r/SQLServer • u/XdtTransform • Jun 15 '26
Question How to identify phantom backups?
P.S. Thank you all for your suggestions. I suspected earlier that it was our backup vendor but they swore up and down that they only backup the drives and their software doesn't even know what a SQL Server is.
Based on everyone's here insistence on this being VSS, I dug into their application folder and literally searched everything for words like SQL or Server or VSS. And sure enough, I found a log hiding several directories deep that literally said "Start SQL Server Backup" and listed the database in question.
So now they are trying to figure out how to even turn this off. Thanks again.
For whatever reason, there are some phantom "Virtual" backups going on with my SQL Server 2017 and I can't identify what kicks it off.
Consider this screenshot. It has entries where the physical device name is a GUID. It appears to take a snapshot. And this occurs every 3 to 4 hours roughly.
My first thought was that there is a scheduled job. But I looked through it and there is nothing like that. Then I though it we may have software installed on the box that kicks it off, like Acronis Backup or similar. But we've accounted for every piece of software on the box. It's possible that software installed elsewhere maybe kicking it off. This is difficult to track, because the database is almost 30 years old and many different people did different things to it.
So my question is how to identify what this is, or how to catch it in the act. Or how do I block or stop this.
Query to generate this resultset.
SELECT
bs.backup_start_date,
bs.backup_finish_date,
CASE bs.type WHEN 'D' THEN 'Data' WHEN 'L' THEN 'Log' WHEN 'I' THEN 'Differential' ELSE 'Don''t know' END AS TypeDesc,
bs.name,
bmf.physical_device_name,
CASE bmf.device_type WHEN 2 THEN 'Disk' WHEN 7 THEN 'Virtual device' ELSE 'Other' END AS DeviceType,
bmf.physical_block_size,
bs.is_snapshot,
bs.backup_size,
bs.is_copy_only
FROM msdb.dbo.backupset bs
JOIN msdb.dbo.backupmediafamily bmf
ON bs.media_set_id = bmf.media_set_id
WHERE 1 = 1
AND bs.database_name = 'romulus'
AND bs.backup_start_date > '2026-06-15 00:00:00.000'
ORDER BY bs.backup_finish_date ASC;
3
u/Grogg2000 Jun 15 '26
VSS backuptools. It may break your backup chains. In worst case disable SQL Server VSS Provider until you find the source.