Backup from the Cloud (Google G Suite)
Creation Date: April 17, 2013
Revision Date: August 28, 2018
Product: DS‑Client (Windows)
Summary
This article contains important information about the Backup from the Cloud (Google G Suite) backup set kind. Read this article carefully before attempting to create this kind of backup set.
NOTE: Google, G Suite, Gmail, Google Calendars, Google Docs, Google Drive, Google Sites, and Google Contacts are all trademarks of Google Inc. These trademarks and related terminologies are used solely for the purpose of describing expected configuration and/or behavior to ensure proper use of the software described in this document.
For the remainder of this article, the term “Google G Suite backup set” will be used as an abbreviation for “Backup from the Cloud (Google G Suite) backup set”.
See also:
Prerequisites for backup and restore of G Suite data
The following prerequisites must be met before you can perform backups for G Suite data.
Google domain, administrative account, and end-user accounts required:
It is assumed that you already have an existing G Suite domain on which there are active end-user G Suite accounts that need to be backed up.
You must also have a Google administrative account that has the permission to access all end-user accounts to be backed up from that domain.
G Suite DS-Client plug-in required on DS-Client computer:
You must install the G Suite DS-Client plug-in on the DS-Client computer. The plug-in installation file can be found on the installation DVD in the following folder:
• \Software\DS-Client\DS-Client_FullFeatured\Windows_64_bit\plugins\install.exe
DS-NOC on Windows recommended for G Suite backups:
We recommend using the Cloud Management System in DS-NOC (Windows) rather than DS-User to create, configure, and schedule G Suite backup sets. DS-NOC on Linux does not support G Suite backups.
The Cloud Management System in DS-NOC automates the process for creating and scheduling Backup from the Cloud (Google G Suite) backup sets for multiple users according to your specified settings. It can divide backup sets among multiple DS-Client instances and distribute multiple credentials among many backup sets. It is also a centralized interface for monitoring these backup sets.
After the backup sets have been created and scheduled using the Cloud Management System in DS-NOC, you can use DS-User to initiate on-demand backups or restore the data as necessary.
IMPORTANT: Do not use DS-User to modify the properties of a G Suite backup set that was created in DS-NOC. In particular, changing the backup set name or the schedule in this manner can adversely affect the operation of the system.
Required network connections:
• Ensure that the following network requirements are met:
• The DS-Client computer has Internet connection and is able to connect to your G Suite domain on which data needs to be backed up.
• DS-User is able to connect to the G Suite domain on which data needs to be backed up.
• To create, schedule, configure, or monitor G Suite backup sets via DS‑NOC, ensure that the web server hosting DS‑NOC is able to connect to your G Suite domain on which data needs to be backed up.
• If the DS-NOC service, the DS-Client service, or the DS-User application is behind a proxy server, ensure that the respective proxy server settings are configured.
• For the DS-NOC service, see instructions on configuring Apache Tomcat to use a proxy server in the Server Software Installation Guide.
G Suite domain and account requirements:
Before performing Google G Suite backups, do the following.
1. Sign in to Gmail using the super admin user account.
2. On the Settings menu, click Manage this domain.
3. Enable API access as follows:
a) Sign in to the Google Admin console for your G Suite domain.
b) On the Security menu, click Settings.
c) Click API reference.
d) Ensure that the Enable API access check box is selected.
4. Create a project and enable the required G Suite APIs for the project as follows:
a) Sign in to the Google Cloud Platform console for your G Suite domain.
b) Create a project.
c) On the APIs and Services menu, click Dashboard.
d) On the Dashboard page, click Enable APIs and Services.
e) On the API Library page, search for and enable the following Google APIs:
• Admin SDK
• CalDAV API
• Contacts API
• Gmail API
• Google Calendar API
• Google Drive API
5. Create credentials for the service account as follows:
a) Sign in to the Google Cloud Platform console for your G Suite domain.
b) On the IAM & admin menu, click Service accounts.
c) On the Service accounts page, click Create Service Account.
d) Create a service account. Ensure that the project role is set as Owner and the Enable G Suite Domain-wide Delegation option is enabled. An OAuth 2.0 client ID is automatically generated for the service account.
NOTE: You must generate the credentials that are required based on the logon mode that will be used during backup configuration and backup and restore activities. The credentials will be used to access the backup source and restore destination. The Service account logon mode allows access to one or multiple user accounts on your G Suite domain. This mode is available in DS-User and is the only logon mode in DS-NOC. The Client ID for native application logon mode allows access to one G Suite user account only. This mode is available in DS-User only.
6. Create encryption keys for the service account as follows:
a) Sign in to the Google Cloud Platform console for your G Suite domain.
b) On the IAM & admin menu, click Service accounts.
c) On the Service accounts page, select the service account you created, and then click Create key on the Actions menu.
d) Create a private key in JSON format for the service account, download the key, and store it in a secure location.
e) Create a private key in P12 format for the service account, download the key, and store it in a secure location.
NOTE: The encryption keys are used for the credentials when logging on to DS-Client and DS-NOC.
7. Locate and record the Client ID as follows:
a) Sign in to the Google Cloud Platform console for your G Suite domain.
b) On the APIs and Services menu, click Credentials.
c) On the Credentials page, locate the project you created and copy the Client ID.
8. Configure the OAuth 2.0 client ID of the service account to use the required API scopes as follows:
a) Sign in to the Google Admin console for your G Suite domain.
b) On the Security menu, click Settings.
c) Click Advanced Settings, and then click Manage API client access.
d) In the Client Name box, paste the Client ID.
e) In the One or More API Scopes box, add the following API scopes separated by a comma, and then click Authorize.
• https://mail.google.com/
• https://sites.google.com/feeds/
• https://www.google.com/calendar/feeds/
• https://www.google.com/m8/feeds/
• https://www.googleapis.com/auth/admin.directory.user
• https://www.googleapis.com/auth/calendar
• https://www.googleapis.com/auth/drive
Internet Explorer 8 or a later version required for DS-User:
You must ensure that Internet Explorer 8 or a later version is installed on the computer on which DS-User is running. This allows authentication with G Suite accounts in the Restore Now Wizard when you initiate a restore of G Suite data, and in the New Backup Set Wizard if you plan to create Google G Suite backup sets using the DS-User.
G Suite backup issues
• Google Document Form items are composed of two parts:
• one item of type application/vnd.google-apps.form
• one item of type application/vnd.google-apps.spreadsheet
• Backup and restore of the application/vnd.google-apps.spreadsheet item is supported.
• Backup and restore of the application/vnd.google-apps.form is not supported.
• If Google introduces new document types that are not immediately supported by DS-Client, there might be an error if you try to backup an unsupported item.
• After editing a native Google file in Drive, it can take Google several minutes to note that the file has changed. Any backup that is run before Google has updated the file's Last Modified Date, Google will assume the file has not changed and ignore it. To prevent this, allow Google time to update a file's metadata before running a backup.
• Troubleshooting Calendar backup: In high use environments, you can encounter events with Google Calendar backups if the G Suite site temporarily enters the Read-Only mode. For a detailed description, see the Google article “Calendar Usage Limits”:
https://support.google.com/a/answer/2905486?hl=en
• DS-Client backup size does not match with Google’s actual size because Google displays the size of items in their native format, whereas DS-Client processes data that is specifically meant for backup.
• Contact groups are not supported.
• With each G Suite backup set that contains Sites as a backup item, a maximum of 25 sites can be backed up for each G Suite user account. If the G Suite user account contains more than 25 sites, only 25 sites are arbitrarily chosen among all the sites and then backed up. If a viewer comment on a site does not appear in the comment feed, the comment cannot be backed up.
• Sometimes G Suite backup items are not backing up the first time: The files that are backed up depend on the result of the item listing at the start of the backup activity. Since there are no errors, the entire operation has performed as expected. Other than errors during the listing, DS-Client has no other method of knowing if it has not acquired the entire list since that number depends on the list itself. All affected files should be backed up during the next backup activity.
G Suite restore issues
• When restoring large files, DS-Client can experience timeouts. To resolve this issue, increase the timeout value in the advanced parameter
GAppsRestoreCompleteTimeout. For more information, see
“Configuring the advanced settings”.
NOTE: Note that DS-Client will retry restoring the file according to the advanced parameter GAppsRequestRetry.
• Failed restores can mistakenly report the failed file's size in the Restored Amount in the process dialog or event log. This will not affect billing. For an accurate measure of restored data, note Event #40000552: Restore Capacity Consumed in the Event Log for the Restore activity.
• If a Google Drive file is deleted from the user's Drive account and restored from a backup, any backup set which explicitly refers to the file will need to be changed to point to the new file. File-level backups get Drive files by ID, and a restored file is automatically given a new ID by Google.
• One of the following permissions is required for the restore of G Suite Calendar. To edit these permissions, go to Calendar Settings > Share this Calendar and set one of the following:
• owner = “Make changes AND manage sharing” OR
• writer = “Make changes to events”
• Backup and restore of Attachments in G Suite Calendar Events are not supported.
G Suite behavior when restoring G Suite sites to their original location:
• When you take the backup of a site and delete it from the cloud before restoring, the site does not get immediately deleted. Google takes some time to completely delete the site. You can verify this by navigating to Deleted Sites, where you will see the status as Still Deleting Site....
• If you restore before the site is completely deleted from the cloud, Google will append some numeric value to the original webspace name and create the site in that webspace because the webspace name of the site (found in the Site’s URL) must be unique.
G Suite behavior when restoring a document to alternate location:
• When restoring a document to an alternate location, sometimes that document might not be immediately visible in the G Suite My drive location. If this occurs, wait a couple of minutes and then check again. The document should be immediately visible if you look in the All Items location.
• Contents of similarly named folder paths (e.g. “/folder 1/folder 2” and
/folder1/folder2) will be merged during restore. This also applies to original location restore, if the source folders have been deleted.