This part sets a file based backup for each vCenter Server and confirms the NSX Manager backup that SDDC Manager already drives. Every fleet runs it once, then monitors it. It depends on the shared SFTP target from Part 8 and administrative access to each vCenter and to VCF Operations.
- Prerequisites: the shared SFTP target from Part 8, port 22 open, a backup service account, and the encryption passphrase stored in your vault.
- vCenter file based backup is set per instance in the vCenter appliance management interface at port 5480, under Backup.
- SDDC Manager configures NSX Manager backup during bring up and drives it on a default hourly cadence.
- Recommended cadence: vCenter daily, aligned with SDDC Manager inside a 5 minute window, and NSX Manager hourly.
- Setting the SFTP target belongs to Part 8, and restoring any of these components belongs to Part 10.
- Verify vCenter under Activity in the appliance interface, and NSX Manager under System, Backup and Restore.
In VCF 9.1, VCF Operations owns the fleet backup configuration for SDDC Manager and the management services, which you set up in Part 8 of this series. vCenter Server and NSX Manager sit one layer below that, and each has its own backup path. vCenter takes a file based backup that you schedule from its own appliance management interface, and NSX Manager takes a file based backup that SDDC Manager configures and runs for you. This part walks both paths, so every management component in a workload domain keeps a current, encrypted copy on your SFTP target. Restoring any of these components is covered in Part 10 of this series, and the SFTP target itself is defined in Part 8, so you reuse it here rather than creating a new one.
You need administrative access to each vCenter appliance, the Administrator role in VCF Operations, and access to the NSX Manager user interface. Reuse the shared SFTP host, service account and encryption passphrase from Part 8 so every job writes to one place. Keep that passphrase in your vault, because a restore asks for it again. Credential and password handling for VCF is covered in Part 6, and for the operating model behind fleet ownership, see the series overview.
Plan vCenter and NSX Manager backups
Decide two things before you touch a console: which SFTP directory each component writes to, and when each job runs. Point vCenter and NSX Manager at the same SFTP host you validated in Part 8, but give vCenter its own sub directory per instance so a restore never pulls the wrong appliance copy. A layout such as one folder for each vCenter, plus the SDDC Manager and NSX folders that bring up created, keeps the tree readable and lets one service account own it.
Match the cadence to your recovery goals. Run each vCenter file based backup daily and start it inside the same 5 minute window as the SDDC Manager job, so the copies line up at restore time. NSX Manager runs hourly, because its configuration changes far more often than vCenter inventory, and SDDC Manager applies that hourly interval automatically. Write these choices into the same runbook that records your SFTP host, account name, directory path and passphrase location, so a restore is a lookup rather than a guess.
Note who owns each schedule. You own the vCenter schedule directly, and you edit it in the vCenter appliance interface. SDDC Manager owns the NSX Manager schedule, and it resets that schedule whenever the SFTP settings change, so you confirm NSX backups rather than re creating them. Understanding that split keeps you from editing the NSX schedule in a place that SDDC Manager will overwrite.
Size the SFTP volume for the full retention window before you enable a daily vCenter job, because an encrypted vCenter backup can reach several gigabytes and seven copies for each instance add up quickly. Confirm the service account has write access to every vCenter sub directory and read access across the tree, so a later restore can browse each copy. A short test run against one vCenter proves the layout works before you repeat the schedule across the fleet.
Prerequisites
| Requirement | Detail | Where to confirm |
|---|---|---|
| Shared SFTP target | The server, port 22 and directory validated in Part 8 | SFTP server |
| Service account | Dedicated account, for example svc-vcf-bck, with write access to each folder | SFTP server |
| Encryption passphrase | The same passphrase used across the fleet, required again at restore | Password vault |
| vCenter root access | The local root account for each vCenter appliance | vCenter appliance |
| VCF Operations access | A user assigned the Administrator role | VCF Operations |
| NSX Manager access | An admin login to the NSX Manager user interface | NSX Manager |
Backup ownership in VCF 9.1 splits by component, so you set the vCenter schedule yourself and let SDDC Manager keep the NSX Manager schedule current. One validated SFTP target keeps every job consistent and makes restore predictable.
Step 1, Confirm the shared SFTP target and align backup windows
Start by confirming the SFTP host from Part 8 answers and offers its fingerprint, then decide the start times so vCenter and SDDC Manager align. Run these checks over SSH as the root user of the SDDC Manager appliance.
- SSH to the SDDC Manager appliance as the root user.
- Test the SFTP login with the service account, and enter the SFTP password when prompted.
- Confirm a Connected message appears, which shows the path is reachable.
- Confirm the server offers its SSH fingerprint on the configured port.
- Pick a vCenter start time inside the same 5 minute window as the SDDC Manager job, for example 04:00 AM.
sftp svc-vcf-bck@192.168.10.20 ssh-keygen -lf <(ssh-keyscan -t rsa -p 22 192.168.10.20 2>/dev/null)
A reachable target here means the vCenter and NSX jobs will land in the same place. If the login fails, fix routing and firewall rules before you configure any schedule, because a schedule that points at an unreachable host reports failure on its first run.
Step 2, Configure vCenter file based backup in the appliance interface
vCenter backup is not configured by VCF for you, so you set it per instance in the vCenter appliance management interface. Repeat this step for every vCenter in the fleet.
- Open a browser to https://<vcenter_fqdn>:5480 and log in as the appliance root user.
- In the left navigation, click Backup.
- Click Configure to set up a backup schedule.
- In Backup location, type the target as protocol, host, port and folder, for example sftp://192.168.10.20:22/backups/vcenter01.
- In Backup server credentials, type the account in User name and its password in Password.
- Under Schedule, select the recurrence and set the time, for example Daily at 04:00 AM.
- Enter the Encryption Password you keep in your vault, so the backup file is encrypted.
- For retention, choose to keep a set number of backups rather than Retain all backups, and enter 7.
- Optionally select Stats, Events, and Tasks to include that historical data in the backup.
- Click Create to save the schedule.
- To prove the target works, click Backup Now, choose Use backup location and user name from backup schedule, then click Start.
- Watch the Activity panel until the job reports Completed.
| Field | Value to enter |
|---|---|
| Backup location | sftp://192.168.10.20:22/backups/vcenter01 |
| User name | svc-vcf-bck |
| Schedule | Daily at 04:00 AM |
| Encrypt backup | Enabled, passphrase from your vault |
| Number of backups to retain | Keep 7, not Retain all backups |
Key based authentication is not offered for the SFTP protocol in this interface, so use the service account password. Record the encryption password with the rest of your backup runbook, because vCenter cannot restore an encrypted backup without it.
Repeat this step for each vCenter, giving every instance its own sub directory so the copies never collide. A consistent naming pattern, such as one folder for each vCenter short name, keeps the SFTP tree easy to read during an incident and lets a new operator find the right copy without guessing.
Step 3, Confirm and adjust NSX Manager backup from SDDC Manager
SDDC Manager configures the NSX Manager backup during bring up and points it at your SFTP target. You confirm it here rather than re creating it, because SDDC Manager owns the schedule.
- Log in to VCF Operations at https://<vcf_operations_fqdn> as a user assigned the Administrator role.
- Navigate to Home, Administration, then SDDC Manager.
- Select the VCF Instance whose NSX Manager you want to check.
- Click the Backup Settings tab.
- Confirm the Backup Server shows the same SFTP host, port and directory set in Part 8.
- Read the NSX Manager entry and confirm its last status and time.
- To change how often NSX Manager backs up, apply the documented backup interval property on SDDC Manager, because SDDC Manager resets this cadence whenever the SFTP settings change.
# SDDC Manager applies this NSX Manager backup interval, in seconds seconds.between.backup=3600
Leave the default hourly interval in place for most fleets. If you must change it, follow the Broadcom knowledge base article on updating the NSX Manager backup cadence, because editing the schedule inside NSX Manager alone does not survive the next SFTP configuration change.
Step 4, Review NSX Manager backup history in NSX Manager
Use the NSX Manager interface to read the backup history and confirm the hourly copies are succeeding against your SFTP target.
- Log in to the NSX Manager interface at https://<nsx_manager_fqdn> as an admin user.
- Click the System tab.
- In the left pane under Lifecycle Management, select Backup & Restore.
- Read the Backup History and confirm recent hourly backups show a status of Success.
- Confirm the SFTP Server shown matches the target from Part 8.
Do not edit the schedule on this screen for a VCF managed NSX Manager, because SDDC Manager overwrites it. Treat this view as read only confirmation that the hourly job is healthy.
Check this history on a regular cadence, not only after a change, because a silent SFTP outage can stop backups without an obvious signal elsewhere. If the most recent entries are missing or show a failure, return to the SDDC Manager Backup Settings and reconfirm the SFTP target before you investigate NSX Manager itself.
How to verify the backups
Confirm vCenter first. In the appliance interface at port 5480, open Backup and read the Activity panel, where the last run shows a status of Completed and a timestamp. Open the NSX Manager interface, go to System, Backup & Restore, and confirm the Backup History lists recent hourly successes. On the SFTP server, confirm that dated, encrypted backup files appear under each vCenter folder and under the NSX Manager folder, and that older files age out within the retention window. A Completed status in vCenter, a Success history in NSX Manager, and visible files on the SFTP target together confirm the configuration is complete. Rehearse a restore of one component on a schedule so you know the copies are usable, and follow the restore procedure in Part 10 of this series when you do.
Common errors and fixes
| Symptom | Cause | Fix |
|---|---|---|
| vCenter backup fails to start when scheduled | Backup manager exception or a stale scheduled job | Run Backup Now to confirm the target, then recreate the schedule and follow the Broadcom knowledge base article for the exception |
| vCenter backup location is rejected | Wrong protocol prefix, port or folder in the location string | Use the form sftp://host:22/folder and confirm the folder exists and is writable |
| NSX Manager backups stop after an SFTP change | SDDC Manager reset the cadence when the SFTP settings changed | Reconfirm Backup Settings in SDDC Manager and let SDDC Manager reapply the hourly interval |
| Backups exist but a restore is refused | Encryption passphrase lost or mistyped | Store the passphrase in your vault and confirm it before the next scheduled run |
Common questions
Does VCF configure vCenter backup automatically?
No. SDDC Manager configures NSX Manager during bring up, but you set each vCenter file based backup yourself in the appliance interface at port 5480.
How often should vCenter and NSX Manager back up?
Run vCenter daily and align it with the SDDC Manager job inside a 5 minute window, and leave NSX Manager on the default hourly interval that SDDC Manager applies.
Can I change the NSX Manager backup schedule directly?
Not durably. SDDC Manager owns the schedule and resets it on any SFTP change, so apply the documented backup interval on SDDC Manager instead of editing NSX Manager alone.
Where does the restore procedure live?
Restoring vCenter, NSX Manager and SDDC Manager is covered in Part 10 of this series, which keeps restore steps out of this backup part.
References
- Broadcom TechDocs, File Based Backups for SDDC Manager NSX Manager and vCenter
- Broadcom Knowledge Base, Update Backup Cadence for NSX Manager from SDDC Manager
- Broadcom Knowledge Base, VAMI Backups on vCenter Fail or Do Not Start When Scheduled
- William Lam, Automating VCF Backup Scheduling with the Fleet LCM API
About The Author
