In the backupset table I can see couple of backups that I am unable to understand where they originated from. That is - who ran them.

I have checked:

  1. Maintenance plans

  2. Sql jobs

  3. Virtualization tool based backup jobs

None of the above have the backups configured yet they are occurring at 6AM every day.

What are the other possibilities and your advise of how to identify the source of backup?

  • Task Scheduler either on server or workstation? Or a client app? Cron job on remote server? Specialized backup software? Could be anything Oct 3 at 13:54

If you're seeing backups in the msdb backup history, they were either performed via T-SQL or VSS.

T-SQL backups can be invoked manually, via SQL Agent, via maintenance plans, or any huge number of scheduling software.

VSS is an API that is used by storage vendors, VM hypervisor vendors, cloud infrastructure providers, and independent backup vendors. Scheduling on those jobs will vary by vendor.

In all cases, you'll be limited to identifying who or what is running the backup by looking at data in msdb.dbo.backupset. Data such an user name is hopefully enough to identify who is performing backups.

Additionally, you can review which accounts have permission to perform backups, and do a manual audit to find if someone has permission to do backups when they should not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.