VMware ESXi backup, also with the free ESXi license

What you will set up

BackupZit backs up VMware ESXi virtual machines without installing anything on ESXi or inside the VMs. A BackupZit agent on any machine in the network works as the host's proxy: it takes snapshots, reads only the changed blocks of the virtual disks and writes them to your storage. A web console schedules the jobs, keeps the history and runs the restores. BackupZit is free and open source (AGPLv3), with no limit on hosts or VMs.

• What you need
• The free ESXi license
• 1. Console
• 2. Storage
• 3. Proxy agent
• 4. ESXi host or vCenter
• 5. Backup job
• 6. Consistent backups
• 7. Off-site copy
• Restoring
• Limits

What you need

• ESXi 6.7, 7 or 8 connected directly, or vCenter Server 7 or 8 with its ESXi hosts.
• A user with administrator rights: usually root on a host; on vCenter administrator@vsphere.local or a user with the Administrator role.
• A place for the BackupZit console: a small Linux VM with 2 vCPU, 2–4 GB RAM and a 16–20 GB disk. It stores no backup data itself.
• A proxy agent: any Windows or Linux machine with the BackupZit agent that reaches the host on port 443 (and 22 when SSH is used).
• Backup storage outside the host — for example a Linux server or NAS over SFTP, an SMB share, an S3-compatible bucket or a BackupZit hardened repository.
• Network: the agent reaches the console on TCP port 8443.

What changes with the free ESXi license

The free license works, with three things to prepare:

• Enable SSH on the host: in the ESXi Host Client, Host → Actions → Services → Enable Secure Shell. Licensed hosts and vCenter need no SSH.
• Changed block tracking (CBT) can only be switched on while the VM is turned off. BackupZit does it at the first backup that finds the VM off; until then every backup reads the whole disks and the run shows a warning. Shut each VM down once, for example in a maintenance window, and let a backup run.
• Free datastore space: while a running VM is backed up, its disks are copied thin on its datastore, so the datastore needs as much free space as the disks actually use.

A host that gets a license later switches to the vSphere API without further setup.

Step 1 — Install the console

The quickest way on ESXi is the ready-made VM image backupzit-appliance.ova from the download page (Debian, PostgreSQL and the console, already set up, with VMware Tools):

1. In the ESXi Host Client choose Create / Register VM → Deploy a virtual machine from an OVF or OVA file and select the OVA. On vCenter use Deploy OVF Template. Give the VM 2 vCPU and 2–4 GB RAM.
2. Start the VM. Its screen shows the address of the web console and the initial password of the user admin. Open https://<address>:8443, sign in and change the password.

On the VM's screen, bzadmin can set a static address and the time zone (schedules run in the console's time zone). On an existing Linux server, use the install script from the download page instead.

Step 2 — Add a storage target

In the console open Storage and add a target. Typical choices for VM backups:

Leave Encrypt backups (AES-256) on (the default). The console then shows a Recovery key — print the recovery sheet or put the key in a password manager, away from the backups. With the key, the storage location and its credentials you can restore even if the console is lost.

Step 3 — Install the proxy agent

The backup data flows through the proxy agent, so put it on a fast network close to the ESXi host and the storage. Prefer Linux: only a Linux proxy can run instant recovery.

1. In the console open Agents and click Create enrollment token. You get an enrollment code (BZ1-…) that is valid for 7 days.
2. Download the agent package from the Agents page. On Debian or Ubuntu:

   apt install ./backupzit-agent_*.deb
   backupzit-agent enroll --code "BZ1-..."
   systemctl enable --now backupzit-agent

   On Windows, run the agent MSI and paste the code. The console can also install the agent itself: Agents → Install on a machine from here.

Step 4 — Add the ESXi host or vCenter

Open Agents, section VMware ESXi hosts, fill in Add an ESXi host or vCenter Server — Address, User, Password and the Proxy agent — and click Add ESXi host or vCenter. The console connects once, reads the VM list and the license, and pins the host's HTTPS certificate and SSH host key: if another machine later answers at the same address, BackupZit refuses to connect instead of sending it the password. The password is stored encrypted.

The column Mode shows how the host is handled:

• vSphere API (licensed host, SSH not needed) — snapshots, disk copies, restores and instant recovery go through the API.
• free license: snapshots and restores over SSH — the API is read-only, so these steps go over SSH.

How the host is changed is Automatic by default and can be forced to Always SSH or Always vSphere API. If the host's certificate changes for a reason you know — reinstalled, new certificate, added to vCenter — click Accept the new certificate after comparing the fingerprint with the host.

With vCenter Server

Add the vCenter like a host. BackupZit then sees the VMs of all ESXi hosts and clusters of the datacenter through this one connection; nothing is changed over SSH. A VM moved with vMotion keeps being backed up, because VMs are recognised by their instance UUID, not by their host. Do not add the same ESXi host both directly and through vCenter, or its VMs are backed up twice.

Step 5 — Create the backup job

1. Open Backup jobs, create a job and select the ESXi host — it is listed under VMware ESXi hosts in the agent list.
2. Choose Virtual machines (Proxmox VE, Hyper-V, VMware), then All VMs (and containers) on the host — VMs created later are included automatically — or tick individual VMs.
3. Pick the storage target from step 2 and set the Schedule, for example every working day at 22:00.
4. Set Keep backups. Example: 3 most recent, 7 daily, 4 weekly, 6 monthly keeps about half a year of history with around 20 restore points.

The job runs on the host's proxy agent. What happens in each run:

1. Changed block tracking is switched on for the VM if it is off — automatically on licensed hosts, on free hosts at the first backup that finds the VM turned off.
2. A snapshot backupzit_… is taken, quiesced when VMware Tools run in the guest (see step 6).
3. CBT reports which blocks to read: for the first backup only the blocks in use, after that only the blocks changed since the previous backup.
4. A running VM keeps its disks locked, so they are copied thin on the datastore and the snapshot is removed right away, usually after seconds. The proxy reads the copy over HTTPS and deletes it. VMs that are turned off are read directly.
5. The VM's configuration (.vmx) and NVRAM are stored with the backup.

An example from the BackupZit test lab: a Debian VM with an 8 GB disk, 1.6 GB of it in use. The first backup read 1.6 GB. The next one, after 50 MB of new data, read 70 MB and took 23 seconds.

Step 6 — Make the backups application consistent

When VMware Tools run in the guest, the snapshot is quiesced: applications and file systems are flushed first, which makes the backup application-consistent. Without VMware Tools it is crash-consistent — like after a power loss. Install open-vm-tools in Linux VMs and VMware Tools in Windows VMs.

Step 7 — Keep an off-site copy (3-2-1)

The 3-2-1 rule: three copies of your data, on two different media, one of them off-site. Add a second job of the kind Backup copy, select the VMware job as its source and an off-site target, such as an S3 bucket with Object Lock or a hardened repository in another building.

• The agent copies the existing backups; the VMs are not read again.
• By default the copy runs after each backup of the source job, with its own retention — e.g. 7 daily on the NAS and 12 monthly in the cloud.

Whole VMs and single files can be restored from the copy like from the original. Under Settings → Restore tests, automatic restore tests (weekly by default) and Check the stored data (monthly by default) verify the backups. More about immutable copies on the ransomware protection features.

Restoring

Open a backup run (from the job page or Activity) and choose Restore a VMware VM, or use the Restore wizard with Whole virtual machine. Choose the target under Restore on ESXi host (with vCenter also the ESXi host that runs the VM) and, if needed, another Datastore.

As a new VM next to the original

Creates a copy with a new name, UUID and MAC addresses; by default the original's name plus -restored- and the date. Guest network settings tied to the old MAC addresses, such as netplan's match: macaddress in cloud images, do not apply to the copy.

In place of the original VM

Tick turn it off and replace its disks. BackupZit turns the VM off, deletes its snapshots, renames the current disks to ….replaced-DATE.vmdk (delete them once the restored VM works) and writes the backup into new disks with the original names. The VM keeps its UUID, network adapters and MAC addresses. A deleted VM is recreated with its original identity.

Disks are restored thin, and only blocks with data are written — through the vSphere API on licensed hosts and vCenter, over SSH on the free license. Optionally tick Start the VM after the restore. ISO images connected to CD/DVD drives are not part of the backup.

Instant recovery

With Instantly, running from the backup a VM starts within seconds. The Linux proxy agent serves its disks straight from the backup over NFS; the host mounts them as the datastore backupzit-<agent>. Changes are kept on the agent; the backup itself is never changed. When the VM works as it should, on the run's page:

• Finish moves it to a datastore — on vCenter with Storage vMotion while it keeps running; on a standalone host with a short shutdown while its disks are copied (with vmkfstools over SSH on the free license).
• Discard VM stops and deletes it with all its changes.

Open ports 2049 and 111 from the ESXi host to the agent if a firewall is in between.

Single files

Browse files on the backup's page (or Files from a virtual machine in the restore wizard) opens the VM's disks. You can browse NTFS, ext2/3/4 and XFS, also on LVM, and download files or restore them to any agent.

Limits to know

• A vCenter with several datacenters cannot be added yet; add the hosts of the other datacenters directly.
• VMs with snapshots of their own are not backed up: delete or consolidate the snapshots first.
• Raw device mappings (RDM) and independent disks are not backed up.
• Instant recovery needs a Linux proxy agent.

Next steps

Download BackupZit, see all VMware features, or read the full chapter VMware ESXi virtual machines in the user guide in the console. Running Proxmox or Hyper-V too? See the Proxmox VM backup guide and the Hyper-V backup guide. Questions are welcome in GitHub Discussions; companies can get commercial support from MaxZit.