Veritas NetBackup™ Commands Reference Guide

Last Published:
Product(s): NetBackup (8.0)
  1. Introduction
    1.  
      About NetBackup commands
    2.  
      Navigating multiple menu levels
    3.  
      NetBackup command conventions
    4.  
      NetBackup Media Manager command notes
  2. Appendix A. NetBackup Commands
    1.  
      acsd
    2.  
      add_media_server_on_clients
    3.  
      backupdbtrace
    4.  
      backuptrace
    5.  
      bmrc
    6.  
      bmrconfig
    7.  
      bmrepadm
    8.  
      bmrprep
    9.  
      bmrs
    10.  
      bmrsrtadm
    11.  
      bp
    12.  
      bparchive
    13.  
      bpbackup
    14.  
      bpbackupdb
    15.  
      bpcatarc
    16.  
      bpcatlist
    17.  
      bpcatres
    18.  
      bpcatrm
    19.  
      bpcd
    20.  
      bpchangeprimary
    21.  
      bpclient
    22.  
      bpclimagelist
    23.  
      bpclntcmd
    24.  
      bpclusterutil
    25.  
      bpcompatd
    26.  
      bpconfig
    27.  
      bpdbjobs
    28.  
      bpdbm
    29.  
      bpdgclone
    30.  
      bpdown
    31.  
      bpduplicate
    32.  
      bperror
    33.  
      bpexpdate
    34.  
      bpfis
    35.  
      bpflist
    36.  
      bpgetconfig
    37.  
      bpgetdebuglog
    38.  
      bpimage
    39.  
      bpimagelist
    40.  
      bpimmedia
    41.  
      bpimport
    42.  
      bpinst
    43.  
      bpkeyfile
    44.  
      bpkeyutil
    45.  
      bplabel
    46.  
      bplist
    47.  
      bpmedia
    48.  
      bpmedialist
    49.  
      bpminlicense
    50.  
      bpnbat
    51.  
      bpnbaz
    52.  
      bppficorr
    53.  
      bpplcatdrinfo
    54.  
      bpplclients
    55.  
      bppldelete
    56.  
      bpplinclude
    57.  
      bpplinfo
    58.  
      bppllist
    59.  
      bpplsched
    60.  
      bpplschedrep
    61.  
      bppolicynew
    62.  
      bpps
    63.  
      bprd
    64.  
      bprecover
    65.  
      bprestore
    66.  
      bpretlevel
    67.  
      bpschedule
    68.  
      bpschedulerep
    69.  
      bpsetconfig
    70.  
      bpstsinfo
    71.  
      bpstuadd
    72.  
      bpstudel
    73.  
      bpstulist
    74.  
      bpsturep
    75.  
      bptestbpcd
    76.  
      bptestnetconn
    77.  
      bptpcinfo
    78.  
      bpup
    79.  
      bpverify
    80.  
      cat_convert
    81.  
      cat_export
    82.  
      cat_import
    83.  
      configurePorts
    84.  
      create_nbdb
    85.  
      csconfig
    86.  
      duplicatetrace
    87.  
      importtrace
    88.  
      jbpSA
    89.  
      jnbSA
    90.  
      ltid
    91.  
      mklogdir
    92.  
      nbauditreport
    93.  
      nbcatsync
    94.  
      NBCC
    95.  
      NBCCR
    96.  
      nbcertcmd
    97.  
      nbcertupdater
    98.  
      nbcomponentupdate
    99.  
      nbcplogs
    100.  
      nbdb_admin
    101.  
      nbdb_backup
    102.  
      nbdb_move
    103.  
      nbdb_ping
    104.  
      nbdb_restore
    105.  
      nbdb_unload
    106.  
      nbdbms_start_server
    107.  
      nbdbms_start_stop
    108.  
      nbdc
    109.  
      nbdecommission
    110.  
      nbdelete
    111.  
      nbdeployutil
    112.  
      nbdevconfig
    113.  
      nbdevquery
    114.  
      nbdiscover
    115.  
      nbdna
    116.  
      nbemm
    117.  
      nbemmcmd
    118.  
      nbexecute
    119.  
      nbfindfile
    120.  
      nbfirescan
    121.  
      nbftadm
    122.  
      nbftconfig
    123.  
      nbgetconfig
    124.  
      nbhba
    125.  
      nbholdutil
    126.  
      nbhypervtool
    127.  
      nbjm
    128.  
      nbkmsutil
    129.  
      nboraadm
    130.  
      nbpem
    131.  
      nbpemreq
    132.  
      nbperfchk
    133.  
      nbplupgrade
    134.  
      nbrb
    135.  
      nbrbutil
    136.  
      nbregopsc
    137.  
      nbreplicate
    138.  
      nbrestorevm
    139.  
      nbseccmd
    140.  
      nbsetconfig
    141.  
      nbsnapimport
    142.  
      nbsnapreplicate
    143.  
      nbsqladm
    144.  
      nbstl
    145.  
      nbstlutil
    146.  
      nbsu
    147.  
      nbsvrgrp
    148.  
      resilient_clients
    149.  
      restoretrace
    150.  
      stopltid
    151.  
      tl4d
    152.  
      tl8d
    153.  
      tl8cd
    154.  
      tldd
    155.  
      tldcd
    156.  
      tlhd
    157.  
      tlhcd
    158.  
      tlmd
    159.  
      tpautoconf
    160.  
      tpclean
    161.  
      tpconfig
    162.  
      tpext
    163.  
      tpreq
    164.  
      tpunmount
    165.  
      verifytrace
    166.  
      vltadm
    167.  
      vltcontainers
    168.  
      vlteject
    169.  
      vltinject
    170.  
      vltoffsitemedia
    171.  
      vltopmenu
    172.  
      vltrun
    173.  
      vmadd
    174.  
      vmchange
    175.  
      vmcheckxxx
    176.  
      vmd
    177.  
      vmdelete
    178.  
      vmoprcmd
    179.  
      vmphyinv
    180.  
      vmpool
    181.  
      vmquery
    182.  
      vmrule
    183.  
      vmupdate
    184.  
      vnetd
    185.  
      vxlogcfg
    186.  
      vxlogmgr
    187.  
      vxlogview
    188.  
      W2KOption

Name

nbkmsutil — run the NetBackup Key Management Service utility

SYNOPSIS

nbkmsutil [-createkey] [-createkg] [-deletekey] [-deletekg] [-export] [-gethmkid] [-getkpkid] [-import] [-ksstats] [-listkeys] [-listkgs] [-modifyhmk] [-modifykey] [-modifykg] [-modifykpk] [-quiescedb] [-recoverkey] [-unquiescedb]

nbkmsutil -createkey [ -nopphrase ] -kgname key_group_name -keyname key_name [ -activate ] [ -desc description ]

nbkmsutil -createkg -kgname key_group_name [ -cipher type ] [ -desc description ]

nbkmsutil -deletekey -keyname key_name -kgname key_group_name

nbkmsutil -deletekg -kgname key_group_name

nbkmsutil -export -path secure_key_container [-key_groups key_group_name_1 ... | -key_file key_file_name]

nbkmsutil -gethmkid

nbkmsutil -getkpkid

nbkmsutil -import -path secure_key_container [-preserve_kgname] [-desc description] [-preview]

nbkmsutil -ksstats [-noverbose]

nbkmsutil -listkeys -kgname key_group_name [ -keyname key_name | -activekey ] [ -verbose ]

nbkmsutil -listkgs [ -kgname key_group_name | -cipher type | -emptykgs | -noactive ] [ -verbose ]

nbkmsutil -modifyhmk [ -nopphrase ]

nbkmsutil -modifykey -keyname key_name -kgname key_group_name [ -state new_state | -activate ] [ -name new_keyname ] [ -desc new_description ]

nbkmsutil -modifykg -kgname key_group_name [ -name new_key_group_name ] [ -desc new_description ]

nbkmsutil -modifykpk [ -nopphrase ]

nbkmsutil -quiescedb

nbkmsutil -recoverkey -keyname key_name -kgnamekey_group_name -tag key_tag [-desc description]

nbkmsutil -unquiescedb

 

On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/admincmd/

On Windows systems, the directory path to this command is <install_path>\NetBackup\bin\admincmd\

DESCRIPTION

The nbkmsutil command performs the following operations:

-createkey

Create a new key. The default state of the new key is Prelive.

-createkg

Create a new key group. The default cipher of the new key group is AES_256.

-deletekey

Delete a key. Only keys in Prelive and Terminated states can be deleted.

-deletekg

Delete an empty key group.

To force the delete of a key group that is not empty, use the -force option.

# nbkmsutil -deletekg -kgname key_group_name -force

-export

Exports keys and keys groups across domains

-gethmkid

Return the current HMK ID.

-getkpkid

Returns the current KPK ID.

-import

Imports keys and keys groups across domains

To preview the results of the import option, use -preview.

# nbkmsutil -import -path secure_key_container -preview

-ksstats

Returns the keystore statistics. The statistics consist of the number of key groups, the total number of keys, and the outstanding quiesce calls.

-listkeys

Get the details of keys.

-listkgs

Get the details of the key groups. If no option is specified, retrieve the details of all the key groups.

-modifyhmk

Modify the host master key (HMK). HMK is used to encrypt the keystore. To modify the HMK, provide an optional seed (passphrase) and an HMK ID which can remind the user of the specified passphrase. The passphrase and the HMK ID are both read interactively.

-modifykey

Modify key attributes.

-modifykg

Modify key group attributes.

-modifykpk

Modify the key protection key (KPK). KPK is used to encrypt KMS keys. KPK is per keystore. To modify the KPK, provide an optional seed (passphrase) and a KPK ID which can remind the user of the specified passphrase. The passphrase and the KPK ID are both read interactively.

-quiescedb

Sends a quiesce request to KMS. If the command succeeds, the current outstanding quiesce count is returned (as multiple backup jobs might quiesce the KMS DB to back it up)

-recoverkey

Restore could fail if a key used in encrypting the backup data is lost. Such Keys can be recovered (re-created) with the knowledge of the original Key's attributes (tag and passphrase).

-unquiescedb

Sends an unquiesce request to KMS. If the command succeeds, the current outstanding quiesce count is returned. A count of zero (0) means that the KMS database is completely unquiesced.

OPTIONS

The nbkmsutil command uses the following options:

-activate

Sets the state of the specified key to active. The default state is prelive.

-activekey

Retrieves the details of a specific key group's active key.

-cipher

The type of cipher that the key group supports. All keys that belong to a key group support the same cipher type. Supported cipher types are BLOW, AES_128, AES_192, and AES_256 (default cipher).

-emptykgs

Retrieves the details of all the key groups with zero keys in it.

-keyname

key_name specifies the name of a key. This name should be unique within a key group. The key group name and key name uniquely identify a key in the keystore.

-kgname

key_group_name specifies the name of a key group. Within a keystore, the key group name uniquely identifies the key group.

-name

Specifies the new name of the key group when used with -modifykg or the new name of the key when used with -modifykey. The new key group name must not conflict with other names in the keystore.

-noactive

Retrieves the details of all the key groups in which there are no active keys.

-nopphrase

Disables the utility function that prompts you for a pass phrase. Instead, the utility creates the key. The default condition is the use of the pass phrase to create a key with a seed. A lengthy seed and a strong seed results in a strong key.

-noverbose

Disables verbosity. The default condition is verbosity, which prints the details in readable format.

-state

new_state specifies the new state of the Key. Possible states are Prelive, Active, Inactive, Deprecated, and Terminated.

Key states can be changed only in the following ways:

  • Prelive to Active

  • Transition between Active and Inactive

  • Transition between Inactive and Deprecated

  • Transition between Deprecated and Terminated

-tag

key_tag specifies a random unique identifier that is created for the key record that the utility creates. The listkey option can display this tag. If you need to recover (recreate) the key record, you need to use the original tag value, hence the - tag option for these recovery options.