Image-level and bare-metal backups of the ESXi hypervisor are not supported

Products

VMware vSphere ESXi

Issue/Introduction

You want to protect an ESXi host and you ask whether you can capture the ESXi operating system with an image-level or bare-metal backup tool.

This article confirms that image-level and bare-metal backups of the ESXi hypervisor itself are not a supported backup or recovery method. This includes any tool that takes a block-level or full-disk image of the ESXi boot device.

ESXi is protected differently from a general purpose server. You do not image the hypervisor, or run an in-guest backup agent on it, the way you protect a Windows or Linux server. An expectation that ESXi hosts are imaged like every other server in the datacenter does not match the supported design. ESXi is built to be reinstalled, not restored from a disk image.

The supported way to protect an ESXi host is to back up the host configuration and reinstall the host if it fails. That method is described in the Resolution section below.

Environment

VMware vSphere ESX 9.0

VMware vSphere ESXi 8.x

VMware vSphere ESXi 7.x

VMware vSphere ESXi 6.x

Cause

ESXi is not a general purpose operating system that lives on a single, static disk volume. Its design means that a disk image of the boot device cannot be relied on to produce a consistent, bootable copy of the host.

The main reasons are:

ESXi runs largely from memory after boot. A block-level image of the boot device does not capture the running in-memory state of the host.
The ESXi boot device uses a dual-bank layout. It holds two boot banks, the active bootbank and the standby altbootbank. An image taken while the host is running can capture these banks in an inconsistent state, which can leave the copy unable to boot.
Configuration changes are written to persistent storage on a schedule, not continuously. An image can capture the boot device before recent changes have been saved.
Starting in vSphere 7.0 Update 2, the host configuration can be encrypted with the host TPM. A raw image of the device does not give you a usable, restorable configuration on different hardware.

The vSphere framework that backup vendors use for image-based backup is vSphere Storage APIs - Data Protection (VADP). VADP is built to back up virtual machines. It does not provide a way to capture the ESXi hypervisor. There is no supported API or mechanism that images the host operating system.

Because of this, imaging the ESXi boot device falls outside the supported procedures. The supported method protects the host configuration instead of the disk image.

Resolution

To protect an ESXi host, back up the host configuration. This is the supported method to capture and later restore a host's settings.

Use one of the supported toolsets to back up the host configuration:

ESXi command line (vim-cmd)
vSphere CLI (vSphere 6.7 and earlier only)
vSphere PowerCLI

For the exact backup and restore commands, follow the steps in the host configuration article listed under Additional Information (KB 313510).
To recover a failed host, do a fresh install of ESXi, then restore the saved configuration bundle. The restore has two requirements:

The destination build number must match the build the backup was taken from.
The host UUID must match the UUID in the backup.

Understand what the configuration backup does not include:

It does not include virtual machine data. After a restore, re-inventory the virtual machines from the datastore.
It does not include bootbank data. If you need that, back it up separately as described in KB 313510.

To protect the virtual machines running on the host, use a backup product based on vSphere Storage APIs - Data Protection (VADP). These products back up virtual machines, not the ESXi hypervisor. See KB 311197 under Additional Information.

Imaging or cloning the ESXi boot device with a bare-metal or block-level backup tool is not supported, and it is not a supported recovery path. If a host fails, rebuild it with a fresh ESXi install at the matching build and restore the host configuration.

Additional Information

For the supported backup and restore steps, see How to back up and restore the ESXi host configuration.

For details on the framework used for virtual machine image backups, see FAQ: VMware vSphere Storage APIs - Data Protection.

Notes and exceptions for host configuration backup and restore:

Host configuration backup and restore is not supported on Distributed Services Engine configurations, meaning ESX hosts with DPUs.
Host configuration backup and restore does not apply to hosts provisioned with Auto Deploy. For those hosts, the state comes from the image profile and host profile on the Auto Deploy server.
If you do not need to keep the same host UUID, Host Profiles can also back up and restore the host configuration.