The vSphere plugin provides the capability to automatically overwrite and resignature an existing VMFS volume from one of its FlashArray crash consistent snapshots. This use case is particularly important in the event of a ransomware attack, disaster recovery, an operating system patch breaking one or more application(s) after it has been applied or if an administrator makes a mistake and needs to recover multiple connected VMs within the same volume to their previous state. This restore operation applies only to the current location of the VMFS volume.
In order for the Restore VMFS from a snapshot workflow to function properly, please make certain to power off all virtual machines that are running within the volume, as the overwrite operation will also remove these VMs and re-add their version from this snapshot into vCenter inventory.
Recommendations: VMs are stopped and unregistered; the existing VMFS datastore is unmounted. Unmounting the datastore reduces the possibility of registration issues with the recovered VM. The required steps are:
- Stop VMs.
- Unregister VMs (remove them from inventory).
- Snapshot restored to original.
- Mount the datastore.
- Register the VM(s),
If one or more virtual machines on the datastore you wish to restore are powered on, the Restore button will be grayed out. The wizard will display which VM(s) need to be powered off prior to the snapshot restoration operation being available. The below example shows a single VM that is still powered on and thus preventing the snapshot restore.
Once all VMs that reside on the VMFS volume to be restored have been vMotioned elsewhere and/or powered off, the Restore button shows as available.
Upon clicking Restore the snapshot will overwrite the existing volume which will automatically replace the previous VMFS volume and be resignatured for immediate use in vSphere.