Compliance audit logging based backup

1. A method, comprising:

obtaining a compliance audit log of a data storage, wherein the compliance audit log stores a plurality of entries associated with a plurality of mounted storage volumes, wherein the plurality of entries include one or more modification entries associated with the plurality of mounted stored volumes and one or more non-modification entries associated with the plurality of mounted storage volumes;

analyzing the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage, wherein analyzing the compliance audit log includes:

identifying one or more entries associated with the mounted storage volume from the plurality of entries associated with the plurality of mounted storage volumes;

identifying, from the one or more identified entries associated with the mounted storage volume, one or more modification entries associated with the mounted storage volume;

determining whether the one or more identified modification entries occurred within a threshold time of or after a previous backup of the mounted storage volume; and

determining that the one or more identified modification entries include one or more entries that occurred within the threshold time before the previous backup of the mounted storage volume and one or more entries that occurred after the previous backup of the mounted storage volume; and

causing an incremental backup snapshot of the mounted storage volume to be performed based on the one or more entries that occurred within the threshold time before the previous backup of the mounted storage volume and the one or more entries that occurred after the previous backup of the mounted storage volume.

2. The method of claim 1 , wherein at least one of the one or more modification entries is associated with a file system write operation.

3. The method of claim 1 , wherein the data storage is a network-attached storage.

4. The method of claim 1 , wherein the data storage is associated with a plurality of mounted storage volumes, wherein the mounted storage volume is one of the plurality of mounted storage volumes.

5. The method of claim 1 , wherein analyzing the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage further comprises determining that the one or more identified modification entries are associated with a file system modification operation.

6. The method of claim 5 , wherein analyzing the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage further comprises determining that the one or more identified modification entries are associated with a file system modification operation that is a write operation.

7. The method of claim 6 , wherein analyzing the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage further comprises determining that a file associated with one of the identified entries is not already on a list of one or more files to be included in the incremental backup snapshot.

8. The method of claim 7 , wherein analyzing the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage further comprises including the file associated with the one of the identified entries on the list of one or more files to be included in the incremental backup snapshot.

9. The method of claim 8 , wherein analyzing the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage further comprises verifying that the file included on the list of one or more files to be included in an incremental backup snapshot has changed since the previous backup snapshot.

10. The method of claim 9 , wherein verifying that the file has changed since the previous backup snapshot comprises inspecting metadata associated with the file.

11. The method of claim 10 , wherein the metadata associated with the file includes a modification timestamp.

12. The method of claim 9 , wherein the data associated with the verified file is included in the incremental backup snapshot.

13. The method of claim 1 , wherein the incremental backup snapshot includes a portion of an identified file that was not previously backed up.

14. The method of claim 1 , wherein the incremental backup snapshot includes an entire portion of an identified file.

15. The method of claim 1 , wherein data associated with the incremental backup snapshot is provided to a storage system, wherein the storage system is configured to deduplicate the data included in the incremental backup snapshot.

16. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

obtaining a compliance audit log of a data storage, wherein the compliance audit log stores a plurality of entries associated with a plurality of mounted storage volumes, wherein the plurality of entries include one or more modification entries associated with the plurality of mounted stored volumes and one or more non-modification entries associated with the plurality of mounted storage volumes;

analyzing the compliance audit log in identifying any files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with the data storage, wherein analyzing the compliance audit log includes:

identifying one or more entries associated with the mounted storage volume from the plurality of entries associated with the plurality of mounted storage volumes;

identifying, from the one or more identified entries associated with the mounted storage volume, one or more modification entries associated with the mounted storage volume;

determining whether the one or more identified modification entries occurred within a threshold time of or after a previous backup of the mounted storage volume; and

determining that the one or more identified modification entries include one or more entries that occurred within the threshold time before the previous backup of the mounted storage volume and one or more entries that occurred after the previous backup of the mounted storage volume; and

causing an incremental backup snapshot of the mounted storage volume to be performed based on the one or more entries that occurred within the threshold time before the previous backup of the mounted storage volume and the one or more entries that occurred after the previous backup of the mounted storage volume.

17. A system, comprising:

a processor configured to:

obtain a compliance audit log of a data storage, wherein the compliance audit log stores a plurality of entries associated with a plurality of mounted storage volumes, wherein the plurality of entries include one or more modification entries associated with the plurality of mounted stored volumes and one or more non-modification entries associated with the plurality of mounted storage volumes;

analyze the compliance audit log to identify one or more files associated with a mounted storage volume that have changed since a previous backup snapshot of the mounted storage volume associated with of the data storage, wherein to analyze the compliance audit log, the processor is configured to:

identify one or more entries associated with the mounted storage volume from the plurality of entries associated with the plurality of mounted storage volumes;

identify, from the one or more identified entries associated with the mounted storage volume, one or more modification entries associated with the mounted storage volume;

determine whether the one or more identified modification entries occurred within a threshold time of or after a previous backup of the mounted storage volume; and

determine that the one or more identified modification entries include one or more entries that occurred within the threshold time before the previous backup of the mounted storage volume and one or more entries that occurred after the previous backup of the mounted storage volume; and

cause an incremental backup snapshot of the mounted storage volume to be performed based on the one or more entries that occurred within the threshold time before the previous backup of the mounted storage volume and the one or more entries that occurred after the previous backup of the mounted storage volume; and

a memory coupled to the processor and configured to provide the processor with instructions.