Source Data Protection Group Config

This tab manages protection groups — named collections of buckets that share a target vault device, a schedule policy, and an operational mode (Prep / Vault). Use it to organize buckets into logical groups, assign each group to a specific vault target, and link each group to a schedule policy. Groups created here are then referenced when building vault policies in Step 5 (Source Data Protection Policy Config).

Overview

Every bucket that participates in vault copying must belong to a protection group. The group determines:

• Which target vault device all policies in the group write to.
• Which schedule policy drives the dispatch cadence in Vault Mode (start time + window duration + repeat-every-N-days). In Preparation Mode there is no automatic schedule — syncs start from Sync Group Now / Sync All.
• The operational mode — Prep (online; you start the syncs and copy agents copy directly to the vault target) or Vault (airgapped; the vault agent starts the syncs on its schedule and copy agents do the copying).
• The RPO hours target for the group.

Separating buckets into groups lets you apply different schedules and target devices to different workloads — for example, a "critical" group with a daily schedule and a "monthly archive" group with Repeat Every 30 days.

Group Settings (Group form fields)

Name — a label for the group, shown in the group pickers (for example when assigning buckets in Step 1, Bucket Browser) and as the group heading on the Vault Data Sync Dashboard. The console doesn't stop two groups having the same name, so use a distinct one.

Description — optional free-text description of the group's purpose.

RPO (hours) — target Recovery Point Objective for the group: how old the last successful sync window may be. Valid range: 1–168 (1 hour to 1 week).

Schedule Policy — links the group to a sync schedule (see the Sync Schedules tab). Defines when copy windows open. Set to — Use default policy — to inherit the global default.

Target Vault Device — the vault-side ObjectScale device that all policies in this group write to. All buckets in a group share the same vault target.

Color — a visual tag picked from a palette. Shown as a color dot next to the group in the Groups list and the Bucket Browser to identify the group at a glance.

Operational Mode (not on the group form; shown as Preparation Mode or Vault Mode) — Preparation Mode (default; you start the syncs and copy agents copy directly to the vault target over the network) or Vault Mode (set via Vault Operations > Vault Data Sync Dashboard > Switch to Vault Mode; the registered vault agent starts the syncs on its schedule over the encrypted QTP channel, and copy agents do the copying).

info

Per-policy copy performance settings — threads per job, multipart threshold, prefix scan depth, delete sync — live on each policy in Step 5 (Source Data Protection Policy Config), not on the group itself.

Assigning Buckets to a Group (Step 1)

The Assign tab (Step 1) lets you select which source buckets belong to this protection group.

Selecting buckets

• Checkboxes — click individual rows to select specific buckets.
• Header checkbox — selects all buckets on the current page.
• Select All (N) — selects all unassigned buckets matching the current filters across all pages.
• Quick-select buttons (100 / 500 / 1000 / 2500) — auto-selects that many unassigned buckets, sorted alphabetically, matching the current device and namespace filters. Use these for fast bulk assignment when group membership doesn't need to be hand-curated.

Bucket exclusivity rule

Each bucket can belong to only one protection group at a time. You can select any bucket regardless of its current group — selection is always allowed so you can unassign buckets. The conflict check fires only at assignment time:

• Quick-select buttons: server-side filter (groupId: unassigned) automatically excludes all already-assigned buckets — they are never returned in the auto-selection result.
• Assign button: if any selected bucket is already in a different group, a red conflict banner lists the offending bucket names and the assignment is blocked. No buckets are changed. Set the group dropdown to Unassigned first to remove them from their current group, then reassign.
• Unassigning: selecting grouped buckets and choosing Unassigned in the dropdown is always allowed and does not trigger the conflict check.

Moving a bucket to a different group

To reassign a bucket that is currently in Group A to Group B:

1. Filter the table to Group A.
2. Select the bucket(s) you want to move.
3. Use the bulk-assign dropdown to set group to Unassigned > click Assign. This removes them from Group A.
4. Switch to Group B (or filter to Unassigned).
5. Select the now-unassigned buckets and assign them to Group B.

Row controls: tags and exclude

Each bucket row carries three quick-toggle buttons next to the protection status:

• High-Churn (⚡) and Large (📦) — advisory tags used by the Distribution Planner to spread heavy buckets evenly across groups. They do not change what gets copied.
• Exclude (shield) — marks the bucket as excluded from vault protection (see below).

Excluding a bucket from vault protection

Click the shield toggle on a bucket row to exclude it. Excluded rows are dimmed and show a gray Excluded badge in place of their protection status. Click the shield again (Include bucket) to clear the exclusion.

Excluding a bucket is an operator statement that this bucket must not be protected. It is enforced everywhere protection happens:

• Copy dispatch is blocked. No copy job runs for an excluded bucket. This covers:

  • Sync Group Now and the vault agent's own incremental sync.
  • Run Sync, Sync All, and Resume on the Vault Data Sync Dashboard, per window and in batches.
  • Full bucket copy, single and bulk.

  When Sync Group Now or an agent sync skips excluded buckets, the result gives "Source bucket excluded from vault protection" as the blocked reason, so you can tell the skip from "nothing pending". The per-bucket dashboard actions reject the request with the same message.

  This holds even if the bucket already had a copy policy. The policy stays in place but is never dispatched while the bucket is excluded.

• It cannot be selected for any protection operation. In the Bucket Browser, an excluded bucket's row checkbox is disabled. You cannot pick it individually, with Select-All, or with quick-select, to:

  • Assign it to a group.
  • Grant a source read ACL (Step 3).
  • Provision it to the vault (Step 4).

  Assigning an excluded bucket to a protection group is refused. No new copy policy can be created for it: the Step 5 wizard, bulk-add, and a direct policy save all refuse. Editing an existing policy whose bucket was excluded later is still allowed, but it never dispatches while the bucket is excluded.

  Clear the shield first if you want to protect the bucket. The bucket still appears in the inventory table, dimmed, so you can find it and include it again.

• Bulk ACL provisioning skips it. The Apply-ACL pipeline never grants the vault service account read access to an excluded bucket — whether the run is whole-group, whole-device, or an explicit selection of specific buckets. It also drops out of the per-namespace ACL coverage counts, so excluding a bucket won't make a namespace look under-provisioned.

• Target provisioning skips it. The Provision-to-Vault step never creates a namespace/bucket on the vault target for an excluded bucket — again whether provisioning is by group, by device, or by an explicit bucket selection.

Scope and limits:

• Excluding does not cancel a copy job that is already in flight — it only prevents future dispatch. Cancel the running job explicitly if you need it stopped now.
• Excluding does not delete data that was already copied into the vault before the bucket was excluded. Remove that from the vault target separately if required.
• Re-including the bucket (clearing the shield) immediately restores normal behavior — the next Sync Group Now or scheduled window will pick it up again.

To take a bucket out of protection: exclude it (stops all future copying), then, if needed, cancel any running job and clean up already-copied vault data.

Workflows

Creating a new protection group

1. Click New Group in the toolbar.
2. Enter a unique Name.
3. Set the RPO (hours) target.
4. Pick a Schedule Policy (or leave as default).
5. Select the Target Vault Device.
6. Pick a Color.
7. Click Create Group.
8. In Step 1 (Assign tab), select the buckets for this group and click Assign.
9. In Step 4 (Provision), provision the target namespaces and buckets.
10. In Step 5 (Source Data Protection Policy Config), create the vault policies that drive the actual copy jobs.

Adjusting a group's schedule

1. Click the pencil icon on the group row to open the edit form.
2. Change Schedule Policy to a different policy from the dropdown, or edit the existing policy on the Sync Schedules tab.
3. Click Save Changes. Changes take effect on the next dispatch evaluation — currently-running jobs continue with the previous schedule. (The schedule is used only in Vault Mode, where the vault agent syncs on it.)

Splitting a group into two separate groups

1. Create a second group with its own Target Vault Device, schedule, and RPO target.
2. Filter the bucket table to the original group (Step 1), select the buckets to move, and use the bulk-assign dropdown > set group to Unassigned > click Assign.
3. Filter to Unassigned, select those buckets, and assign them to the new group.
4. Re-run Step 4 (Provision) and Step 5 (Policy Config) for the new group.

Switching a group to Vault Mode

The mode of a protection group is set system-wide from Vault Operations > Vault Data Sync Dashboard > Switch to Vault Mode (in the Operational Mode panel). This bulk-converts all prep-mode groups to Vault Mode in one operation, assigns them to the selected vault agent, and updates all their existing policies automatically. You cannot change the mode per-group from this tab.

Tips

• Use distinct group names — the console doesn't enforce it. Choosing descriptive names (e.g. finance-prod, archive-cold) makes the Vault Data Sync Dashboard and Data Sync Reporting easier to read at a glance.
• A bucket in a protection group will show the group name and color badge in the bucket table. If you see a bucket appearing in two groups in the UI, it is two separate inventory rows (the same bucket name on different devices or namespaces) — each row belongs to exactly one group.
• Per-job copy concurrency lives on each policy in Step 5, not on the group. To throttle a group's effective throughput, edit the Threads per Job setting on each policy (or use the bulk wizard's Advanced Settings when creating them).
• The Distribution Planner modal (top of the Groups list) bootstraps multiple groups + staggered schedule policies in one operation — ideal for first-time setup on a large source inventory.