Backup from the Cloud (G Suite)
Creation Date: April 17, 2013
Revision Date: December 22, 2016
Product: DS‑Client (Windows)
Summary
This article contains important information about the Backup from the Cloud (G Suite) backup set kind. Read this article carefully before attempting to create this kind of backup set.
NOTE: Google, G Suite, Gmail, Google Calendars, Google Docs, Google Drive, Google Sites, and Google Contacts are all trademarks of Google Inc. These trademarks and related terminologies are used solely for the purpose of describing expected configuration and/or behavior to ensure proper use of the software described in this document.
For the remainder of this article, the term “G Suite backup set” will be used as an abbreviation for “Backup from the Cloud (G Suite) backup set”.
See also
Prerequisites for backup and restore of G Suite data
The following prerequisites must be met before you can perform backups for G Suite data.
Google domain, administrative account, and end-user accounts required
It is assumed that you already have an existing G Suite domain on which there are active end-user Google accounts that need to be backed up.
You must also have a Google administrative account that has the permission to access all end-user accounts to be backed up from that domain.
G Suite DS-Client plug-in required on DS-Client computer
You must install the G Suite DS-Client plug-in on the DS-Client computer. The plug-in installation file can be found on the installation DVD in the following folders:
• \Software\DS-Client\Windows_64_bit\plugins\install.exe
• \Software\DS-Client\Windows_32_bit\plugins\install.exe
DS-NOC on Windows recommended for G Suite backups
We recommend using the Cloud Management System in DS-NOC (Windows) rather than Classic DS-User to create, configure, and schedule G Suite backup sets. DS-NOC on Linux does not support G Suite backups.
The Cloud Management System in DS-NOC automates the process for creating and scheduling Backup from the Cloud (G Suite) backup sets for multiple users according to your specified settings. It can divide backup sets among multiple DS-Client instances and distribute multiple credentials among many backup sets. It is also a centralized interface for monitoring these backup sets.
After the backup sets have been created and scheduled using the Cloud Management System in DS-NOC, you can use Classic DS-User to initiate on-demand backups or restore the data as necessary.
IMPORTANT: Do not use Classic DS-User to modify the properties of a G Suite backup set that was created in DS-NOC. In particular, changing the backup set name or the schedule in this manner can adversely affect the operation of the system.
Required network connections
• Ensure that the following network requirements are met:
• The DS-Client computer has Internet connection and is able to connect to your G Suite domain on which data needs to be backed up.
• The DS-User is able to connect to the G Suite domain on which data needs to be backed up.
• To create, schedule, configure, or monitor G Suite backup sets via DS‑NOC, ensure that the web server hosting DS‑NOC is able to connect to your G Suite domain on which data needs to be backed up.
• If the DS-NOC service, the DS-Client service, or the DS-User application is behind a proxy server, ensure that the respective proxy server settings are configured.
• For the DS-NOC service, see instructions on configuring Apache Tomcat to use a proxy server in the Server Software Installation Guide.
G Suite domain and account requirements
Before performing G Suite backups, you must ensure that all of the following requirements have been met in the order presented below.
1. Enable API access:
a) Log on to the Google Admin console for your G Suite domain.
b) In Security settings, ensure that API access is enabled.
2. Create a project and enable required G Suite APIs:
a) Log on to the Google API Console for your G Suite domain.
b) In the Google API Console, create a new project.
c) In your project, ensure that all of the following G Suite APIs are enabled:
• Drive API
• Calendar API
• Gmail API
• Admin SDK
• Contacts API
• CalDAV API
3. Generate credentials for your logon mode:
You must generate the credentials that are needed based on the logon mode that will be used during backup configuration and backup activities. During these activities, credentials will be used to access the backup source.
The Service account logon mode allows access to one or multiple Google user accounts on your G Suite domain. This mode is available in Classic DS-User and is the only logon mode in DS-NOC. To use the Service account logon mode, generate these credentials:
• OAuth 2.0 client ID for a service account in the project. This client ID is automatically generated when G Suite Domain-wide Delegation is enabled for the service account.
• a JSON file that contains the service account client email address. Currently, a JSON-format private key file generated for the service account will fulfill this requirement.
• One PKCS12-format (P12) private key for the same service account above.
The Client ID for native application logon mode allows access to one Google user account only. This mode is available in Classic DS-User only. To use the Client ID for native application logon mode, generate these credentials:
• One OAuth 2.0 client ID for native (or Other) applications
• One JSON file containing information for the client ID created in (d).
To generate credentials for logging on using a service account, do the following:
a) Log on to the Google API Console for your G Suite domain.
b) Go to the project that you have created with all required G Suite APIs enabled.
c) In your project’s Permissions, create a new service account with the option Enable G Suite Domain-wide Delegation selected.
An OAuth 2.0 client ID is automatically generated for this service account when the option Enable G Suite Domain-wide Delegation is selected.
d) In your project’s API Manager, generate a private key in JSON format for the service account.
e) Download the key and store it in a secure location.
f) In your project’s API Manager, generate a private key in PKCS12 format (P12) for the service account.
g) Download the key and store it in a secure location.
To generate credentials for logging on using a client ID for native application, do the following:
a) Log on to the Google API Console for your G Suite domain.
b) Go to the project that you have created with all required G Suite API enabled.
c) In your project’s API Manager, generate an OAuth 2.0 client ID for the application type Other.
d) Download a JSON file for the OAuth 2.0 client ID generated in the previous step and store it in a secure location.
4. (Applicable to service account logon only) Authorize the client ID of the service account to use API scopes
If you will use a service account for logging on, you must also authorize the OAuth 2.0 client ID of the service account to use all required API scopes.
a) Log on to the Google Admin console for your G Suite domain.
b) In Security settings, authorize the OAuth 2.0 client ID of the service account to use all of the following API scopes:
• https://mail.google.com/
• https://sites.google.com/feeds/
• https://www.google.com/calendar/feeds/
• https://www.google.com/m8/feeds/
• https://www.googleapis.com/auth/admin.directory.user
• https://www.googleapis.com/auth/calendar
• https://www.googleapis.com/auth/drive
Internet Explorer 8 or a later version required for Classic DS-User
You must ensure that Internet Explorer 8 or a later version is installed on the computer on which Classic DS-User is running. This allows authentication with Google accounts in the Restore Now Wizard when you initiate a restore of G Suite data, and in the New Backup Set Wizard if you plan to create G Suite backup sets using Classic DS-User.
G Suite backup issues
• Google Document Form items are composed of two parts:
• one item of type application/vnd.google-apps.form
• one item of type application/vnd.google-apps.spreadsheet
• Backup and restore of the application/vnd.google-apps.spreadsheet item is supported.
• Backup and restore of the application/vnd.google-apps.form is not supported.
• If Google introduces new document types that are not immediately supported by DS-Client, there might be an error if you try to backup an unsupported item.
• After editing a native Google file in Drive, it can take Google several minutes to note that the file has changed. Any backup that is run before Google has updated the file's Last Modified Date, Google will assume the file has not changed and ignore it. To prevent this, allow Google time to update a file's metadata before running a backup.
• Troubleshooting Calendar backup: In high use environments, you may encounter events with Google Calendar backups if the G Suite site temporarily enters the Read-Only mode. For a detailed description, see the Google article Calendar Usage Limits:
https://support.google.com/a/answer/2905486?hl=en
• DS-Client backup size does not match with Google’s actual size because Google displays the size of items in their native format, whereas DS-Client processes data that is specifically meant for backup.
• G Suite Contact Groups: As of the revision date of this article, contact groups are not supported (listing, backup, restore).
• G Suite Site Comments: If a comment for a G Suite site does not appear in the feed, it cannot be backed up.
• Sometimes G Suite backup items are not backing up the first time: The files that are backed up depend on the result of the item listing at the start of the backup activity. Since there are no errors, the entire operation has performed as expected. Other than errors during the listing, DS-Client has no other method of knowing if it has not acquired the entire list since that number depends on the list itself. All affected files should be backed up during the next backup activity.
G Suite restore issues
• When restoring large files, DS-Client may experience timeouts. To resolve this issue, increase the timeout value in the DS-Client advanced parameter:
Miscellaneous >
GAppsRestoreCompleteTimeout. Note that DS-Client will retry restoring the file according to the advanced parameter
GAppsRequestRetry. (see
“DS-Client Advanced Configurations”)
• Failed restores may mistakenly report the failed file's size in the Restored Amount in the process dialog or event log. This will not affect billing. For an accurate measure of restored data, note Event #40000552: Restore Capacity Consumed in the Event Log for the Restore activity.
• If a Google Drive file is deleted from the user's Drive account and restored from a backup, any backup set which explicitly refers to the file will need to be changed to point to the new file. File-level backups get Drive files by ID, and a restored file is automatically given a new ID by Google.
• UNC paths are not supported for G Suite backup sets for local disk restores. They do not appear in the dialog that appears when you click the browse button to choose a restore location.
• One of the following permissions is required for the restore of G Suite Calendar. To edit these permissions, go to Calendar Settings > Share this Calendar and set one of the following:
• owner = "Make changes AND manage sharing" OR
• writer = "Make changes to events"
• Backup and restore of Attachments in G Suite Calendar Events are not supported.
G Suite behavior when restoring G Suite sites to their original location:
• When you take the backup of a site and delete it from the cloud before restoring, the site does not get immediately deleted. Google takes some time to completely delete the site. You can verify this by navigating to Deleted Sites, where you will see the status as Still Deleting Site....
• If you restore before the site is completely deleted from the cloud, Google will append some numeric value to the original webspace name and create the site in that webspace because the webspace name of the site (found in the Site’s URL) must be unique.
G Suite behavior when restoring a document to alternate location:
• When restoring a document to an alternate location, sometimes that document may not be immediately visible in the G Suite My drive location. If this occurs, wait a couple of minutes and then check again. The document should be immediately visible if you look in the All Items location.
• Contents of similarly named folder paths (e.g. “/folder 1/folder 2” and
/folder1/folder2) will be merged during restore. This also applies to original location restore, if the source folders have been deleted.