From: Derrick Ho <derrick.ho@hycu.com>
Sent: Friday, January 7, 2022 10:02:41 AM
To: Jamey Franks <jfranks@choicespine.com>
Cc: Ryan Blume <rblume@choicespine.com>
Subject: Re: Choicespine backup warning via HYCU
Jamey,
I apologize regarding our support but it appears we had some mis-communication internally. However, the support engineer, Juan Ignacio Munoz Gomez will reach out. You should be receiving an email for the support portal login. Please check your “junk/spam” folder as well for this email.
In the mean time, this is what support emailed me since I opened the ticket on your behalf.
HYCU triggers this notification to let you know of unusual change blocks in the server, this could be caused by ransomware encrypting the server, it does not necessarily mean you are under a ransomware attack, but HYCU alert you to maybe check the server to make sure all is good.
We added some new features related to malware protection, in regards to this specific warning, this is a new feature described in our Release Notes for the 4.3.0 version, page 5.
If HYCU detects that the data change rate of the last incremental backup is 25% or more compared to the average data change rate of the previous incremental backups performed for the protected virtual machine or volume group. 25% is the default value that you can adjust to the needs of your data protection environment.
Here is an example:
- The average change rate of 9 previous incremental backups of a VM was 5%
- The default threshold to trigger this notification is 25%
- If the 9 previous backups average is 5% and the next incremental change rate is 7%, the difference between the current and the previous is 28.5%, since the threshold is 25% then you will get a warning.
Percentage Calculator
To avoid any warning you can set up the threshold to a higher value than the top, maybe 60% is a good value.
Here is the procedure for changing the threshold:
1. Make sure no jobs are running (put the HYCU controller in suspend mode HYCU UI -> Power options).
2. SSH to HYCU Controller. Default credentials are (username: hycu password: hycu/4u)
3. Change to root (credentials from step 1)
sudo su
4. Run the following command to set the change rate to 60% or to whatever value you want.
echo "changerate.treshold.percentage=60.0" >> /opt/grizzly/config.properties
5. Restart grizzly
sudo service grizzly restart
6. Go to HYCU UI -> Gear icon -> Power options and resume HYCU operations.
This increase is an change average and it is NOT the Threshold percentage noted in the policies settings, both things are completely different.
Sincerely,
Derrick Ho
Solutions Architect
HYCU, Inc
C: 678-509-5193