[{"data":1,"prerenderedAt":540},["ShallowReactive",2],{"art-linux-server-backups-2026-en":3},{"id":4,"title":5,"author":6,"body":7,"date":525,"description":526,"extension":527,"image":528,"meta":529,"navigation":391,"pareja":530,"path":531,"seo":532,"stem":533,"tags":534,"__hash__":539},"blogEn\u002Fen\u002Fblog\u002Flinux-server-backups-2026.md","Linux server backups in 2026: the 3-2-1 rule, explained with real-world cases","Paco Cubel",{"type":8,"value":9,"toc":510},"minimark",[10,15,19,32,40,44,47,68,71,75,78,146,152,156,159,206,213,217,224,242,249,253,259,265,279,286,290,300,312,341,345,348,370,373,377,380,460,463,467,473,479,489,495,499,502],[11,12,14],"h2",{"id":13},"the-uncomfortable-conversation","The uncomfortable conversation",[16,17,18],"p",{},"Most companies we audit will tell you they \"have backups\". The trouble starts when we ask three follow-up questions:",[20,21,22,26,29],"ul",{},[23,24,25],"li",{},"When did you last actually restore from one?",[23,27,28],{},"How long would it take you to bring your website back if the server vanished right now?",[23,30,31],{},"Is your backup sitting on the same server as your database?",[16,33,34,35,39],{},"The most common answer to the third one is \"yes\". And that's where the problem hides: if the server goes down, you lose the site ",[36,37,38],"strong",{},"and"," the backup with it.",[11,41,43],{"id":42},"the-3-2-1-rule-in-plain-english","The 3-2-1 rule in plain English",[16,45,46],{},"The 3-2-1 rule isn't new. It's been the de facto standard for decades and it still holds up in 2026 because it solves 95% of real-world disasters:",[20,48,49,55,62],{},[23,50,51,54],{},[36,52,53],{},"3 copies"," of your data: the original plus two extra copies.",[23,56,57,58,61],{},"On ",[36,59,60],{},"2 different media",": local disk on the server plus external storage, for example. Three folders on the same drive don't count.",[23,63,64,67],{},[36,65,66],{},"1 copy off-site",": a different datacenter, a different region, a different provider entirely. This is the one that saves you when the server room burns down or your provider goes under.",[16,69,70],{},"In 2026, \"off-site\" usually means an S3 bucket, a Backblaze B2 bucket or a server hosted somewhere else. The technology doesn't matter — what matters is the isolation.",[11,72,74],{"id":73},"what-you-actually-need-to-back-up","What you actually need to back up",[16,76,77],{},"This is where most plans fall apart. A \"server backup\" means nothing until you spell out what it covers:",[79,80,81,94],"table",{},[82,83,84],"thead",{},[85,86,87,91],"tr",{},[88,89,90],"th",{},"Layer",[88,92,93],{},"What to back up",[95,96,97,106,119,130,138],"tbody",{},[85,98,99,103],{},[100,101,102],"td",{},"Application",[100,104,105],{},"Source code (if not in git), configuration, user uploads, SSL certificates",[85,107,108,111],{},[100,109,110],{},"Database",[100,112,113,114,118],{},"A consistent SQL dump — not a hot copy of the ",[115,116,117],"code",{},".ibd"," files",[85,120,121,124],{},[100,122,123],{},"System",[100,125,126,129],{},[115,127,128],{},"\u002Fetc",", installed package list, cron jobs, users and permissions",[85,131,132,135],{},[100,133,134],{},"Shared data",[100,136,137],{},"NFS mounts, Samba shares, internal NAS folders",[85,139,140,143],{},[100,141,142],{},"Identities",[100,144,145],{},"SSH keys, certificates, API tokens, service passwords",[16,147,148,149,151],{},"The classic mistake is backing up the website and forgetting ",[115,150,128],{},". The day you need to reinstall, you realise rebuilding nginx, fail2ban, postfix and sudoers by hand costs more than losing the data ever would.",[11,153,155],{"id":154},"the-tools-we-reach-for-in-2026","The tools we reach for in 2026",[16,157,158],{},"There's no single \"best tool\" — there's the one that fits your case:",[20,160,161,167,173,183,197],{},[23,162,163,166],{},[36,164,165],{},"restic"," — Encrypted, deduplicated, incremental backups. Native support for S3, B2, Azure, GCS, SFTP and local disk. Our default pick on new projects.",[23,168,169,172],{},[36,170,171],{},"borgbackup"," — Similar to restic, with great compression and deduplication. Ideal when the destination is an SSH server with its own storage (rather than a cloud bucket).",[23,174,175,178,179,182],{},[36,176,177],{},"rsnapshot"," — Veteran, simple, built on ",[115,180,181],{},"rsync"," and hardlinks. Good for fast copies to a local NAS. No encryption, so trust the destination.",[23,184,185,188,189,192,193,196],{},[36,186,187],{},"percona xtrabackup"," or ",[36,190,191],{},"mariabackup"," — For large MySQL\u002FMariaDB databases where ",[115,194,195],{},"mysqldump"," is already taking too long.",[23,198,199,202,203,205],{},[36,200,201],{},"mydumper \u002F myloader"," — A parallelised ",[115,204,195],{},". Still the most comfortable option for databases up to a few hundred GB.",[16,207,208,209,212],{},"If your stack runs Docker, add a periodic dump of the volumes (",[115,210,211],{},"docker run --rm -v vol:\u002Fdata -v $(pwd):\u002Fdest alpine tar czf \u002Fdest\u002Fvol.tgz \u002Fdata","). Don't assume the container image is enough.",[11,214,216],{"id":215},"the-step-almost-no-one-takes-a-test-restore","The step almost no one takes: a test restore",[16,218,219,220,223],{},"A backup you've never restored ",[36,221,222],{},"isn't a backup, it's a hope",". We mean this literally: half the time we've opened a backup chain that \"had been working for years\", we've found one of these:",[20,225,226,229,232,239],{},[23,227,228],{},"Truncated SQL dumps that no one noticed.",[23,230,231],{},"File system permissions blocking half the files.",[23,233,234,235,238],{},"Huge files quietly excluded by an old ",[115,236,237],{},".rsync-filter"," rule.",[23,240,241],{},"Software version mismatches between source and target.",[16,243,244,245,248],{},"The bare minimum sanity check: ",[36,246,247],{},"once a quarter",", spin up a throwaway server, restore the latest backup, and confirm the website boots and the database is queryable. For business-critical setups, once a month.",[11,250,252],{"id":251},"encryption-and-retention-the-two-questions-nobody-asks","Encryption and retention: the two questions nobody asks",[16,254,255,258],{},[36,256,257],{},"Encryption."," If your backup travels to an external provider in the clear, you're handing your database to whoever breaks into that account. restic, borg and duplicity encrypt by default; rsnapshot and rsync don't. Store the encryption key somewhere other than the backup itself (your team password manager works).",[16,260,261,264],{},[36,262,263],{},"Retention."," Keeping 100 daily backups makes no sense. Keeping a policy like this does:",[20,266,267,270,273,276],{},[23,268,269],{},"7 daily backups.",[23,271,272],{},"4 weekly backups.",[23,274,275],{},"12 monthly backups.",[23,277,278],{},"2 yearly backups.",[16,280,281,282,285],{},"That's 25 restore points covering two years, at manageable storage cost. restic and borg do it with a single command (",[115,283,284],{},"forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --keep-yearly 2",").",[11,287,289],{"id":288},"three-real-world-cases-anonymised","Three real-world cases (anonymised)",[16,291,292,295,296,299],{},[36,293,294],{},"Case 1 — The online shop with no off-site backup.","\nA client running a healthy PrestaShop store. Daily backups... on the same VPS, under ",[115,297,298],{},"\u002Fhome\u002Fbackups",". A disk failure at the provider took the server offline for 18 hours. The backups too. They lost 6 days of orders because the last clean copy was from earlier in the week. We switched them to restic + Backblaze B2 + a monthly restore drill.",[16,301,302,305,306,308,309,311],{},[36,303,304],{},"Case 2 — The backup that took 14 hours to restore.","\nServer with an 80 GB database. Backups via plain ",[115,307,195],{},". The night of the incident, the restore took the entire night and half of the next morning. We migrated them to ",[115,310,191],{}," + restic. Restores dropped to 25 minutes.",[16,313,314,317,318,321,322,325,326,329,330,333,334,321,337,340],{},[36,315,316],{},"Case 3 — The files nobody knew existed.","\nA migration off an old server. The backup we got covered ",[115,319,320],{},"\u002Fvar\u002Fwww"," and ",[115,323,324],{},"\u002Fetc\u002Fmysql",". Missing: a ",[115,327,328],{},"\u002Fdata\u002Flegacy"," folder with 12 GB of historical PDFs, the Let's Encrypt certificates under ",[115,331,332],{},"\u002Fetc\u002Fletsencrypt",", and a cron job invoked from another machine over SSH. From that day on, we audit the live machine with ",[115,335,336],{},"lsof",[115,338,339],{},"find"," before scoping any backup.",[11,342,344],{"id":343},"what-it-costs-to-do-this-right","What it costs to do this right",[16,346,347],{},"For a typical VPS with website plus a small database:",[20,349,350,358,364],{},[23,351,352,188,354,357],{},[36,353,165],{},[36,355,356],{},"borg",": free.",[23,359,360,363],{},[36,361,362],{},"Backblaze B2"," or equivalent: around €6 per month per 1 TB stored.",[23,365,366,369],{},[36,367,368],{},"A properly automated and monitored system",": one working day to set up, then cron + email alerts keep it running.",[16,371,372],{},"Compared with the cost of losing a week of orders or being down a full day for a major client, it's easily the best cost-to-benefit ratio in your whole infrastructure.",[11,374,376],{"id":375},"minimum-verification-checklist","Minimum verification checklist",[16,378,379],{},"If you'd rather not read the whole article, here's the actionable summary:",[20,381,384,398,408,421,431,441,451],{"className":382},[383],"contains-task-list",[23,385,388,393,394,397],{"className":386},[387],"task-list-item",[389,390],"input",{"disabled":391,"type":392},true,"checkbox"," You have ",[36,395,396],{},"at least 3 copies"," of your critical data.",[23,399,401,403,404,407],{"className":400},[387],[389,402],{"disabled":391,"type":392}," One copy lives ",[36,405,406],{},"off the production server"," (different provider, different region).",[23,409,411,413,414,420],{"className":410},[387],[389,412],{"disabled":391,"type":392}," Your backup includes ",[36,415,416,417,419],{},"database, code, ",[115,418,128],{},", SSH keys and certificates",".",[23,422,424,426,427,430],{"className":423},[387],[389,425],{"disabled":391,"type":392}," The backup is ",[36,428,429],{},"encrypted"," if it travels to an external service.",[23,432,434,436,437,440],{"className":433},[387],[389,435],{"disabled":391,"type":392}," You have an ",[36,438,439],{},"automated retention policy"," (daily, weekly, monthly).",[23,442,444,446,447,450],{"className":443},[387],[389,445],{"disabled":391,"type":392}," You've ",[36,448,449],{},"restored a test copy"," within the last 3 months.",[23,452,454,393,456,459],{"className":453},[387],[389,455],{"disabled":391,"type":392},[36,457,458],{},"alerts"," if a backup fails (cron alone isn't enough — you need to know).",[16,461,462],{},"If you ticked fewer than 5, there's work to do.",[11,464,466],{"id":465},"frequently-asked-questions","Frequently asked questions",[16,468,469,472],{},[36,470,471],{},"Aren't cloud provider snapshots enough?","\nNo. Snapshots live in the same account and the same provider. Lose access to that account (unpaid invoice, hack, accidental delete) and they're gone too. They're a useful fast layer, not a single line of defence.",[16,474,475,478],{},[36,476,477],{},"Is RAID a backup?","\nNo. RAID protects you from a disk failure, not from an accidental delete, ransomware, an application bug or a human mistake. They solve different problems.",[16,480,481,488],{},[36,482,483,484,487],{},"Is ",[115,485,486],{},"git"," enough for the code?","\nFor the code, yes — assuming everything is committed. But it doesn't cover user uploads, the database or system configuration. You still need the complementary piece.",[16,490,491,494],{},[36,492,493],{},"Do I need encryption if the target is my own server in another datacenter?","\nYes. Encryption is cheap and it protects you if that other server ever ends up in the wrong hands for any reason. There's nothing to lose by encrypting every time.",[11,496,498],{"id":497},"wrapping-up","Wrapping up",[16,500,501],{},"Good backups aren't hard, but they do require sitting down for a working day to think through scope, pick tools, automate the job and leave it monitored. The expensive option is not doing it, and finding out on the worst possible day.",[16,503,504,505,420],{},"If you'd like us to review your infrastructure's backups, find the gaps and leave a 3-2-1 setup running, ",[506,507,509],"a",{"href":508},"\u002Fen\u002Fcontacto\u002F","let's talk, no strings attached",{"title":511,"searchDepth":512,"depth":512,"links":513},"",2,[514,515,516,517,518,519,520,521,522,523,524],{"id":13,"depth":512,"text":14},{"id":42,"depth":512,"text":43},{"id":73,"depth":512,"text":74},{"id":154,"depth":512,"text":155},{"id":215,"depth":512,"text":216},{"id":251,"depth":512,"text":252},{"id":288,"depth":512,"text":289},{"id":343,"depth":512,"text":344},{"id":375,"depth":512,"text":376},{"id":465,"depth":512,"text":466},{"id":497,"depth":512,"text":498},"2026-05-09","When you actually need that backup, there's no time to improvise. Here's the 3-2-1 rule, which tools to pick and the typical mistakes we keep running into on urgent calls.","md","\u002Fog\u002Fog-default.png",{},"backups-servidores-linux-2026","\u002Fen\u002Fblog\u002Flinux-server-backups-2026",{"title":5,"description":526},"en\u002Fblog\u002Flinux-server-backups-2026",[535,536,537,538],"Servers","Linux","Backups","Security","_V_IGwfoqTYt4yWFuwkxkaFLD0SXK307UxMbIRi2Jnk",1778944558545]