# Backups and drift

Schedule configuration backups with backup policies, back up on configuration-change traps, compare versions, spot drift from intent and propose a restore.

A backup captures a device's running configuration through its collector. This page shows how to schedule backups for a whole fleet, back up the moment a device changes, and read what changed.

## Before you begin

* The devices are in configuration management, each with a collector assigned. See [Add devices to configuration management](https://tracix.io/docs/network/ncm#add-devices-to-configuration-management).
* A login credential is bound to the devices, plus an enable credential for Cisco IOS and NX-OS over SSH. See [Device credential vault](https://tracix.io/docs/network/ncm/vault).
* The account the credential signs in with can read the full configuration. [Supported platforms](https://tracix.io/docs/network/platforms) lists the command each OS family runs and the access it needs.

A backup only reads. It never enters configuration mode.

## Create a backup policy

A backup policy chooses devices by attributes, so devices that match later, such as newly discovered ones, are backed up too.

**1. Start a policy**

Open **Network › Config Mgmt › Backup policies** and select **New policy**. Enter a **Name**, such as `edge-routers-daily`.

**2. Choose the devices**

Add clauses under **Include**: a device must match every include clause. Each clause matches on one attribute: `site`, `collector`, `vendor`, `platform`, `model` (wildcards such as `C9300*`), `role`, `tag`, `device`, `cidr` (IPv4 ranges), or `all`. Add **Exclude** clauses to remove devices that match any of them.

**3. Check the membership preview**

The **Membership preview** updates as you build the scope. It counts the devices that match, how many are ready, and which have gaps: no collector, no credential, or an unsupported platform. Fix the gaps before you rely on the policy.

**4. Set the schedule**

Pick a **Schedule preset** (**Hourly**, **Every 6 hours**, **Every 12 hours** or **Daily**), or enter an interval in **Backup schedule**: a number followed by `m`, `h` or `d`, such as `30m` or `7d`.

**5. Turn it on**

New policies start disabled. Select **Enabled**, then **save policy**. The first backups start within about a minute, and then follow the schedule.

> **Use intervals, not cron**
>
> The schedule field accepts a cron expression, but Tracix doesn't parse cron yet: a policy with a cron schedule backs up once a day. Use an interval such as `24h` instead.

When a device matches more than one enabled policy, the policy with the highest **Priority** governs it. The **Keep last** and **Keep days** fields are saved with the policy, but Tracix doesn't prune older versions yet, so every saved version stays available.

You can also create a policy from **Inventory**: select devices, or none, and choose **backup schedule** or **create schedule for selection**. A policy made this way is enabled at once. A selection makes a fixed device list; any other scope stays dynamic.

### Back up when a device changes

With **Back up immediately on config-change trap/syslog** on (the default), a device that sends a configuration-change SNMP trap, such as Cisco's `ciscoConfigManEvent` or Juniper's `jnxCmCfgChange`, is backed up soon after the trap arrives instead of at the next scheduled run. Traps that report only a configuration display, not a change, don't trigger a backup. For this to work, the device must send its traps to a collector with the trap listener on; see [SNMP polling and traps](https://tracix.io/docs/collect/network-data/snmp).

Tracix records the trap as a change event on the device, and also records a backup that returns a device to an earlier configuration. Problems that involve the device show these changes; see [Problems and cases](https://tracix.io/docs/alerting/problems-and-cases).

### Back up now

* One device: open it under **Inventory** and select **Backup now**.
* Several devices: select them under **Inventory** and choose **back up now**.
* A policy's devices: open the policy and select **Backup now**.
* Every policy that is due: select **Run due backups** on **Backup policies**.

## What a backup saves

Each backup is a job you can follow under **Network › Config Mgmt › Activity**. When the configuration is identical to the previous one, the job says **No configuration change — nothing to save.** and no new version is created. When it changed, Tracix saves a new version. History is append-only.

Backups are stored as the device returned them, including any secrets the device prints, because they are the record of what the device ran. When Brain reads a configuration, Tracix masks passwords, communities and keys first. Activity never stores the raw device session.

## Compare versions and spot drift

Open a device under **Inventory**:

* **Running** shows the configuration from the latest backup, and **Intended** what you declared.
* **Revisions** lists every version with who or what captured it and when. Select one to see its diff against the version before it.
* **Compare** shows drift: the requirements of the intended configuration that the running configuration breaks. It reads **Baseline satisfied** when there are none, and **Not evaluated** when the backup can't be checked against them.

Drift counts only requirements you declared, so extra settings on the device don't count unless a section uses exact matching. Lines that match the governing policy's **Drift ignore-rules** (regular expressions) are left out of the comparison on **Compare**. By default, the rules skip lines that change on their own, such as uptime counters.

## Restore an earlier version

Select a version under **Revisions** and choose **Propose restoration**. Tracix creates a change request with that version's configuration. Nothing changes on the device, or in the intended configuration, until the request is approved, saved and deployed like any other change; see [Drafts and change requests](https://tracix.io/docs/network/ncm/change-requests). Restoring needs a platform that supports applying changes; see [Supported platforms](https://tracix.io/docs/network/platforms).

## Fleet report

**Network › Config Mgmt › Reports** shows the fleet's sync status, the backup success rate over the most recent jobs, running compliance and OS versions. It can also send configuration management notifications to a Slack incoming webhook or another webhook, filtered by severity.

## Next steps

- [Drafts and change requests](https://tracix.io/docs/network/ncm/change-requests): Declare intent and deploy changes

- [Compliance rules](https://tracix.io/docs/network/ncm/compliance): Check backups against rules

- [Supported platforms](https://tracix.io/docs/network/platforms): Capture commands per OS family