EduLMS / Running it

Backups you have never restored are not backups

The test is not whether the job runs. It is whether the file opens.

Every administrator knows they should test restores and most do not, because the backup job reports success and a restore test costs an afternoon nobody has budgeted. The gap between those two facts is where organisations lose years of records. A backup process that runs nightly and produces a file is not evidence of anything except that a process ran and produced a file.

The failures are rarely dramatic. A course grows past a size limit and the backup silently truncates. A storage path fills and the newest file is written as zero bytes while the job still exits cleanly. A version upgrade changes the format and the archive from before the upgrade can no longer be read by the software that would need to read it. Each of these is invisible until the day somebody asks for something from two years ago.

A modest discipline covers most of it. Once a quarter, take one backup at random, restore it somewhere that is not production, and open something inside it. Not the whole system, one course. If the course opens and the assessment submissions are inside it, the process is probably sound. If it does not, you have found out on an ordinary Tuesday instead of during an audit.

Write down what you did and when. The record of a successful restore test is itself worth having, both because it tells the next administrator that the process was verified and because it is the kind of evidence that answers a question convincingly rather than reassuringly.

It is worth adding that the restore test has a second and less obvious benefit. It forces you to find out where restores actually happen, which turns out to be a question with a surprising number of dependencies: available disk, a spare environment, the version of the software that can read the archive, and somebody's permission. Discovering that any of those is missing during a routine test costs an afternoon. Discovering it during an incident, when a course has been deleted and somebody is waiting, costs considerably more than that, and the discovery is made in front of an audience.