The most dangerous backup problem is not a missing backup system. It is one that looks fine and has quietly stopped working. A credential expired, a disk filled, a new server was never added to the job, or a scheduled task was disabled during maintenance. Nobody noticed until the day recovery was needed.
Monitoring is what separates a backup that exists from a backup you can rely on. This guide covers what to watch, who should watch it, and how to make failures loud instead of silent.
How backups fail quietly
Understanding the common failure patterns tells you what to monitor.
- Expired or changed credentials. A password rotation or an account lockout stops the job from authenticating.
- Full storage. The target runs out of space, and either the job fails or old restore points are pruned faster than planned.
- Scope drift. A new server, database, file share, or cloud workspace is created and never added to the protected list.
- Skipped or partial jobs. A job completes with warnings, and warnings are ignored until they are the norm.
- Software or agent problems. An agent stops after an update, or a device is offline when the backup window arrives.
- Silent corruption. The backup runs but the data cannot be restored cleanly.
What to monitor
Job success and recency
For every protected system, you want to know the time of the last successful backup. Alert if that exceeds your target, for example more than a day for a system you back up nightly. Alerting on failure alone misses jobs that never ran at all.
Warnings, not just errors
Treat warnings as work items. A job that repeatedly completes "with warnings" is telling you something. Review and either fix the cause or document why it is acceptable.
Storage capacity and growth
Watch free space on local targets and consumption on cloud storage. Set alerts well before the point of exhaustion so you have time to add capacity.
Coverage
Periodically compare the list of systems you believe are protected with the list of systems that exist. New servers, new SaaS tenants, and new jobsite devices are the usual misses.
Restore testing
Monitoring tells you a backup ran. Only a restore proves it works. Schedule regular test restores of files, a full system, and a critical application, and record the time taken against your recovery goals.
Who watches, and how
A dashboard nobody opens is not monitoring. Decide specifically who owns the alerts.
- Route failure and missed-job alerts to a ticketing system, not just a mailbox that gets filtered.
- Assign a named owner and a backup owner for response.
- Define response times, such as same business day for a failed job on a critical system.
- Send a short weekly or monthly summary to leadership showing success rates, open issues, and the most recent restore test.
If an outside provider manages backups, confirm in writing what they monitor, how they notify you, and how quickly they respond. Ask to see an example report.
Protect the monitoring itself
An attacker who controls your network may try to disable or delete backups first. Keep backup management accounts separate from everyday admin accounts, require multifactor authentication on the backup console, and keep at least one copy that cannot be altered or deleted from your main network. Alert on changes to retention settings and on deletion of restore points.
A simple monitoring checklist
- Every critical system has a documented backup schedule and recovery target.
- Alerts exist for failed, missed, and warning-state jobs.
- Storage alerts trigger well before capacity is reached.
- Someone reviews coverage against your system inventory each quarter.
- Restore tests happen on a calendar, with results recorded.
- Console access is protected with multifactor authentication.
- An offsite or immutable copy exists and is also monitored.
Where Ironfield Cyber fits
Ironfield Cyber monitors backups for contractors and energy companies, reviews coverage as your systems change, and runs restore tests so you know recovery will work. If you are not sure when your last successful backup ran, we can help you find out.