box.]

  4. Choose a name for the new role, e.g. "HFS Backup".

  5. Add the following permissions to the role:

    Allocate space
    Browse datastore
    Low level file operations
    Host > Configuration
    Storage partition configuration
    Assign Network
    Assign virtual machine to resource pool
    Migrate powered off virtual machine
    Migrate powered on virtual machine
    Add virtual machine
    Assign resource pool
    Virtual machine > Guest Operations
    [Only if you are using the Data Protection for VMware feature to protect Microsoft Exchange Server or Microsoft SQL Server applications that run inside virtual machine guests. This is only available with vSphere 5. Contact the HFS team if you would like to use this.]
    Guest Operation Modifications
    Guest Operation Program Execution
    Guest Operation Queries (vSphere 5)
    Virtual machine > configuration
    Add existing disk
    Add new disk
    Add or Remove device
    Change CPU count
    Change resource
    Disk change tracking
    Disk Lease
    Host USB device
    Modify device setting
    Raw device
    Reload from path
    Remove disk
    Reset guest information
    Swapfile placement
    Upgrade virtual hardware / Upgrade virtual machine compatibility
    Virtual machine > Interaction
    Power On
    Power Off
    Virtual machine > Inventory
    Create new
    Virtual machine > Provisioning
    Allow disk access
    Allow read-only disk access
    Allow virtual machine download
    Virtual machine > State (vSphere 4 only)
    Create snapshot
    Remove snapshot
    Rename snapshot
    Revert to snapshot
    Virtual machine > Snapshot management (vSphere 5 only)
    Create snapshot
    Remove snapshot
    Rename snapshot
    Revert to snapshot
  6. Create a new user in your vSphere infrastructure. How you do this depends on your local authentication setup.

  7. Navigate to [Home] > [Inventory] > [VMs and Templates].

  8. Right-click on the vCenter server in the list on the left and choose Add Permission.... The Assign Permission dialogue box is displayed:

    Figure /hfs/help/images/tsm4ve-vCenterAssignPermissionsDialog.png [Screenshot of the vCenter Assign Permissions dialogue box]

  9. Click Add.... The Select Users and Groups dialogue is displayed:

    Figure /hfs/help/images/tsm4ve-vCenterSelectUsersAndGroups.png [Screenshot of the vCenter Select Users and Groups dialogue box]

  10. Choose the newly created user from the list and click Add. Click OK.

  11. Choose the HFS backup role created earlier from the Assigned Role drop down in the Assign Permissions dialogue box.

  12. Ensure Propagate to Child Objects is checked and click OK.

  13. You can check that the permission has been assigned correctly by choosing the vCenter server from the navigation pane and then choosing the Permissions tab. You should see the new permission listed.

3. Installation

  1. Extract the supplied zip file to a suitable location. You will need about 1.5 GB of disk space for the extracted files and substantially more for the installed files.

  2. Navigate to the directory containing the extracted files and run TSM for VE installer.exe.

  3. Fill in the requested information in the form that is displayed:

    Figure /hfs/help/images/tsm4ve-WinWelcomeScreen.png [Screenshot of the TSM for VE installer screen]

    If you wish to install the vCenter server plugin, you should check the box for that option and provide details of an administrative account on the vCenter server. This account is only used to register the TSM for Virtual Environments vCenter plugin. Hovering over each item on the form will give more information on that item. Help takes you to this page.

  4. Once you have filled in the information, click Install. The installer does several things:

    • Installs or updates the TSM client if required.
    • Installs TSM for Virtual Environments.
    • Configures the above for use.
  5. The installer will take some time to complete. Once it is, you will see a message reminding you of the required firewall holes.

  6. If a reboot is required, the installer will ask you if you want to reboot now or later.

4. Configuration

We have tried to choose reasonable defaults in the configuration file (C:\Program Files\Tivoli\TSM\baclient\dsm.opt). However, there are some configuration options that you may want to adjust to suit your setup. In particular, these are:


This sets the list of VMs that you want to back up. If the proxy machine is a VM on the vCenter server, you should not back it up via itself so add its name to the -VM part of DOMAIN.VMFULL. To exclude virtual machines vm1, vm2 and vm3 from the backups, give them as the value for -VM, separated by commas:

DOMAIN.VMFULL  all-vm;-VM=vm1,vm2,vm3

Note that if the VM name contains spaces, it should not be surrounded by quotes. There should also be no spaces between VM names and the commas. This applies to all DOMAIN.VMFULL options.

To specify explicitly the VMs to backup, use the VM option. For example to backup vm1, vm2 and vm3, use:

DOMAIN.VMFULL vm=vm1,vm2,vm3

VMs can also be specified by vCenter folder, host, host cluster and datastore. To backup specific folders, use:

DOMAIN.VMFULL  vmfolder=folder1,folder2,folder3

To backup specific ESX/ESXi hosts, use:

DOMAIN.VMFULL  vmhost=host1,host2,host3

To backup specific host clusters, use:

DOMAIN.VMFULL  vmhostcluster=cluster1,cluster2,cluster3

To backup specific datastores, use:

DOMAIN.VMFULL  vmdatastore=datastore1,datastore2,datastore3


Maximum number of VM backups to perform in parallel per instance of the TSM client.


Maximum number of VM backups to perform in parallel per ESX or ESXi host.


Maximum number of VM backups to perform in parallel per datastore.

The limit options can be used to ensure that parallel VM backups do not put too much load on any one part of your infrastructure. If you have one ESX/ESXi host and one datastore then all the limits on parallel backups should be equal.

5. Backup virtual machines

5.1. Using the TSM client GUI

  1. Launch the TSM client GUI on the proxy machine.

  2. Choose [Actions] > [Backup VM]. The Backup Virtual Machine window is displayed.

  3. Expand the Virtual Machines item. This displays the ESX/ESXi hosts in the navigation pane. Expand or click on the ESX/ESXi hosts:

    Figure /hfs/help/images/tsm4ve-GUIbackupVM.png [Screenshot showing the TSM client GUI Backup Virtual Machine window.]

  4. Select virtual machines to backup. Choose Incremental Forever - Incremental from the drop down box at the top of the window and click Backup.

  5. The task list window displays the progress:

    Figure /hfs/help/images/tsm4ve-GUItaskList.png [Screenshot of the Backup Virtual Machine task list window.]

  6. For detailed information, click Report:

    Figure /hfs/help/images/tsm4ve-GUIbackupReport.png [Backup Virtual Machine detailed report.]

5.2. Using the TSM command line

To back up all virtual machines specified in the DOMAIN.VMFULL option, start the TSM command line client and run:

tsm> backup vm -mode=IFincr

To back up a specific VM, run:

tsm> backup vm 'vmname' -mode=IFincr

6. Restore virtual machines

6.1. Using the TSM client GUI

  1. Launch the TSM GUI client on the proxy machine.

  2. Choose [Actions] > [Restore VM]. The Restore Virtual Machine window is displayed:

    Figure /hfs/help/images/tsm4ve-GUIrestoreVM.png [Restore Virtual Machine window.]

  3. Choose a VM in the navigation pane. All the available backups of the VM are displayed. Choose a backup and click Restore.

  4. The Restore Destination window is displayed. If you wish to restore to the original location, you need to make sure that there is not a VM with the same name in that location. If you are restoring to a new location, specify as much of the information as necessary. If you specify only a new name the VM will be restored to the original location with the new name

    Figure /hfs/help/images/tsm4ve-GUIrestoreSelectLocation.png [Restore Destination window.]

  5. Click Restore to start the restore.

6.2. Using the TSM command line

7. Restore individual files

Restoring individual files is achieved by using the Data Protection for VMware Recovery Agent. Launch the Recovery Agent from [Start] > [All Programs] > [Tivoli Storage Manager] > [Data Protection for VMware] > [Data Protection for VMware Recovery Agent]:

Figure /hfs/help/images/tsm4ve-recoveryAgentHome.png [Recovery Agent main window.]

7.1. Using iSCSI

The most flexible way to restore individual files is by using the Recovery Agent to export a backup as an iSCSI target that the iSCSI initiator on a virtual machine can then mount.

  1. Select [New Tivoli Storage Manager server...] from the Tivoli Storage Manager server drop-down.

  2. Set the following:
    Server address:
    Server port:
    Node access method:
    Authentication node:
    The proxy node name. This is the NodeNmae setting in dsm.opt.
    The password for the authentication node.
    Target Node:
    The TSM for VE target node. This is the AsNodeNmae setting in dsm.opt.

    Figure /hfs/help/images/tsm4ve-recoveryAgentNewServerDialog.png [Recovery new server dialogue.]

    Click OK.

  3. Choose the relevant backup by selecting a Virtual machine, Snapshot and Disk under Select snapshot:

    Figure /hfs/help/images/tsm4ve-recoveryAgentVMselected.png [Recovery Agent select backup.]

    Click Mount.

  4. The Select mount destination dialogue is displayed:

    Figure /hfs/help/images/tsm4ve-recoveryAgentMountDialogISCSImount.png [Recovery Agent select mount destination dialogue (iSCSI).]

    Choose Mount as an iSCSI target and set a unique (on the proxy machine) iSCSI target name and set the appropriate iSCSI initiator name that corresponds to the virtual machine that will connect to this iSCSI target. Note that port 3260 must be open between the

    Click OK.

  5. The iSCSI target will now be listed in the Mounted Volumes list in the Recovery Agent. Configure the iSCSI initiator on the appropriate VM to mount the target read-only and copy the required files to the VM using standard operating system tools. How to do this is beyond the scope of these instructions as it varies for each operating system.

  6. When the iSCSI target is not needed any longer, unmount it and disconnect the iSCSI initiator from the target. Select the target in the Recovery Agent and click Dismount.

  7. Exit the Recovery Agent by clicking Close.

7.2. Using a Windows mount

You can mount an NTFS backup as a drive letter or in an empty NTFS folder.

  1. Follow the steps for setting up iSCSI until you reach the Select mount destination dialogue.

  2. Select Create virtual volume from selected partition.

  3. Select a partition to mount. You should also select Show only mountable partitions and Mount virtual volume as read only.

  4. Choose either a drive letter or NTFS folder for the partition.

    Figure /hfs/help/images/tsm4ve-recoveryAgentMountDialogLocalMount.png [Recovery Agent select mount destination dialogue (local mount).]

    Click OK.

  5. The volume appears in the Mounted Volumes list of the Recovery Agent. Use normal Windows tools to copy files from the mounted volume. When finished, select the volume in the Recovery Agent and click Dismount.
  6. Close the Recovery Agent.

Although the above procedure was run on the TSM for VE proxy machine it is possible to install the recovery agent on a VM to perform local mounts. Contact the HFS team if you wish to do this.