You can schedule recurring VM snapshots to a cloud file system, which you can later use when you fail over to a Recovery SDDC and for ransomware recovery.

You can view snapshots for a protection group by navigating to Protection Groups view and then selecting one of the snapshot in the group. A protection group can take two types of snapshots, standard-frequency or high-frequency.
Note: A protection group can have only one snapshot type.

Snapshots Details

For every snapshot, you can view the following details:
Detail Description
Name Name of the VM included in the snapshot.
Origin vCenter Protected site vCenter where the VM snapshot resides.
Snapshot type Either standard-frequency or high-frequency.
Transferred bytes The logical size of transferred data from the protected site to the cloud file system in a snapshot. The actual physical size of transferred data might be smaller due to compression.
Change rate

The logical VM data change rate since the previous snapshot.

Note: For the first snapshot of a VM after a product upgrade, 'Change Rate' is not reported.

Change rate can be useful for detecting anomalous snapshot behaviors. For example, a very high change rate outside of normal expectations might indicate an unplanned encryption event related to a ransomware attack.

For Transferred bytes, these two caveats apply:
  • Transferred Bytes and VM changes during snapshot initial seeding. When using standard -frequency snapshots, any failures or interruptions at the time of initial seeding can impact 'Transferred bytes' as reported in the UI, so the value might be lower or larger than the logical size of the VM. When using high-frequency snapshots, if there are changes on the source VM while initial seeding is in progress, then the reported Transferred bytes might be larger than the logical size of the source VM.
  • Transferred Bytes for snapshot replication different depending on VM disk provisioning. When a new disk is added to a VM that is being protected by high-frequency snapshots, the Transferred Bytes value for the snapshot task depends upon the type of datastore and provisioning of the disk. For example, if the disk is on vSphere Virtual Machine File System (VMFS) datastore and is provisioned “lazy zeroed,” then Transferred Bytes counts only the bytes that are allocated on the disk. If the disk is provisioned “eager zeroed” then all the bytes are accurately reports in Transferred Bytes. (For more information, see About Virtual Disk Provisioning Policies.) When increasing the size of disk, Transferred Bytes might not show the extended size as Transferred Bytes, depending on the method used to increase the disk capacity.