There’s problem with specifying a single external hard drive as the only backup destination: if that drive fails, there is no backup until somebody notices and replaces the drive.

Previously, I set all my backup schedules to copy from Drive1 (with the databases) to a folder in Drive2.  Other scripts would run periodically to synchronize the folder in Drive2 to Drive3 and Drive4.  But this makes Drive2 a single source of failure for the whole setup.

Now, each external hard drive is specified separately in turn in the server schedules and we backup to the boot drive as well. I’m pretty sure somebody will notice if the boot drive fails.

The schedules do send e-mail updates, but somebody does have to read it every day. And FileMaker Server 9 doesn’t help by sending emails on every execution, succeed or fail.  People start to ignore messages of success.

So, my updated outlook: I’ll go ahead and take a performance penalty for backing up to the boot drive at least a few times per day.