no, the updates touch files all over the place in that cfusion (or instancename) folder...btw, not only in the cfusion folder but also the sibling bundles folder. I'll say again I've never done the copy you refer to, nor heard of it being done...and I've helped folks do several hundred CF updates. Again, I'm not saying it's wrong. IT just seems a bit overkill. But sure, if one wants to be "super careful" (and has the space and time), I'd not fault them doing it. As for the size, one of the biggest contributors (when it's huge) is almost certainly the wwwroot/WEB-INF/cfclasses folder within the instance. Now, it's not NECESSARY to revert that. In fact, in some updates there's an argument for wiping that out (the last one was the updates in Oct 2022, where a lot of people even today trip over errors referring to xmlsearch compilation failures, even just in loading the CF Admin. More on that was discussed back then.) I'm just saying that if one confirmed that folder was indeed the largest cause of size in the "cfusion backup" they are making, avoiding bringing that could help reduce the size...but depending on how you "make the cfusion backup", that may not be easy. All this contributes to why I'd not think it a "best practice", but I'm not arguing with those whose experience leads them to feel otherwise. And sure, if you find where it's discussed elsewhere, perhaps all such things (and more are hashed out). You asked, there are my initial thoughts. 🙂

is it actually true that updates only touch the hf-updates folder?

Charlie obviously just said that wasn't true.... What I think is true is that CF copies all the files that it's going to replace and/or delete into the hf-updates folder for doing uninstalls.

well, yes, the update is supposed to copy into that backups folder (within the update folder) whatever it touches...sadly I don't find that to always be perfectly so, but it's indeed the intent. But yes, to Dave original question, it's just one of the many places in the cfusion (pr instancename) folder that potentially get updated in an update. btw, the hotfix_filelist.log in the update folder should also list all that was changed. But if anyone looks at that (or the backups folder) and says, "wow, that's a lot of files", note that each update does lay down ALL the files that ALL the past updates WOULD have led (cumulatively) to being updated. So even if "the latest update changes only one file", you may still find that thousands of files are "updated" by the update...and tracked in that log and the backups folder.

I treat my CF upgrades like I treat my OS upgrades. There is no way I’m upgrading without a snapshot, Time Machine backup, or some other comprehensive restore point. I’m not usually approaching CF upgrades from the ‘Master Troubleshooter’ standpoint, but from the ‘server admin with one hour to get everything working correctly’. I’ve never had an issue with the size of the CF folder.

well, sure, for those who want to be super-careful, I would strongly recommend those on a vm take a snapshot, or those on a real machine take a backup--but folks tend not to want to/be able to do the latter, or not easily. And in that case, sure, this notion of "copy the cfusion" is better than nothing. but I'm simply saying that virtually no one I work with (watch) bothers, and never once has there been a problem that was so botched we couldn't resolve it (together). but I get that some "can't rely on any outside assistance" and so would need to take all steps to protect themselves. Some may regard that copy as a best practice. Again, I don't argue with them. I'm just explaining why it's never been something I've advocated or needed, for myself or those I've helped. As you said, if it gives you comfort, go for it. It's not unwise.

Even if the install saves copies all the files from all over that it's going to replace, that doesn't help us if we want to manually roll back. Even if the locations of all those files are recorded, it'd be a nasty job to put them all back by hand. A simple backup and restore of that directory appeals to my Fred Flintstone "simplest thing that could possibly work" mentality. Not that I'm arguing with you @carehart or anyone else, it's just what I've done for a while, to "feel safe", and hopefully, actually BE safe 🙂 I'm where this sort of buck stops, and I seriously don't want to explain to the CEO, CIO, and my manager why we're still down!

I suspect this is one of those practices that came about as "community lore" based on getting bitten repeatedly by failed updates and an inability of the supplied tools to reliably roll back correctly. It doesn't take too many people having these failures (such as the OP in the original thread) before folks get "superstitious" and start creating rituals, whether they really need them or not. Part of the issue here -- in the CF community -- is there's a bit of a tendency, when something goes wrong, to start flailing around, randomly changing stuff in the hope of "fixing it"... instead of taking the very deliberate, painstakingly careful approach that Charlie does (and that many others would do well to try to adopt). Yes, there's a lot of complexity and moving parts in ACF (and Lucee) and most of the time you don't need to know or care about how it all works under the hood. But when something goes wrong, you're much better off being thorough and careful and working like @carehart does. But I guess the lack of that care in others is part of what keeps him in business 🙂

Huh? Best practice is not witchcraft. Not sure why this has become so seemingly political. Cover your ass. Done! And making the backup IS being careful AND thorough. Like @Dave Merrill said, when you’re reporting back to someone - have your bases covered. Plain and simple.

Jakob (and all), I have said repeatedly here that it's not unwise. No one's saying don't do it. No one's saying it's wrong. I appreciate the added perspective Sean added (sincerely), but even that's not really a negation of your position. We're just sharing experiences and perspectives. When an open-ended question is offered as Dave did, there will be varying opinions. Sadly, our culture has moved more and more away from having civil debate and discussion to "taking sides". 🙂 Not saying you're doing that. Saying it's something we all need to watch out for. Even I can fall into the trap if not careful. Indeed, it's why I tend to offer "a lot of words" to make my points clear--and then it's too much for some to read, so they perhaps glom on to one point for a retort, which is unfortunate. But it's life in our big city here. Bottom line: roll on with your backup approach. Nothing wrong with it.

@jakobward My only criticism in all of that is that many CFers just don't understand their stack well enough to debug it methodically. Even if the backups are an unnecessary ritual that just makes upgrades take a lot longer, it doesn't mean anyone is wrong to do it. There's nothing "political" in my observation.

Thanks @seancorfield, @carehart, and @jakobward for your perspectives, I appreciate them all.