CrashPlan Server Backup includes components that run with elevated privileges. Security software installed on a Windows Server may block, quarantine, or lock CrashPlan files and folders, which can cause installation issues, unexpected behavior, or backup performance problems.

To help ensure that CrashPlan Server Backup operates correctly, configure your security software to trust the CrashPlan application and exclude the required CrashPlan files and folders from scanning.

Security Software Whitelisting for Server Backup

Configure your security software to allow CrashPlan Server Backup components to run without interruption. Whitelisting the required CrashPlan folders, executables, services, and URLs helps prevent antivirus, application protection, exploit detection, or firewall software from interfering with backup operations.

Prerequisites

Before configuring your security software, ensure that you have:

• Administrative access to the server.

• Administrative access to the security software or security management console.

• Identified the CrashPlan Server Backup installation and configuration locations.

• Identified the CrashPlan region used by your environment.

• Access to configure folder, process, application, service, and URL exclusions.

Security software that may require exclusions

Configure exclusions or trusted relationships for CrashPlan if your environment uses:

• Antivirus software

• Application protection

• Exploit detection or advanced threat protection

• Firewalls

Third-party security software can lock CrashPlan application files, folders, configuration files, or logs. This can result in corruption, unexpected behavior, or disruption to backup operations.

Windows

Configure the following exclusions for CrashPlan Backup For Servers on Windows.

Folder exclusions

Add the following folders to your security software's exclusion or whitelist configuration:

Replace {USER_NAME} with the appropriate Windows user name.

Executable exclusions

Whitelist the following CrashPlan executables:

Configuration files

Exclude the following CrashPlan configuration files from security scanning:

Windows service

Whitelist the following CrashPlan service:

The CrashPlan service should be configured as a trusted application so that security software does not shut down or remove it.

Linux

Configure the following exclusions for CrashPlan Backup For Servers on Linux.

Folder exclusions

Add the following directories to your security software's exclusion or whitelist configuration:

Executable exclusions

Whitelist the following CrashPlan processes or executables:

Note: The source document lists CrashPlan Backup For Endpoints in the Server Backup — Linux executable section. The value is reproduced as provided in the source.

Configuration files

Exclude the following CrashPlan configuration files:

Linux service

Whitelist the following systemd service:

Ensure that the CrashPlan service is permitted to run and is not blocked, terminated, or quarantined by security software.

URLs

CrashPlan Server Backup requires access to regional CrashPlan Portal, Gateway, and Storage services.

Allow the URLs for the region in which your CrashPlan environment is hosted.

India

US East (USE)

UAE

Frankfurt (FFM)

Note: Replace {customername} with the customer's CrashPlan tenant or customer name.

VSS

On Windows servers, CrashPlan creates a software snapshot or Volume Shadow Copy Service (VSS) volume and uses it to read files during backup.

VSS allows CrashPlan to obtain a consistent copy of data, including files that are currently in use by applications.

Disable real-time and on-demand scanning

Some antivirus and third-party encryption applications scan VSS volumes in real time or when files are accessed. This can interfere with backup operations and may cause:

• Slower backup operations

• Increased I/O usage

• Antivirus processes locking files required by CrashPlan

Disable real-time or on-demand scanning of CrashPlan VSS volumes.

Important: Scheduled antivirus scanning of VSS volumes can remain enabled. The source document specifically recommends disabling only on-demand or real-time scanning.

Troubleshooting

If Server Backup is not operating as expected after installation, verify the following configurations.

Backup operations are slow

Check whether your antivirus or security software is performing real-time or on-demand scanning of VSS volumes.

Resolution:
Disable real-time and on-demand scanning of VSS volumes. Scheduled scanning can remain enabled.

CrashPlan service is stopped

Security software may have terminated, blocked, or quarantined the CrashPlan service.

Windows: Verify that the following service is trusted:

Linux: Verify that the following service is permitted to run:

The CrashPlan service is required for backup operations and other agent functionality.

CrashPlan files are being quarantined or blocked

Verify that the CrashPlan installation and configuration directories are excluded from antivirus and other security scanning.

For Windows, verify:

For Linux, verify:

Server cannot connect to CrashPlan

Verify that the appropriate regional Portal, Gateway, and Storage URLs are allowed through your firewall, proxy, or other network security controls.

Confirm that you are using the URLs for the correct CrashPlan region.

Whitelisting Checklist

Use this checklist to verify your configuration:

Windows

• CrashPlan installation folders are excluded.

• CrashPlan configuration folders are excluded.

• CrashPlan executables are whitelisted.

• config.yaml is excluded.

• WL.properties is excluded.

• CrashPlanBackupService is trusted.

Linux

• CrashPlan installation directories are excluded.

• CrashPlan configuration directories are excluded.

• CrashPlan processes are whitelisted.

• config.yaml is excluded.

• WL.properties is excluded.

• CrashPlanBackupService.service is permitted to run.

Network

• Regional Portal URL is allowed.

• Regional Gateway URL is allowed.

• Regional Storage URL is allowed.

Windows VSS

• Real-time antivirus scanning of VSS volumes is disabled.

• On-demand antivirus scanning of VSS volumes is disabled.

• Scheduled antivirus scanning remains enabled only if required by organizational policy.