This part configures scheduled, encrypted file based backups for SDDC Manager and the VCF management services that VCF Operations owns. Every fleet runs it once, then monitors it. It depends on a reachable SFTP target and Administrator access to VCF Operations.
- Prerequisites: an SFTP server on the management network, port 22 open, a service account, and an encryption passphrase stored safely.
- SDDC Manager backup is set in VCF Operations under Home, Administration, SDDC Manager.
- VCF management services backups are set under Build, Lifecycle, VCF Management, Backup and Restore.
- Recommended cadence: SDDC Manager daily with 7 day retention, NSX Manager hourly, and SDDC Manager plus vCenter jobs aligned within a 5 minute window.
- vCenter and NSX Manager backup detail belongs to Part 9, and restoring these components belongs to Part 10.
- Verify each job with Backup Now and watch the VCF Operations Health dashboard.
In VCF 9.1, VCF Operations owns fleet lifecycle and the backup configuration for the management plane. You point the fleet at one SFTP repository, set a schedule per component, and let VCF Operations push that configuration to SDDC Manager and the VCF management services. This part covers the SFTP target, the SDDC Manager file based backup, and the VCF management services schedules. Backing up vCenter and NSX Manager is covered in Part 9 of this series, and restoring any of these components is covered in Part 10. For the operating model behind fleet ownership, see the series overview.
You need Administrator access to VCF Operations, a running SFTP server that the management appliances can reach on port 22, a dedicated service account on that server, and an encryption passphrase that you record in your password vault. Credential and password handling for VCF is covered in Part 6. A current backup is also a prerequisite for the upgrade path in Part 2, so treat this configuration as the foundation of every later operation.
Plan the backup targets and cadence
Decide the SFTP layout before you open VCF Operations. A single backup directory per VCF Instance keeps files easy to find and lets one service account own the whole tree. Give that account write access to the directory and read access to every sub directory below it, then size the volume for the full retention window across SDDC Manager, vCenter, NSX Manager and the management services. When several instances share one server, use a separate top level folder per instance so a restore never pulls the wrong copy.
Map the cadence to your recovery goals next. SDDC Manager runs daily and also on each state change, so a configuration change is captured within minutes rather than waiting for the nightly run. Fleet lifecycle, SDDC lifecycle, identity broker and Salt RaaS support incremental backups, which shorten each run and reduce load, while software depot, log management and VCF Automation take a full copy every time. NSX Manager runs hourly, and SDDC Manager plus vCenter share a 5 minute window so their copies line up. Write these choices down, because a schedule that matches your recovery point objective is easier to defend during an audit and faster to act on during a restore.
Record where each piece lives: the SFTP host, the account name, the directory path, and the location of the encryption passphrase. A short runbook of these four values turns a stressful restore into a routine task, and it keeps a new operator from guessing during an incident. Keep that runbook next to your pre installation checklist so both stay current as the fleet grows.
Prerequisites
| Requirement | Detail | Where to confirm |
|---|---|---|
| SFTP backup target | Reachable server on the management network, port 22 open, SFTP protocol | Network and firewall |
| Service account | Dedicated account, for example svc-vcf-bck, with write access to the backup directory | SFTP server |
| Backup directory | A path such as /backups/ where the account has read access to all sub directories | SFTP server |
| Encryption passphrase | A passphrase stored in your vault, required again during restore | Password vault |
| VCF Operations access | A user assigned the Administrator role | VCF Operations |
| Free space | Enough storage for all backups kept within the retention window | SFTP server |
Backup ownership in VCF 9.1 sits with VCF Operations, so you configure one SFTP location and reuse it across components. A single, validated target keeps every schedule consistent and makes restore predictable.
Step 1, Configure the SFTP backup target in VCF Operations
Set the SFTP location once. VCF Operations pushes it to VCF Automation and the VCF management services, and reuses it for automatic backups taken during patching and upgrades.
- Log in to VCF Operations at https://<vcf_operations_fqdn> as a user assigned the Administrator role.
- In the left navigation, open Build, then Lifecycle.
- In the Lifecycle navigation, select VCF Management.
- Select the Backup & Restore tab.
- Click Add Backup Location.
- In VCF Instance, select the target instance.
- In SFTP Host FQDN or IP Address, type the address of your SFTP server.
- In Port, type 22.
- In Username, type the service account, for example svc-vcf-bck.
- In Password, type the account password.
- In Backup Directory, type the path, for example /backups/.
- In Encryption Passphrase, type the passphrase you will store for restore.
- Click Add to fetch the fingerprint, click Confirm Fingerprint, then click Add to save.
- Watch the SFTP Status table below the settings, and click Refresh to confirm each component reports success.
| Field | Value to enter |
|---|---|
| SFTP Host FQDN or IP Address | Address of the SFTP server, for example 192.168.10.20 |
| Port | 22 |
| Username | svc-vcf-bck |
| Backup Directory | /backups/ |
| Encryption Passphrase | Stored in your vault, required at restore |
Validate the host, username and password before you save. Any incorrect value propagates to every component and causes the SFTP configuration to fail. If a component reports a failure, use Retry, then Refresh to recheck the status.
Step 2, Set the SDDC Manager backup schedule
SDDC Manager still runs domain level operations, so its configuration database must be captured on a fixed cadence. You set that schedule from the SDDC Manager administration area inside VCF Operations.
- In VCF Operations, navigate to Home, Administration, then SDDC Manager.
- Select the VCF Instance whose SDDC Manager you want to schedule.
- In the right pane, click the Backup Settings tab.
- Click SDDC Manager Configurations.
- Under Backup Schedule, click Edit.
- Set Automatic Backup to enabled.
- In Backup Frequency, select Weekly, then in Days of the Week select every day for a daily cadence.
- In Schedule Time, set a low activity time such as 04:02 AM.
- Enable Take Backup on State Change so a backup also runs after each change.
- In Retain Last Backups, type 7.
- In Retain Daily Backups for Days, type 7, and in Retain Hourly Backups for Days, type 1.
- Click Save.
- Click Backup Now to run one backup and confirm the schedule works.
| Setting | Value |
|---|---|
| Automatic Backup | Enabled |
| Backup Frequency | Weekly, all days selected |
| Schedule Time | 04:02 AM |
| Take Backup on State Change | Enabled |
| Retain Last Backups | 7 |
| Retain Daily Backups for Days | 7 |
Align this SDDC Manager job with the vCenter jobs so both start within the same 5 minute window. A shared window gives you a set of backups that are logically consistent with each other at restore time.
Step 3, Create backup schedules for the VCF management services
VCF management services include fleet lifecycle, SDDC lifecycle, identity broker, Salt RaaS, software depot, Salt master, log management, VCF Automation and VCF services runtime. You schedule these from the same Backup and Restore tab.
- In VCF Operations, open Build, then Lifecycle.
- Select VCF Management.
- Select the Backup & Restore tab.
- Click Create Schedule.
- Select the VCF Instance used to schedule backups for the management components.
- Choose the frequency: for Daily Schedule, pick the hour of the day, and for Weekly, pick the day and hour.
- Select and configure incremental backup for fleet lifecycle, SDDC lifecycle, identity broker or Salt RaaS if hourly backups are needed.
- Choose the retention policy for how many backups to keep.
- Click Next.
- Confirm the SFTP details match the target from Step 1, then click Save.
- Click Next to review, then click Create Schedule and monitor the Task panel.
- Repeat for each additional VCF Instance.
Only fleet lifecycle, SDDC lifecycle, identity broker and Salt RaaS support incremental backups. Software depot, Salt master, log management, VCF Automation and VCF services runtime follow a full backup schedule only, where each run captures the complete component configuration and data.
Step 4, Protect the VCF Operations appliance with an image based backup
VCF Operations holds the fleet backup configuration, so protect the appliance itself with an image based backup taken by a vendor backup product. That restore point lets you recover VCF Operations before you rebuild any component schedules.
- Confirm your image based backup product supports the VCF Operations appliance.
- In the backup product, add the VCF Operations virtual machine to a protection job.
- Quiesce the guest if the product supports it, then run a full image based backup.
- Record the restore point and the appliance FQDN so recovery is fast.
Keep the appliance image and the component file based backups on separate retention policies. Two independent copies protect you when one target is unavailable.
Step 5, Verify SFTP reachability from the appliance
When a job fails, confirm from the SDDC Manager appliance that the SFTP target answers and offers its fingerprint. Run these checks over SSH as the root user.
- SSH to the SDDC Manager appliance as the root user.
- Test the SFTP login with the service account, and enter the SFTP password when prompted.
- Confirm a Connected message appears, which indicates the path is reachable.
- Confirm the server offers its SSH fingerprint on the configured port.
sftp svc-vcf-bck@192.168.10.20 ssh-keygen -lf <(ssh-keyscan -t ssh-rsa -p 22 192.168.10.20 2>/dev/null)
How to verify the backups
Confirm the SDDC Manager job first. Open Home, Administration, SDDC Manager, select the instance, then read the last status and start time under Backup Settings. In Build, Lifecycle, VCF Management, Backup & Restore, confirm each schedule shows a recent successful run. Open the VCF Operations Health dashboard and check for backup failures. On the SFTP server, confirm that dated, encrypted backup files appear under the backup directory and that older files age out within the retention window. A green status in each place, plus visible files on the SFTP target, confirms the configuration is complete.
Common errors and fixes
| Symptom | Cause | Fix |
|---|---|---|
| SFTP configuration fails on save | Wrong host, username or password propagated to all components | Re-enter validated SFTP details, click Retry, then Refresh to recheck status |
| Fingerprint prompt does not appear | SFTP server not reachable on port 22 | Confirm firewall and routing, then test with sftp and ssh-keyscan from the appliance |
| SDDC Manager backup fails with a large file error | Unexpected large files in /opt/vmware/vcf | Remove files you added to that directory, and never store data there |
| Backups drift out of sync | SDDC Manager and vCenter jobs not aligned | Set both to start within the same 5 minute window for a consistent restore point |
Common questions
How often should SDDC Manager back up?
Daily, with 7 day retention, plus a backup on each state change. That cadence keeps a recent, consistent copy without filling the SFTP target.
Why does the encryption passphrase matter so much?
It encrypts the backup data and is required again during restore. Store it in your vault, because a lost passphrase makes a backup unusable.
Can I automate these schedules instead of clicking through the UI?
Yes. VCF Operations exposes a Fleet LCM API that scripts backup scheduling for the management components, which is useful across many instances.
Does this part cover vCenter and NSX Manager?
No. vCenter and NSX Manager backup is covered in Part 9. NSX Manager is configured by SDDC Manager during bring up and runs hourly by default.
References
- Broadcom TechDocs, Back Up SDDC Manager
- Broadcom TechDocs, Configure SFTP Backup Location for VCF Automation and VCF Management Services
- Broadcom TechDocs, Configure Backup Schedules for VCF Automation and VCF Management Services
- Broadcom TechDocs, File Based Backups for SDDC Manager NSX Manager and vCenter
About The Author
