Backup/Recovery appliance non-disruptive update:

• Database Restore & Management: Resolved SAP HANA differential restore failures and Oracle "Mount and Migrate" disk eligibility issues, while enhancing Db2 log purging and HANA /etc/fstab cleanup.
• System Stability: Improved reliability by addressing gpdmgr memory leaks, preventing udpengine crashes during OnVault jobs, and enabling size-based log rotation.
• API & Infrastructure: Optimized host discovery and API performance, including support for duplicate VM names, subnet pagination, and the removal of deprecated NFS options.

Cost reports are now generally available for Backup and DR Service. Use cost reports to view resource specific Backup & DR Billing costs to gain granular insights into service spend and take actions to optimize resource allocation.

You can now use cost reports to view resource-specific Backup and DR billing costs to gain granular insights into service spending and to take actions to optimize resource allocation.

Announcement

Protection summary is now generally available for Backup and DR Service. Use Protection summary to identify and fix data protection gaps across your projects.

Backup/Recovery appliance non-disruptive update:

• Resolved issues with Db2 migration scripts and various SAP HANA backup failures, including differential and log backups.
• Improved system stability and diagnostics by enhancing logging, adding log rotation, and correcting unit reporting in dashboards.
• Corrected the data copy reporting for Persistent Disk (PD) based backups, ensuring it accurately reflects zero data copied.

Security

Addressed multiple OpenSSH vulnerabilities, including CVE-2025-26465 and CVE-2025-26466.

Feature

Enhanced performance for restore and clone of VMware VMs.

Expanded Linux CBT support for new kernels on RHEL 8 and 9.

Backup Vault: CMEK support for Compute Engine (GA) Backup Vault now supports data protection for Compute Engine instances and Persistent Disks encrypted with Customer-Managed Encryption Keys (CMEK). This capability is currently available via Allow-list General Availability; please contact your Google Cloud sales representative to request access.

Cloud SQL enhanced backups are now generally available (GA). With enhanced backups, backups are managed and stored in a centralized backup management project that leverages Backup and DR service to provide enforced retention, granular scheduling, and longer retention. Enhanced backups now also support point-in-time-recovery (PITR) after instance deletion.

For more information about the available options and their limitations, see Backup options.

For more information about enhanced backups pricing, see Backup and DR pricing.

Resolved a decryption failure that occurred when accessing KMS keys.

Fixed

• Resolved an issue with SAP HANA datafile validation on scale-out clusters.
• Fixed a bug causing SAP HANA log backups to fail when the log mode is not 'normal'.
• Addressed failures in Db2 dump full backups in some environments.
• Corrected an issue where Db2 restore jobs with the roll-forward option were not applying logs completely.

Feature

Added Change Block Tracking (CBT) support for RHEL 8.8 SAP kernels.

Announcing the public preview launch of Database Center support for resources protected with Backup and DR Service. Database Center is an AI-assisted dashboard that highlights fleet-wide data points.The integration is designed to provide Database Center users with a single, unified, and accurate view of the data protection posture for all databases protected by Backup and DR Service.This capability is available today, at no additional cost, for all Cloud SQL customers who have protected their databases through Backup and DR Service enhanced protection.

Announcing the Public Preview launch of AlloyDB for PostgreSQL enhanced backups with Backup and DR Service. This enables advanced data protection capabilities offered by Backup and DR Service including backup vault support, granular scheduling through backup plans, and centralized management.

Feature

A new backup vault setting, Prevent deletion for duration specified in backup rule, is now available. When enabled, this feature locks backups for the exact retention period defined in the associated backup plan, overriding the vault's local minimum retention and preventing manual deletion.

• Resolved a problem with timestamp conversions during recovery range calculations in SAP HANA
• Fixed a bug that prevented the identification of persistent disk names in some SAP HANA environments
• Fixed DB2 restore issue wrt pre-flight checks and instances with a large number of archive logs
• Fixed a logging issue during Postgres upgrades where an incorrect version was displayed after a rollback
• Resolved a restore failure when using a combination of full and incremental backups for SAP ASE
• Fixed a connection leak and an issue with executor service shutdown in the VMware hypervisor integration, improving reliability.

Security

The following CVEs have been addressed in this release: CVE-2022-1471, CVE-2025-31651, CVE-2025-31650, CVE-2022-42003, CVE-2025-25193, CVE-2024-6763, CVE-2025-52999, CVE-2025-24970, CVE-2025-49125, CVE-2025-48734, CVE-2024-52317, CVE-2025-48988, CVE-2025-46701

Feature

• Change Block Tracking (CBT) support has been added for latest kernel versions in RHEL 8.10, 9.2, 9.4 and 9.6.
• Improved alerting for long-running jobs by adding application type and name to the alerts.

Backup and DR Service 11.0.16.253 is now available to update your backup/recovery appliances. Refer to these instructions to update your appliance.

• Guardrails have been defined for each backup/recovery appliance to specify the number of supported job slots, ensuring smooth parallel backup and mount jobs.

Introducing notifications and alerts for the following critical events:

• Processes not running on a backup/recovery appliance
• Expired certificates
• No jobs running on a backup/recovery appliance
• CPU and memory usage exceeding threshold values
• Backup/recovery appliance appliance version out of support
• Backup/recovery appliance updates available

You can subscribe to these events and configure email alerts.

You can now set up backup vault specific workload quotas for critical resources like data sources, backups, backup plans, and backup plan associations. Until now these quotas were set up only at the project level, not at the workload level.

An issue where Backup and DR Service management charges for SAP HANA backup were calculated using the allocated size of the database disk volume, rather than the amount of data in the database. This issue only affected Backup and DR Service deployments where SAP HANA was backed up using either the Volume level (LVM CBT) or Persistent Disk snapshot backup methods.

Announcing the 30-Day Introductory Trial for Google Cloud Backup and DR Service

You can now activate a 30-day, full-featured introductory trial of the Backup and DR Service on any project that does not have an active Backup and DR configuration. The trial provides a hands-on experience with all features, from centralized management to our advanced immutable backup vault, without any initial commitment.

Announcing the General Availability (GA) of Backup Vault support for independent Persistent Disks and Hyperdisks!

This new capability empowers you to protect application data, databases, and file shares stored on individual disks (where a full VM backup is not required) — all within a secure, immutable, logically air-gapped vault designed to withstand malicious deletion and advanced threats like ransomware.

Announcing the Public Preview launch of Cloud SQL enhanced backups with Backup and DR. This enables advanced data protection capabilities offered by Backup and DR including backup vault support, granular scheduling through backup plans, and centralized management.

We're excited to announce the launch of Editable Backup Plans, a new feature designed to give you more flexibility and control over your data protection strategy. You can now modify your existing backup plans directly, eliminating the need to create new plans and reassign them when your requirements change. This makes it easier than ever to adapt to evolving business needs, optimize for cost, and correct configuration errors on the fly.

What's new:

• Directly Edit Key Settings: You can now change the description, schedule, backup window, and retention periods of your existing backup plans. You can also add or remove backup rules as needed.

• Automatic Updates: Once a plan is edited, the changes are automatically applied to all resources protected by that plan for all future backups. There's no need to manually detach and reattach the plan.

• Backward Compatibility: This new capability is available for all backup plans, including those created before this update.

Important Note: While most settings in a backup plan are now editable, the assigned backup vault cannot be changed. To store backups in a different vault, a new backup plan must be created.

Announcing the General Availability (GA) of multi-region backup vaults.

You can now create backup vaults in multi-region storage locations. This new capability allows you to leverage the security benefits of backup vault, while also enhancing your ability to maintain accessibility and recoverability of critical backup data during a regional service disruption (such as natural disasters and power outages).

Backup and DR Service 11.0.15.226 is now available to update your backup/recovery appliance. Refer to these instructions to update your appliance.

Announcement

There is a new committed use discount (CUD) for customers using Backup and DR Service to protect Oracle databases into a backup vault. This is a way to lower backup costs in consideration of a 1-year or 3-year commitment. You can purchase CUDs from Google Cloud Marketplace via the standard process.

Fixed

These issues have been fixed:

• An issue in which multiple snapshot/Direct OnVault jobs became stuck in an unresponsive state after attempting to connect to vCenter with an openssl command.
• An issue in which database persistent disk snapshot backup jobs failed with the unhelpful error message resource not found now has a useful error message.
• An issue in which Log explorer was showing some spurious "read error, check permissions" results on backup/recovery appliances.
• An issue in which a backup/recovery appliance could come out of synchronization with a management console following a Trying to release lock or Failed to acquire lock error.
• A rare issue in which a backup/recovery appliance became unresponsive after a very heavy load exhausted all job threads and /var/log/ was 100% full. Thread management is now more efficient.
• An issue in which persistent disk database snapshot images were failing to import log backups, and the recovery range was missing on imported backups.
• An issue in which some backups of PostgreSQL version 15 failed due to a premature timeout.
• An issue in which some mount jobs failed if the host's lvmconfig has global/system_id_source set to uname.
• An issue in which database names provided in mount screen were not honored correctly when creating child applications on the target host.
• The Staging disk is full error message has been made more useful.

Feature

Backup and DR Service now supports backup and restore of Db2 databases using persistent disk snapshots. This is typically faster and simpler than previous methods and in some cases may also reduce costs.

Feature

This release introduces enhanced logging and alerting capabilities for backup/recovery appliances, enabling proactive monitoring of their health and status. You can now configure email notifications via Cloud Logging to receive timely alerts on appliance status changes or potential issues, and five new events have been added for more granular monitoring:

• 10237: Jobs running over 6 hours.
• 11001: Backup/recovery appliance certificate expires in X days.
• 11004: Backup/recovery appliance system components are down.
• 11006: Backup/recovery appliance unable to sync with host.
• 90003: A new backup/recovery appliance update is available.

Security

Vulnerabilities CVE-2024-42301, CVE-2024-42284, and CVE-2024-41092 have been fixed at kernel version 4.18.0-553.33.1.el8_10.

Introducing preview of a simplified one-step procedure for changing backup plans assigned to your Compute Engine VMs. Previously, changing the backup plan for a VM required removing the existing plan and then applying the new plan. With this update, you can now change the backup plan for a VM in a single operation. This enhancement streamlines your workflow, making it quicker and more efficient to ensure your VMs are protected by the desired backup strategy.

The Backup and DR service has added support for activating the management console, for creating backup plans, and for storing backup vault data in the following regions: northamerica-northeast1 (Montréal), northamerica-northeast2 (Toronto), and asia-east2 (Hong Kong).

Generally available: The Create an instance page in the Google Cloud console has a Data protection pane where you can specify how to back up and replicate your data. For more information, see Configuration options during instance creation and Data protection options.

Security Command Center adds threat detection support for Backup Vault, Backup Plans, and vaulted backups.

Security Command Center released new rules for Google Cloud Backup and DR Service. Security Command Center can now do the following:

• Detect Backup Vault deletions
• Detect Backup Plan deletions
• Detect deletion of backups stored in a Backup Vault

These detectors are available to all Security Command Center Premium and Enterprise customers. For more information, see Security Command Center for Backup and DR Service.

Announcement

The Backup and DR service has added support for activating the management console and for storing backup vault data in the following regions: us-west3 (Salt Lake City), europe-west9 (Paris), me-west1 (Israel), europe-north1 (Finland), europe-west6 (Zürich), asia-northeast3 (Seoul), southamerica-west1 (Santiago).

Backup and DR now supports the latest RHEL and SLES OS and kernels in backup/recovery appliance 11.0.13 and later:

RHEL 8.8: 4.18.0-477.36.1, 4.18.0-477.43.1, 4.18.0-477.51.1, 4.18.0-477.55.1, 4.18.0-477.58.1, 4.18.0-477.64.1, 4.18.0-477.67.1, 4.18.0-477.70.1, 4.18.0-477.75.1, 4.18.0-477.81.1, 4.18.0-477.83.1

RHEL 8.10: 4.18.0-553.30.1, 4.18.0-553.32.1, 4.18.0-553.33.1

RHEL 9.3: 5.14.0-362.24.1

RHEL 9.4: 5.14.0-427.13.1, 5.14.0-427.16.1, 5.14.0-427.18.1, 5.14.0-427.20.1, 5.14.0-427.22.1, 5.14.0-427.24.1, 5.14.0-427.26.1, 5.14.0-427.28.1, 5.14.0-427.31.1, 5.14.0-427.33.1, 5.14.0-427.35.1, 5.14.0-427.37.1, 5.14.0-427.40.1, 5.14.0-427.42.1

RHEL 9.5: 5.14.0-503.11.1, 5.14.0-503.14.1, 5.14.0-503.15.1, 5.14.0-503.16.1, 5.14.0-503.19.1

SLES 15 SP6: All kernels

Backup and DR Service 11.0.14.302 is now available to update your backup/recovery appliance. Refer to these instructions to update your appliance.

Backup and DR Service 11.0.14.302 includes the following fixes and improvements:

• The following CVEs have been addressed in this hotfix: CVE-2024-42301, CVE-2024-42284, CVE-2024-41092
• In some cases, a database that has data on multiple volumes can be mounted successfully, but a subsequent unmount operation fails. This has been fixed.
• In rare cases, the management console could lose the connection to the backup appliance for up to an hour, after which it automatically recovered. During the disconnection, the scheduled backups continued to be taken but the jobs monitor could not show progress and new on-demand jobs could not be run. This has been fixed.
• A Db2 log backup to a full disk failed without notification. With this hotfix, upon failure the disk is resized and the backup job is retried successfully.
• A persistent disk backup job for an SAP HANA or an IBM Db2 database fails if the backup/recovery appliance includes another host with the same name in a different project. This has been fixed.
• Imported persistent disk snapshots of SAP HANA and Db2 databases sometimes failed to mount or to restore if the database host had a custom (non-default) PD disk names. This fix ensures that these imported databases can be successfully mounted and restored.
• For SAP IQ databases, the INC_BKP.1 file (a config file) is backed up. It can be a large file that consumes much storage, so starting with this hotfix the config file is compressed for backup.
• Recovery of an IBM Db2 database from a standby image sometimes failed. This has been fixed.
• Backup and DR now supports "Import without ownership" for SAP HANA and IBM Db2 databases and logs.

Protection summary is now available for public preview. Protection summary provides a centralized, single-pane-of-glass view of your backup configurations for resources running within your Google Cloud project. Use protection summary to gain a holistic understanding of your backup state, identify gaps in coverage, and implement centralized backup management strategies. You can read about protection summary at Use protection summary.

The Backup and DR service has added support for activating the management console and for storing backup vault data in the following regions: us-east5, asia-northeast1, and asia-southeast2.

Fixes for Oracle databases backed up to OnVault and backup vault

• Hosts from both source and remote backup appliances are now listed in the restore page. For cases when no host is reachable or the primary backup appliance is down, the UI was improved by showing a spinning wheel to avoid waiting for longer than necessary while attempting to restore from an imported image.

• A Replace Original Application Identity option has been added for Oracle traditional restore functionality.

Feature

For updates to the backup appliance, a default window now exists to schedule non disruptive patch updates. (Disruptive updates do not get the default window.) You will now receive notifications 2 weeks , 1 week and 24 hours before the scheduled update after which the appliance will be automatically updated. An option to reschedule non disruptive patch updates is also available.

Fixed

Fixes for SAP HANA Persistent Disk Snapshots

• Enhancing imports of log images: Log images can now be imported correctly with the right recovery range. Enabled importing log images without having to take the ownership of the images. Fixed the workflow for importing on the source management server instance and another new management server instance.

• UI fixes for point-in-time recovery from imported images: Imported images appear in the remote snapshot lane in access view, populating correct recovery range for imported images, populating recovery time in restore operation request, adding archive log mount point location in restore page, disabling Replace Original Application Identity for remote images, mount page waiting indefinitely for imported image, adding import PD snapshot option in application page, enabling host selection drop-downs for replication cluster etc.

• BA fixes: Issues with uploading metadata for replication clusters and with point-in-time recovery from imported images were fixed.

Security

The following CVEs have been addressed in this release: CVE-2024-38286, CVE-2019-9636, CVE-2023-5178, CVE-2020-14343, CVE-2021-29921, CVE-2019-7164, CVE-2020-27619, CVE-2018-20060, CVE-2019-20477, CVE-2019-9948, CVE-2020-1747, CVE-2021-3177, CVE-2022-42919, CVE-2024-0565, CVE-2015-20107, CVE-2023-51042, CVE-2020-10878, CVE-2023-6546, CVE-2022-0391, CVE-2022-45884, CVE-2021-33631, CVE-2020-10543, CVE-2019-20907, CVE-2023-3812, CVE-2019-11324, CVE-2022-45919, CVE-2023-6931, CVE-2024-1086, CVE-2021-43818, CVE-2021-33503, CVE-2020-26116, CVE-2019-20916, CVE-2023-2163, CVE-2021-42771, CVE-2022-45886, CVE-2021-3737, CVE-2023-52425, CVE-2018-18074, CVE-2021-27291, CVE-2021-20270, CVE-2023-24329, CVE-2019-18874, CVE-2019-16056, CVE-2019-7548, CVE-2021-3572, CVE-2019-9740, CVE-2021-23336, CVE-2020-14422, CVE-2021-3426, CVE-2023-1192, CVE-2022-38096, CVE-2023-6135, CVE-2020-8492, CVE-2020-27783, CVE-2020-28493, CVE-2023-46218, CVE-2021-4189, CVE-2020-26137, CVE-2021-3733, CVE-2019-16935, CVE-2021-28957, CVE-2018-20852, CVE-2019-11236, CVE-2019-9947, CVE-2020-28241, CVE-2023-5388, CVE-2023-28322 CVE-2022-48624, CVE-2023-38546, CVE-2021-20095

Backup and DR service added integration with the Compute Engine VM creation experience, enabling the application of Backup and DR backup policies when VMs are created. This feature is now generally available.

Feature

Backup and DR service added centralized backup management within Google Cloud console, with support for Compute Engine VM backup to backup vaults. This feature is now generally available.

Feature

Backup and DR service added support for immutable and indelible backups with the new backup vault feature. This feature is now generally available.

This release fixes an issue with OnVault pool jobs leaving behind inactive cloudbacker mountpoints. It does this by retrying the unmount process a set number of times, including forced unmounts. Due to the increased number of retries and the wait time between them, job durations may be slightly longer.

Deprecated

This release deprecates support for ssh-rsa as the ssh Host Key algorithm.

Security

This release fixes the following Kernel vulnerabilities:

CRITICAL Kernel issues: CVE-2023-25775 CVE-2019-15505

MEDIUM Kernel issues CVE-2019-13631 CVE-2020-25656 CVE-2020-26555 CVE-2020-36777 CVE-2021-3753 CVE-2021-46909 CVE-2021-46939 CVE-2021-47171 CVE-2022-38096 CVE-2022-48743 CVE-2023-1192 CVE-2023-4133 CVE-2023-5090 CVE-2023-6121 CVE-2023-6176 CVE-2023-6240 CVE-2023-6622 CVE-2023-6915 CVE-2023-24023 CVE-2023-31083 CVE-2023-37453 CVE-2023-38409 CVE-2023-39189 CVE-2023-39192 CVE-2023-39193 CVE-2023-39194 CVE-2023-39198 CVE-2023-42754 CVE-2023-42755 CVE-2023-45863 CVE-2023-52448 CVE-2023-52463 CVE-2023-52471 CVE-2024-0340 CVE-2024-21140 CVE-2024-21145 CVE-2024-25739 CVE-2024-26583 CVE-2024-26584 CVE-2024-26585 CVE-2024-26586 CVE-2024-26602 CVE-2024-26603 CVE-2024-26901 CVE-2024-26908 CVE-2024-27014 CVE-2024-27019 CVE-2024-36270 CVE-2024-36489 CVE-2024-38598 CVE-2024-39472 CVE-2024-39476

HIGH Kernel issues: CVE-2019-25162 CVE-2021-4204 CVE-2021-33631 CVE-2021-47624 CVE-2022-0500 CVE-2022-3565 CVE-2022-23222 CVE-2022-45884 CVE-2022-45886 CVE-2022-45919 CVE-2022-45934 CVE-2023-2163 CVE-2023-3567 CVE-2023-3812 CVE-2023-4244 CVE-2023-5178 CVE-2023-6546 CVE-2023-6931 CVE-2023-6932 CVE-2023-28464 CVE-2023-51042 CVE-2023-51780 CVE-2023-52340 CVE-2023-52434 CVE-2023-52439 CVE-2023-52445 CVE-2023-52451 CVE-2023-52464 CVE-2023-52469 CVE-2024-0565 CVE-2024-0841 CVE-2024-1086 CVE-2024-21147 CVE-2024-23307 CVE-2024-25744 CVE-2024-26593 CVE-2024-26907 CVE-2024-26933 CVE-2024-26934 CVE-2024-27020 CVE-2024-36971 CVE-2024-36978 CVE-2024-36979 CVE-2024-38538 CVE-2024-38555 CVE-2024-38627 CVE-2024-39487

Fixed

This release fixes an issue where SAP HANA database and log backup jobs using Persistent Disk snapshots would complete with a warning status due to metadata upload failures to Google Cloud Storage for disaster recovery.

Change

This release removes the 700 thread hard limit and psrv restarts at 800 threads when the psrv is at high usage.

Fixed

This release fixes the synchronization between database and log backup states. Log backups should not copy the logs to the database staging after the database staging disk is unmounted and the state DBBACKUP_DONE is set.

Security

This release fixes the Tomcat vulnerability CVE-2024-38286.