What is a backup agent?
A backup agent is a small program installed on a server or computer that reads its data and sends it to the backup system.
Virtual machines can often be backed up from outside, through the hypervisor that runs them. Physical servers, cloud instances, laptops and many databases have no such outside view, so an agent does the work from within.
A helper on the inside
Think of a courier who is let into the office to pack the boxes, instead of waiting at the door for whatever is handed out. Because the agent runs inside the machine, it knows which applications are running and what has changed.
That inside view does three useful things. It asks databases and mail servers to finish pending writes first, so the copy opens cleanly later. It keeps track of changed disk blocks, so the next job reads only what is new. And it can compress and encrypt the data before it leaves the machine.
Agent or agentless
| Approach | How data is read | Best fit |
|---|---|---|
| Installed agent | A service running all the time on the machine | Physical servers, laptops, cloud instances |
| Application plug-in | The application's own backup interface | Databases and mail systems |
| Agentless | A snapshot taken through the hypervisor | Virtual machines |
The choice also decides what can be restored later. An agent that captures whole disks makes a bare-metal restore possible. One that copies only files can bring back data, but never a server that boots.
Where agents cause trouble
- Silent failure. An operating system update, an expired certificate or a firewall change can stop an agent without any alarm.
- Missing machines. A server that never got an agent is simply unprotected and shows up on no failure list.
- Too much power. Agents run with full system rights and take orders from the backup software. Whoever controls that console can reach every protected machine.
- Keys on the host. When an agent writes straight to storage, its access key sits on the machine. A key that can delete lets ransomware on one server erase backups for all of them.
Keeping each key's reach small is the idea behind administrative blast radius. Coverage reports that list every machine, with or without an agent, close the second gap. The wider basics of data backup apply to agents like any other source.
ARTESCA and backup agent
No ARTESCA software runs on protected machines. Agent data reaches ARTESCA through the backup application, or directly over S3 using access keys from ARTESCA's own accounts. Those keys can be limited to specific buckets and actions, and they have nothing to do with the host's operating system logins.
A key stolen from an infected server still works for whatever it is allowed to do. Restore points held under S3 Object Lock in compliance mode stay in place until their retain-until date, whatever that key requests. Agent health and coverage gaps are not visible from ARTESCA.
Related terms
- Backup Software: the application that schedules jobs and directs agents.
- Bare-Metal Restore: rebuilding a whole system onto hardware with nothing installed.
- Credential Theft: the stealing of passwords, keys and tokens used to sign in.
- Administrative blast radius: how much one compromised administrative identity can reach.