VM & Database Replication

One DR engine for every hypervisor and database you run.

NGBackup replicates virtual machines and databases with change-block delta transport, continuous log shipping and standby orchestration — then turns a disaster into a one-command failover. Planned, unplanned and sandbox test failover; failback and re-protect; near-zero RPO on continuous modes and seconds-to-minutes RTO. All under a single Director, one queue and one catalog.

5
Hypervisor platforms
10
Database engines
< 5 s
Best-case RPO (continuous log)
Seconds
Best-case RTO (pre-staged replica)
Architecture

How NGBackup replication works

Replication is a first-class job type in the Director (not a bolt-on script). The Director schedules cycles, the source plugin computes a delta and the DR receiver applies it — secured end-to-end and recorded in the catalog so every restore point and failover event is auditable.

Director-orchestrated

Dedicated Replicate and Failover job types run in their own scheduler lane with a separate concurrency budget, so DR cycles never starve backups (or vice-versa). State lives in catalog tables: replication pairs, restore points and failover events.

Delta-only transport

VM plugins push only changed blocks via native change tracking (CBT/RCT/QEMU dirty bitmaps) in a compact binary frame. Database plugins ship logs (WAL, binlog, archived redo, oplog). Seed once, then incrementals forever.

🛡 Secured & verified

Transport is mutual-TLS or a pre-shared key (ChaCha20-Poly1305 / AES-256-GCM). Bandwidth throttling, exponential-backoff retry, restore-point rotation and sample-block integrity checks are built in.

Source plugin Change tracking (CBT / RCT / bitmap / log) Delta / log stream Encrypted transport DR receiver (apply + snapshot) Failover-ready replica
RPO vs RTO, defined. RPO (Recovery Point Objective) is how much data you can lose — driven by replication interval or, for continuous modes, log-flush latency. RTO (Recovery Time Objective) is how fast you are back online — driven by whether the replica is pre-staged (seconds) or must be rebuilt from logs (minutes to hours).
Part 1 — Virtual Machines

VM replication & failover

Veeam-style image replication for five hypervisor platforms. Agentless — driven entirely through the hypervisor API. A first full seed establishes the replica; every cycle after that ships only changed blocks. The replica is provisioned and ready, so failover is a power-on, not a restore.

Synchronous delta-push (CBT / RCT)

NGBackup's own engine. The source plugin quiesces the VM (VSS / guest-tools / QEMU guest agent for application consistency), asks the hypervisor "which blocks changed since last cycle?", and streams just those blocks to the DR receiver, which applies them and takes a restore-point snapshot. Interval-driven — typically 5–15 minute RPO.

vSphere · VADP CBT Hyper-V · RCT + AVHDX Proxmox · QEMU dirty-bitmap Nutanix · Prism CBT CloudStack · QEMU bitmap + hash dedup

Native async orchestration (Hyper-V Replica)

On Hyper-V, NGBackup can instead drive the hypervisor's own built-in replication (Hyper-V Replica) — enabling it, seeding it and reporting health — while Hyper-V handles transport. Useful where you want Microsoft's native engine with NGBackup as the single control plane. Native RPO is configurable down to 30 seconds.

CloudStack adds 3-layer change detection: QEMU dirty bitmap → xxHash64 block verification (kills false positives) → SIMD zero-block elimination (thin-provisioning win). Result: ~95% replication-bandwidth reduction vs. full copy.

Platform capability matrix

Platform Change tracking Replication modes RPO (best) RTO (best) Failover set Instant recovery Maturity
VMware vSphere VADP + CBT (agentless) CBT delta-push + seed 5–15 min Seconds Planned · Unplanned · Test · Undo · Permanent · Failback · Re-protect File-level restore GA
Microsoft Hyper-V RCT + AVHDX differencing RCT delta-push + Hyper-V Replica (native async) 5 min (RCT) · 30 s (native) Seconds Planned · Unplanned · Test · Undo · Permanent · Failback · Re-protect iSCSI live-boot GA
Proxmox VE QEMU dirty-bitmap (NBD) Bitmap delta-push + seed 5–15 min Seconds Planned · Unplanned · Test · Undo · Permanent · Failback · Re-protect Roadmap (SD plugin) GA
Nutanix AHV Prism CBT (changed-regions) Bitmap delta-push + seed Minutes Seconds Planned · Unplanned · Test · Undo · Permanent Roadmap (SD plugin) RC — code complete
Apache CloudStack QEMU bitmap + xxHash64 dedup Bitmap delta-push + seed ~5 min Seconds Planned · Unplanned · Test · Failback · Re-protect Roadmap (SD plugin) GA
GA Generally available / lab-validated RC Code complete, validation in progress
Failover playbook

Every DR move, one verb

Planned failover

Graceful switchover: verify source, run a final delta sync, shut the source down cleanly, boot the replica on DR and apply re-IP. Zero data loss.

Unplanned failover

Source is gone. Pick a restore point, apply it, power on the replica, re-IP, and log the exact data-loss window since the last good cycle.

🧪 Test failover

Boot an isolated clone of the replica on a fenced network — validate your DR plan without ever touching production replication.

Undo failover

Tear down the test/failover VM and snapshot, returning the replica to its pre-failover state. Replication resumes.

Permanent failover

Merge restore points into the base disk and detach the replication metadata — the replica becomes standalone production.

Failback & re-protect

After the primary recovers, reverse-sync deltas back and re-establish replication in the original direction.

🌐 Network mapping & re-IP

Map source virtual switches to DR switches and rewrite guest IPs/subnets at failover, so a DR VM lands on the right network without manual reconfiguration.

🔁 Cross-hypervisor restore

Disk-format conversion (VMDK ↔ VHDX ↔ qcow2 ↔ raw) means a VM captured on one platform can be restored onto another — Veeam-style V2V, built in.

Requirements (all VM platforms)

Deployment

  • Agentless — hypervisor API only
  • Bacula File Daemon on a Linux x86-64 proxy (Hyper-V: on Windows host)
  • Standalone DR receiver (systemd) — no full FD needed on DR

🔌 Connectivity

  • vSphere 7/8 · Hyper-V WS 2016–2025 · Proxmox 8.4+ · Nutanix AOS · CloudStack 4.16+
  • API port (443/8006/8080/9440) + DR receiver port + NBD/iSCSI for streaming
  • API credentials; PSK token (≥32 chars) or X.509 certs for DR

Consistency

  • Application-consistent via VSS (Hyper-V) / guest tools (vSphere) / QEMU guest agent
  • Crash-consistent fallback when quiescing is unavailable
  • No hypervisor licensing impact — native APIs only
Part 2 — Databases

Database replication, standby & CDP

For databases, replication means continuous log capture and standby orchestration — not snapshots. NGBackup ships engine-native logs (WAL, binlog, archived redo, oplog) and can bootstrap and promote a standby with a single job. Continuous modes reach near-zero RPO; warm standbys reach minute-class RTO.

📜 Continuous log shipping / CDP

A daemon tails the engine's transaction log and streams it continuously to Bacula storage. Recovery point shrinks to the log-flush interval — seconds, not minutes.

🖥 Standby provisioning

Replay a full + log chain onto a second host to build a hot/warm standby — then keep it current. Promotion is a single command when disaster strikes.

Role reversal / switchover

Demote the old primary, promote the standby, rewire replication — orchestrated by the plugin, validated before it returns success.

Engine capability matrix

Engine Replication / standby modes Continuous capture RPO (best) RTO (best) Maturity
PostgreSQL WAL streaming · standby restore · logical-replication capture · block-level incr (PG17+) CDP — continuous WAL Near-zero (seconds) Minutes–hours GA
Oracle Database Data Guard (EE) · archivelog-apply standby on SE2 · CDP daemon CDP — archived redo Near-real-time (EE) · minutes (SE2) Minutes (standby mounted) GA
Microsoft SQL Server Log shipping · Always On AG bootstrap · 1→N fan-out Log backups (≈5 min) 30 s – 15 min Minutes (standby in NORECOVERY) GA
MySQL / MariaDB / Percona Async & GTID replication · Galera/Group · DR-target provisioning CDP — binlog streamer ~45–80 s (60 s interval) Minutes–hours GA
MongoDB Change-streams tail · oplog tailing · sharded-cluster · switchover (stepDown) Continuous oplog / streams Seconds–minutes (30 s resume) Minutes–hours GA
Informix Dynamic Server HDR · RSS · SDS · Enterprise Replication — all bootstrap-orchestrated Logical-log daemon (≥5 s) < 5 s (interval=5) · < 1 min default < 5 min (HDR failover) GA
Firebird Replication-log replay (FB 4+) Log replay only Minutes Hours Partial
Progress OpenEdge OE-Replication seed bootstrap · AI-archiver shipping AI-archiver (<15 min) < 15 min Minutes (one-shot bootstrap) Seed only
ADABAS — backup + PITR only — Not available Sec–min (PITR) Hours No replication
HCL Domino / Notes — roadmap — Not available Pre-alpha
GA Production-ready replication / CDP Partial Log replay or seed only No Backup + PITR, no replication Pre-alpha On roadmap
What sets it apart

Replication features you won't find bundled elsewhere

Oracle standby without a Data Guard licence

The archivelog-apply mode bootstraps a physical standby via RMAN and continuously applies archived redo — on Standard Edition 2 / 23ai FREE. Manual failover with ACTIVATE STANDBY DATABASE, no EE Data Guard option required.

PostgreSQL block-level incremental + CDP

Continuous WAL streaming for near-zero RPO, plus PG17 pg_basebackup --incremental / pg_combinebackup block-level chains — and restore directly as a standby.

Informix sub-5-second RPO

The logical-log daemon polls sysmaster:syslogs as fast as every 5 seconds, and the plugin bootstraps HDR, RSS, SDS and Enterprise Replication topologies from one bconsole command.

MySQL GTID-aware CDP & Galera

Binlog streamer sidecar for single-digit-minute RPO, GTID tracking that survives restarts and topology changes, and a donor auto-desync guard so backing up a Galera node never blocks writes.

Requirements (database plugins)

Deployment

  • Bacula File Daemon on the database host (Linux x86-64; OE also Windows)
  • Engine-native tooling (RMAN, pg_basebackup, mysqlbinlog, mongodump, ON-Bar/XBSA…)
  • Continuous modes run a lightweight log-shipper daemon

🔑 Privileges

  • Backup/replication role with log read access
  • PG: REPLICATION + wal_level; MySQL: binlog + GTID; Oracle: SYSDBA/RMAN
  • Backup-from-standby/replica supported to offload the primary

📋 Versions

  • PG 12–17 · Oracle 11gR2–23ai · SQL Server 2012–2022
  • MySQL 8.0/8.4 · MariaDB 10.5–11.4 · Percona 8.0
  • MongoDB 4.4–8.0 · Informix 12.10+/14.10/15.0
Platform-wide

Built into every replication mode

🔒 Encrypted transport

Mutual TLS 1.3 or a pre-shared key with ChaCha20-Poly1305 / AES-256-GCM. Optional AES-256-GCM at rest on file replicas.

🚦 Bandwidth throttling

Token-bucket rate limiting with optional business-hours schedules and per-target limits for WAN-friendly DR.

🗂 Restore-point rotation

Keep N recovery points per replica (default 7), auto-purging the oldest. Pick any point at failover time.

Auto-retry & alerting

Exponential backoff (30→60→120 s) with RPO-violation detection and alerts to Bacula messaging.

🔬 Integrity verification

Sample-block checksums per cycle (Proxmox: 64 KB / FNV-1a, 0 mismatches in gate runs); BLAKE3 on file replication.

📊 Catalog & dashboards

Replication pairs, restore points and failover events are catalog rows — queryable, exportable to JSON, ready for Prometheus.

🛣 Scheduler lanes

Replication runs in its own lane with a dedicated concurrency budget — DR cadence and backups never contend.

🌱 Seed-from-backup

Bootstrap a DR replica from an existing backup to avoid a full WAN copy, then switch to incremental delta-push.

🧩 File replication too

Beyond VMs and DBs: mirror & versioned-retention file replication with multi-site fan-out and failover hooks.

Honesty note on maturity. Items marked GA are shipped and lab-validated. Partial / RC items are code-complete or in active validation. RPO/RTO depend on workload, link bandwidth and change rate — treat the best-case numbers as the engine floor, not a guarantee for every dataset.

Replace your DR tooling — keep your budget.

Bring your Veeam, Commvault, NetBackup or Bacula Enterprise renewal quote. We'll match the replication and DR features and cut the price by at least half.