incr backup incorrect

Most probably something has happened to files and thus they have been picked up for backup. Sometimes AV may set archive bit or something else that would access those files.

As per the admin guide, incremental backup will pick up all files that are modified since the last backup. Any application that opens a file in r+w mode will cause the file's modification date to change. It could be something as simple as a anti-virus.

However, I have always found, while restoring from incremental backups, that I need only the full backup and the latest incremental backup. I am talking about different environments and diffrent OS types. The only common thread is that they are all FS backups and not backups of application and database. No modules involved. It's strange. Practically, I have found that what is defined in NW as a incr backup is actually a backup of all files modifed since the last full backup and not all files modified since the last backup.

Anyone else seen this kind of behaviour?

I am talking about a schedule starting on a Sunday going something like this;

Full Incr Incr Incr Incr Incr Incr Incr.

On day 1 full backup and subsequent backups are incremental. Backup runs in the morning and fininshes before noon. On day 5 evening, to restore I find I need the tapes containing the full backup and the incremental backup tape of day 5 morning. Please note that the tapes are moved out of the tape library to a offsite location everyday thus eliminating the chance of backups of multiple days on the same tape.

It doesn't work that way. You will see this backed up again only if archive bit (Windows) was not reset or was set again by AV for example OR differential might have been used (depending on level), but this is not the case.

In your case, it sounds as for /usr1 everything required was full plus last incremental to cover PIT you had. That's nothing unusual unless you state something did change and was covered by incr on Wed and that was not used in restore on Friday. In that case you could easily verify that with nsrinfo and have case with EMC for further analysis.

If I had to restore file(s) which has been backed up by my last incremental I should not be asked about full at all.

I am not looking at a restore of a specific file, I am talking about a complete restore ... point in time. Look at /usr1 mount point being backed up as per the schedule I described and the /usr1 crashing after the day 5 incr backup and being completely restored. I need only the full and the day 5 morning. This is just what I have seen happening. It would explain the behaviour being described by the thread owner of the incr backup doing a backup of all files changed since the last full backup rather than the last backup.

From what I have seen, it depends on what I wish to restore and when was that backed up.