Enterprise Workloads Editions: ✅ Business | ✅ Enterprise | ✅ Elite

This article describes how to view details such as backup configuration, recovery points, backup types, and cybersecurity event information from the Configured VMs page.

Procedure

Log in to the Management Console.
Select your organization if organizations are enabled.
Click Protect > VMware.
The All vCenters/ESXi Hosts page appears that lists all the registered vCenters/Hypervisors.
Select the vCenter/ESXi Host. Click Configured VMs.
Click the virtual machine. You’ll see the Summary, Backups, and Trends tabs.

Summary

The Summary tab provides details about backup, type of recovery points, configuration details, backup status, and data change rate trends.

Field	Description
Details	This section summarizes the following details: If the backup is enabled Host name Number of Hot, Warm, and Cold recovery points Administrative Group If the DR Plan is configured or not CBT status for a virtual machine
Backup Configuration details	This section provides configuration details such as: Backup policy App Aware Processing Long Term Retention (LTR) Backup Proxy Pool Exclude Disks Retention Storage
Backup Trend	This section displays backup jobs for the last seven days with the following three statuses: Backups successful Backups successful with errors Backups failed
Backup Data Trend	This section illustrates the following data for the last 90 days: Source + Changes: The amount of backup data generated at the source. This includes the initial full backup and incremental data from all subsequent backups. Current Source: The size of the data on the source server(s) at the time of the last backup.
Data Change Rate Trend	This section illustrates the following data for the last 90 days: Data Growth: Difference between the data sizes of the source data and the total source + changes data. Average Change Rate: Average of the daily change rate for a backup set calculated since the time of the first backup.

Backups

The Backups tab displays a card with details such as total recovery points, number and type of recovery points, and the latest and oldest recovery points.

In addition, it includes the Operational Recovery and Cyber Recovery tabs.

You can switch between the Operational Recovery view and the Cyber Recovery view.

Operational Recovery

The Operational Recovery view displays the following columns:

Recovery Point: Indicates the state of the backup data at a particular point-in-time.
Recovery Point Type: Indicates the type of recovery point.
Size: Indicates the size of a recovery point.

You can select the recovery point and click Restore to view all the supported restore options and perform the restore.

Cyber Recovery

The Cyber Recovery view displays the recovery points with additional information related to cybersecurity events such as threats detected, files activity, size, and data changes.

You can also select the recovery point and click Cyber Restore to view all the supported restore options, and perform the restore.

📝 Note

You must have either a Security Posture & Observability, Accelerated Ransomware Recovery, or a premium license to view and access the Recovery Insights feature.

To view and access the Recovery Insights details for the Threat Hunting feature, the Premium license is mandatory.
For more information, see Cyber Resiliency documentation.

The Cyber Recovery view displays the following columns:

Recovery Point: Specifies recovery points for restore. You can select a recovery point and perform a Cyber Restore. For more information, see Cyber Resiliency documentation.
Data Change: Specifies the amount of data that is changing in the virtual machine between two consecutive backups, as reported by Changed Block Tracking (CBT). For more information, see FAQs.

📝 Note
You must upgrade the VMware proxy to the latest version to view the data change details. Otherwise, the column will display empty dashes (-) instead of the actual data change values.
Created: Specifies the new files that were created after the backup.
Deleted: Specifies the existing files that were deleted after the backup.
Modified: Specifies the existing files modified after the backup.
Encrypted: Specifies if the files created or modified are encrypted or not.
Scan Status: Provides Threat Hunt and Restore Scan-related information.

You can select a recovery point and click Cyber Restore to view all the supported restore options and perform the restore.

For more information, see Cyber Resiliency documentation.

Trends

The Trends tab provides a graphical representation of recovery points for the last 30 days (no other filter will be available).

📝 Note

You must have either a Security Posture & Observability, Accelerated Ransomware Recovery, or a premium license to view and access the Recovery Insights feature.

To view and access the Recovery Insights details for the Threat Hunting feature, the Premium license is mandatory.
For more information, see Cyber Resiliency documentation.

FAQs

Here are some FAQs to help you understand the Data Change column in VMware snapshot metadata:

What is the Data Change column in VMware snapshot metadata?

The Data Change column provides critical information about the amount of data processed during a backup operation for a VMware virtual machine (VM). Its value changes depending on the type of backup performed.

You must upgrade the VMware proxy to the latest version to view the data change details. Otherwise, the column will display empty dashes (-) instead of the actual data change values.

How is Data Change interpreted for a full backup?

For a full backup, the Data Change value represents the total size of all disks included in that backup.

Example: If a VM has two disks, each 100 GB, a full backup will show a Data Change of 200 GB (100 GB + 100 GB).

How is Data Change interpreted for an incremental backup?

For an incremental backup, the Data Change value reflects the total amount of data that has changed as reported by VMware's Changed Block Tracking (CBT) feature.

Example: If a VM has two 100 GB disks, and during an incremental backup, CBT reports 10 GB of changes on Disk1 and 0 GB on Disk2, the Data Change will be 10 GB.

Scenarios leading to full backups

When does a full backup occur, even if I intended an incremental backup?

A full backup, either for specific disks or all disks, can be triggered in the following situations:

CBT Disabled: If Changed Block Tracking (CBT) is disabled on the VM, a full backup will be performed for all disks.
New Disk Added: When a new disk is added to a VM, a full backup will be performed only for the newly added disk(s). Existing disks will continue to have incremental backups.

What if the "Auto Enable CBT" option in the backup policy is also disabled when CBT is disabled on the VM?

If CBT is disabled on the VM and Auto Enable CBT is disabled in the backup policy, then a full backup will be performed for all disks of the virtual machine, and the Data Change column will show the total size of the disk.

How does adding a new disk affect the Data Change value?

When a new disk is added to a VM:

A full backup will be performed for the newly added disk(s).
Existing disks will continue with incremental backups for any changes.
Example:
- You had a previous backup with Disk1 (100 GB) and Disk2 (100 GB)
- You then added a new disk: Disk3 (50 GB)
- New data added to Disk1: 10 GB
- New data added to Disk2: 0 GB
- Data Change = 10 GB (Disk1, incremental) + 50 GB (Disk3, full) = 60 GB