SIRIS, ALTO, and NAS: Create Rescue Agent



This article describes the function of the Create Rescue Agent option for Datto appliances capable of running local virtualizations.


  • Datto SIRIS


When starting a local virtualization, you have the option to create a virtual Rescue Agent from the selected snapshot of the Source Agent and take crash-consistent backups of the VM. The feature creates a new backup agent on the Protect tab of the Datto appliance's GUI and writes all of the Source Agent's configurations and data changes to automatic incremental snapshots. The agent will continue to back itself up until you restore the production machine or its replacement. This feature ensures that whenever you want to bring the original machine back into service, your data is ready and waiting.

Because the Rescue Agent creates a 'forked' backup set from the Source Agent's snapshots, the only additional space the Rescue Agent will use on your appliance will come from its incremental backups.

If you delete a Source Agent while a Rescue Agent is running, the Source Agent's dataset will be promoted to the Rescue Agent's dataset.


  • Rescue Agents do not preserve transactional data. If you are virtualizing an environment that relies on transactional data, such as an Exchange or SQL server, and you need to back it up, start a local virtualization, log into it and configure its networking, and then repair agent communications between the virtual agent and the Datto appliance. Then, start a backup on the Protect tab of the Datto device GUI to resume backups for the agent.
  • You do not need to have any agent slots available on your Datto appliance to create a Rescue Agent, but creating it does use a slot. If you create the Rescue Agent on a device that has only one slot available, or if the device has reached the maximum number of protected systems that you can pair with it, you will not be able to add additional agents until you remove the Rescue Agent or another agent.


1. To create a virtualization with a Rescue Agent, start a local virtualization. In the Local Options screen, configure the virtualization. The Create Rescue Agent box will automatically be selected, as shown in Figure 1. To start the virtualization without a rescue agent, uncheck the box before clicking Start VM.

Figure 1: Create Rescue Agent (click to enlarge)

2. If you started the virtualization with the Rescue Agent option enabled, you will be prompted to choose whether or not you would like to pause backups on the protected machine. Depending on your recovery scenario, click either Pause Backups or Continue Backups, and then click Confirm.

Pausing backups for an agent or share will not suspend billing for it. To modify your billing plan, contact your Datto Sales Executive.

Figure 2: Pause or continue backups (click to enlarge)

3. Your virtualization will mount and begin running in the Local Virtualization screen. On the Protect tab of the Datto appliance GUI, you will see a new agent with a name comprised of the word 'rescue' and the protected server's IP address or FQDN, as shown in Figure 3. This is the Rescue Agent for your running virtualization. You can manage this agent the same way you would manage any other agent, including setting a custom backup schedule for it through the Configure Agent Settings page.

Figure 3: Rescue Agent, as seen in the Protect tab (click to enlarge)

4. If the Source Agent that you created the Rescue Agent from is encrypted by the Datto appliance, the Rescue Agent will also be created as an encrypted agent. It will use the same encryption password as the Source Agent, and you will need to unseal the agent on the Protect tab of the appliance GUI in the event of a device reboot.

If you were running a virtualization of the Rescue Agent at the time of the device reboot, you will also need to unseal and restart the virtualization from the Restore tab.

Figures 4 and 5 show examples of a sealed Rescue Agent.

Figure 4: Sealed rescue agent, Protect tab (click to enlarge)

Figure 5: Sealed rescue agent, Restore tab (click to enlarge)

Unencrypted rescue agents do not require manual intervention in the event of a device reboot, and will resume virtualization automatically.

5. When you no longer need the Rescue Agent, remove the protected virtualization from the Restore tab of the Datto appliance GUI by clicking Stop and then Archive.

Don't click the Stop button if you have not fully restored the production machine. The stop button does a hard shutdown of the rescue agent, which is the equivalent of unplugging the power cord on a physical machine. If you are using the rescue agent in your production environment, log into the virtual machine from its VNC session and do a soft shutdown (Start Menu → Shut Down).

Figure 6: Stop and archive (click to enlarge)

6. When you click Archive, your Datto appliance will archive the Rescue Agent's dataset. Archiving will hide the Rescue Agent in the list of Restores, stop all backups, and unmount the VM permanently. Only use this option if you have no need to initiate backups of this Rescue Agent in the future.

7. When you no longer need the Rescue Agent's dataset, you can remove it by clicking Remove Rescue Agent on the Protect tab of the Datto device GUI. Removing the Rescue Agent will permanently delete any backups taken by the Rescue Agent while it was running.

For more information on archiving and removing Rescue Agents see SIRIS, ALTO, and NAS: Archiving and removing a Rescue Agent.


Q: Are Rescue Agents subject to retention rules? Will I be alerted if a Rescue Agent uses too much of my Datto device's free disk space?

A: Rescue Agents are subject to the same retention rules as conventional agents. They will trigger device alerts in the same way that conventional agents do.

Does a Rescue Agent need to take a full backup to create its dataset?

A: Rescue Agents don't require a full backup because of how the Datto appliance leverages ZFS (through a ZFS promote). Rescue Agents are no more likely to cause disk space issues than the original agent was.

Q: Does the Rescue Agent continue to back up if the Datto device is critically low on space, or will it check to see if the device has 30GB or less of free space before taking the snapshot?

A: The Rescue Agent will check to ensure that appropriate space is available on the Datto appliance before it runs a backup.

If a Source Agent is encrypted, will the Rescue Agent be encrypted?

A: Yes, if the Source Agent is encrypted, the Rescue Agent will use the same encryption settings.

Do Rescue Agents replicate their backups to the Datto Cloud?

A: Yes, Rescue Agents can replicate offsite.

Q: Does the Rescue Agent need to sync a full base image offsite before normal offsite sync begins, despite it not needing a full backup to start running?

A: Currently a Rescue Agent will send a full base image offsite - this is because, while the Rescue Agent can reference the data of its Source Agent locally, when it replicates offsite, it requires a full dataset to be able to restore in the cloud.

Additional Resources

Was this article helpful?

2 out of 2 found this helpful

You must sign in before voting on this article.

Want to talk about it? Have a feature request?

Head on over to our Datto Community Forum or the Datto Community Online.

For more Business Management resources, see the Datto RMM Online Help and the Autotask PSA Online Help .

Still have questions? Get live help.

Datto Homepage