Each month I manually review backups for several customers using a standard checklist and then generate a report to send them. The checks usually involve confirming that database dumps, firewall configuration files, and other backups exist, have the expected size, and meet other basic parameters on FTP/SFTP servers and Synology NAS devices. Because the systems are on customer networks, I connect through VPN and log in to each storage location. The process only takes about 15–30 minutes per customer, but across all customers it consumes one or two full workdays every month. It is repetitive, yet important enough that I do not want to rely on a superficial check. Annual recovery tests are already performed separately, but I want to detect a backup outage within a month rather than discovering several weeks of missing database backups. How would you automate this, and what approaches do larger organizations use to verify that backups are actually running?
2 Answers
Monitoring is the usual first step: have the backup system report successful and failed jobs, alert when a job is late, and track repository capacity and retention. However, a message saying that a job completed is not the same as proving the backup can be restored. For stronger assurance, automate periodic isolated restore tests for representative files, databases, or virtual machines and record the result. You can then keep the monthly checks focused on exceptions while performing deeper recovery validation on a less frequent schedule.
If the customers can support it, a proper backup platform such as Veeam can centralize job status, retention checks, repository health, and alerting. It is reliable and gives you reporting instead of requiring someone to inspect files manually. If that software is not suitable for these environments, you could build a smaller equivalent with scripts and monitoring: connect over the VPN, check expected files and timestamps, validate sizes or hashes where practical, and send a report only when something is missing or abnormal. The important part is making the checks run on a schedule and alerting on failures rather than relying on a monthly manual review.
A commercial backup platform is not always an option, especially when customers have different infrastructure or licensing restrictions. In that case, scheduled scripts plus centralized monitoring can still remove most of the repetitive work, as long as the scripts themselves are monitored and their results are retained.
Some audits specifically require evidence that a restore worked, such as restoring a virtual machine into an isolated network and recording screenshots or logs. That is different from simply confirming that backup files exist, so both types of checks may be needed.