Enabling WORM copy with built-in WORM Storage

We are leaning towards turning it on only on the Commvault side. What are the benefits of turning it on on both sides? Thanks

Hi Nick

Commvault WORM prevents deletion from within the application.

Hardware, or cloud based WORM, offers protection at a layer below the filesystem hosting the backups. 

Two points to consider - 

1. The Commvault “Ransomware Protection” feature can be configured to offer protection at the filesystem level using a combination of selinux or a filter driver coupled with filesystem permissions to protect disk libraries outside of the application.
2. Hardware/Cloud based WORM when used in conjunction with deduplication requires that the dedupe DDBs be periodically sealed resulting in new baselines being written out and thus greater storage utilisation.

It should also be noted that in the context of this conversation WORM is really just a time lock defined on storage vendors user interface. 

HTH

Niall

We have Commvault’s ransomware protection enabled on all of our mediaagents. Is there any other benefit in only enabling worm protection within Commvault other than preventing a Commvault user with the correct permissions from deleting any backups before they have aged? Would Commvault micro pruning still work if the backend storage supported it and only worm protection was turned on at the Commvault level?

Does Commvault have any consolidated documentation that compares having only hardware/cloud worm turned on, having only Commvault worm turned on or having both turned on? Maybe this would help us understand your first comment on recommending that both be enabled so “this way you avoid the situation where a job has ‘aged’ from the Commserve database but remains on the disk or cloud library.” .

Thanks

Hi Nick, 

With WORM enabled on a Storage Policy copy, the retention can only be increased [and not decreased] as well as the prevention of job or copy deletion. And yes micro pruning still works if supported by the back end storage.

I did look to see if we had any white papers specific to WORM and didn't find any. The point I was trying to make earlier was that if you use ‘hardware’ WORM functionality to protect the data on the disk library then you should really protect the jobs in the Commserve database too [with the Commvault Application WORM capability]. 

HTH

Niall