# Encrypted and incremental backups.

**URL:** https://forums.percona.com/t/encrypted-and-incremental-backups/4002
**Category:** Percona XtraBackup
**Created:** [January 21, 2015, 4:20am UTC](https://forums.percona.com/t/encrypted-and-incremental-backups/4002 "2015-01-21T04:20:27Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![jbl](https://avatars.discourse-cdn.com/v4/letter/j/e47c2d/32.png) [@jbl](https://forums.percona.com/u/jbl)
#### Post date: [January 21, 2015, 4:20am UTC](https://forums.percona.com/t/encrypted-and-incremental-backups/4002/1 "2015-01-21T04:20:27Z")

</div>

Hello,

I’m currently writing backups and restorations scripts, on the basis of innobackupex. I need the backups to be encrypted and incremental.

Therefore, In order to enable incremental backups on the basis of an encrypted basedir, I’m using the ‘–extra-lsndir’ option to save an alternative cleartext ‘xtrabackup\_checkpoints’ file. I think it is a good solution (this solution comes from [this blog post](http://www.percona.com/blog/2014/04/24/encrypted-and-incremental-mysql-backups-with-percona-xtrabackup/)).

My question is :  
Can I safely set the ‘–extra-lsndir’ value to the same value as the backupDir, and then delete /xtrabackup\_checkpoints.xbcrypt ?

---

<div class="post-metadata">

### Author: ![Nickolay\_Ihalainen](https://avatars.discourse-cdn.com/v4/letter/n/e95f7d/32.png) [@Nickolay\_Ihalainen](https://forums.percona.com/u/Nickolay_Ihalainen)
#### Post date: [April 15, 2015, 10:57am UTC](https://forums.percona.com/t/encrypted-and-incremental-backups/4002/2 "2015-04-15T10:57:40Z")

</div>

Hi,

For incremental backups you need only a single file xtrabackup\_checkpoints or  
xtrabackup\_infoxtrabackup\_info,  
if you are using exra-lsndir option or even a single number with --incremental-lsn option.

You can get LSN for incremental from innobackupex script output or from xtrabackup\_info: innodb\_to\_lsn.

There is a full instruction for backup and restore for xtrabackup 2.2.10:

openssl enc -aes-256-cbc -pass pass:Password -P -md sha1  
get the key from iv, e.g.:  
iv =4D27E0ED263A8F2BAF337DED0A5FFFBE

You will have a different one because the salt is changed every time you are running openssl tool.

innobackupex --encrypt=AES256 --encrypt-key=“4D27E0ED263A8F2BAF337DED0A5FFFBE” .

For incremental backups you should get a correct LSN from previous backup output or from xtrabackup\_info (innodb\_to\_lsn parameter). Well from documentation you can get LSN from xtrabackup\_checkpoints but this file is encrypted, see [https://bugs.launchpad.net/percona-xtrabackup/+bug/1444255](https://bugs.launchpad.net/percona-xtrabackup/+bug/1444255) .

innobackupex --encrypt=AES256 --encrypt-key=“4D27E0ED263A8F2BAF337DED0A5FFFBE” --incremental --incremental-lsn= .

For restore:

# change directory to base backup:

innobackupex --decrypt=AES256 --encrypt-key=4D27E0ED263A8F2BAF337DED0A5FFFBE .

# check if files decrypted correctly or make a backup copy before restore

# e.g. xtrabackup\_checkpoints should contain a valid text and data

# 

# remove xbcrypt files

find . -name ‘\*.xbcrypt’ -exec rm {} +

Repeat this procedure with every backup directory you need. If you are using compression you can specify decompress in the same command line to save a time.

# from full backup directory

innobackupex --apply-log --redo-only .

# from full backup directory (not incremental)

# use absolute path to incremental directory

innobackupex --apply-log . --redo-only --incremental-dir= # run this if it’s not a last in incrementals chain

# …

innobackupex --apply-log . --incremental-dir= # for the last incremental backup