How does BackupWall work?
BackupWall runs on the server it protects. A scheduler starts backup jobs, a worker running as root reads each account through the panel and the file system, and the data goes to your destination as deduplicated, compressed objects. Restores read it back and verify every object.
The pieces
BackupWall installs six services on the server:
| Service | What it does |
|---|---|
backupwall-api |
The API and the web console. |
backupwall-worker |
Runs backups, restores and migrations. Runs as root so it can read every account. |
backupwall-download-worker |
Builds download files, so a big download never blocks a backup. |
backupwall-beat |
The scheduler. |
backupwall-watcher |
Notes which files changed so backups can skip the rest. |
backupwall-redis |
A private job queue on a unix socket (no network port). |
A watchdog checks them every 5 minutes. When nothing is running, the worker and download worker keep no task processes; a task that arrives starts one and it stops after 30 to 60 idle seconds. systemctl status still shows both services as active.
Jobs, schedules and backup points
- A job says what to back up (which accounts and which content), where to send it (a destination) and whether to encrypt it.
- A job has one or more schedules (Every hour, Daily, Weekly or Monthly) with a number of points to keep.
- Each run produces a backup point: a restorable snapshot of every account the run covered. A point that covered only some accounts, or finished with problems, is marked partial.
- Retention removes points beyond the number you keep; a later cleanup frees the space.
How a backup runs
- The scheduler (or you, with Run now) starts the job. Only one backup runs per server at a time; the others wait and retry every 2 minutes.
- For each account the worker asks the panel for the account's databases, mailboxes, DNS zones, certificates, cron jobs and FTP logins. Where it can, it uses the panel's own local command line as root, which needs no network API or token.
- It finds the files that changed (see Incremental and deduplicated backups), cuts large files into chunks, compresses them, and optionally encrypts them.
- It uploads only the objects the destination does not already hold, then writes the account's manifest and the point's record.
- It runs the retention rules and, once a day, a cleanup.
How a restore runs
A restore takes a point and a scope (files, databases, email, DNS zones or a whole account), reads the objects back, checks every object against its hash, and writes into the live account. An overwrite restore first takes a safety copy you can undo. See Restore files, databases, email or DNS.
What stays on your server
The BackupWall database (jobs, destinations, backup points, users, audit log) and the master encryption key live on your server. The backup data itself lives on your destinations. Disaster Recovery exports the database and key as a sealed bundle so a lost BackupWall server can be rebuilt. See Set up Disaster Recovery.
One BackupWall per server
One BackupWall installation serves one server and one panel. There is no multi-server console. Servers relate to each other only through migration and clone links.