Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ for VMware Administrator's Guide
  3. Best practices and more information
  4. Best practices for VMware tag usage
NetBackup™ for VMware Administrator's Guide

Best practices for VMware tag usage

Use unique tag names whenever possible

The combination of Category and Tag uniquely identifies a tag association to a virtual machine. Veritas, however, does not support selection of virtual machines based on Category. As such, avoid the creation of tags with identical names in different Categories.

When you create a VMware Intelligent Policy and select virtual machines based on tags, identical tag names in different categories may have unintended consequences. All virtual machines with the tag name are selected independent of the Category. Be aware of this behavior as you create your VMware Intelligent Policies.

Use a primary server or a media server as a discovery host for VMware Intelligent Policies that use tags

Because tag queries require Java, the discovery host used for VMware Intelligent policies must have Java installed. NetBackup primary servers have Java installed by default. Java is an optional component for NetBackup media servers and for UNIX and Linux clients, and may or may not be installed in your environment. Windows clients that are used as a discovery host require a separate installation of the Remote Console.

Successful use of tags in a mixed vCenter Server environment

NetBackup support for VMware tags begins at vCenter 6.0. In a mixed vCenter Server environment (e.g. 5.x and 6.0), a VMware Intelligent Policy query that uses the Tag keyword can return some virtual machines as Failed if the configuration of the query requires tag evaluation on a 5.x vCenter. This behavior is observed when you select Test Query during policy configuration. This behavior is also observed when you run the policy. The parent (discovery) job exits with a non-zero status and its details enumerate the virtual machines that Failed. The virtual machines that the query has included are backed up normally.

You can use any of the options that are shown to create a query that uses tags but does not report virtual machines on 5.x servers as Failed.

  • Use another field to limit tag evaluation to the supported vCenter Server versions.

    Example: vCenterVersion GreaterEqual "6.0.0" AND Tag Equal "Production"

    Example: vCenter Equal "vcenter-123" AND tag Equal "Production"

  • Use the VMware Server List option under the Advanced Attributes on the VMware tab to restrict the policy to a supported list of vCenter Servers.

    See Table: VMware Advanced Attributes.

  • Enable the Treat Tags as unset if unable to evaluate option under the Advanced Attributes on the VMware tab.

    See Table: VMware Advanced Attributes.

Place tag clause at the end of the VMware Intelligent Policy query

Place the tag clause toward the end of the VMware Intelligent Policy query. This configuration allows NetBackup to eliminate as many virtual machines as possible before it evaluates the tag portion of the query. This organization optimizes the performance of discovery and selection of virtual machines.

Consider the query: Powerstate Equal poweredOn AND Tag Equal "Production"

In the example, the first clause automatically eliminates all virtual machines that are poweredOff. The query does not need to evaluate the tag clause of the query for all of those virtual machines.

Tag backup and restore are best effort

Tag associations are part of the metadata of the virtual machine. NetBackup considers virtual machine tag association protection a best effort backup. Any tag collection errors are shown in the Activity Monitor for the virtual machine snapshot job.

Feedback

Was this page helpful?
Previous

NetBackup for VMware with deduplication

Next

Further assistance with NetBackup for VMware

Feedback

Was this page helpful?