NetBackup™ Troubleshooting Guide
- Introduction
- Troubleshooting procedures
- About troubleshooting procedures
- Troubleshooting NetBackup problems
- Troubleshooting installation problems
- Troubleshooting configuration problems
- Device configuration problem resolution
- Testing the master server and clients
- Testing the media server and clients
- Resolving network communication problems with UNIX clients
- Resolving network communication problems with Windows clients
- Troubleshooting vnetd proxy connections
- vnetd proxy connection requirements
- Where to begin to troubleshoot vnetd proxy connections
- Verify that the vnetd process and proxies are active
- Verify that the host connections are proxied
- Test the vnetd proxy connections
- Examine the log files of the connecting and accepting processes
- Viewing the vnetd proxy log files
- Troubleshooting security certificate revocation
- Troubleshooting cloud provider's revoked SSL certificate issues
- Troubleshooting cloud provider's CRL download issues
- How a host's CRL affects certificate revocation troubleshooting
- NetBackup job fails because of revoked certificate or unavailability of CRLs
- NetBackup job fails because of apparent network error
- NetBackup job fails because of unavailable resource
- Master server security certificate is revoked
- Determining a NetBackup host's certificate state
- Troubleshooting issues with external CA-signed certificate revocation
- About troubleshooting networks and host names
- Verifying host name and service entries in NetBackup
- Example of host name and service entries on UNIX master server and client
- Example of host name and service entries on UNIX master server and media server
- Example of host name and service entries on UNIX PC clients
- Example of host name and service entries on UNIX server that connects to multiple networks
- About the bpclntcmd utility
- Using the Host Properties window to access configuration settings
- Resolving full disk problems
- Frozen media troubleshooting considerations
- Troubleshooting problems with the NetBackup web services
- Troubleshooting problems with the NetBackup web server certificate
- Resolving PBX problems
- Troubleshooting problems with validation of the remote host
- Troubleshooting Auto Image Replication
- Troubleshooting network interface card performance
- About SERVER entries in the bp.conf file
- About unavailable storage unit problems
- Resolving a NetBackup Administration operations failure on Windows
- Resolving garbled text displayed in NetBackup Administration Console on a UNIX computer
- Troubleshooting error messages in the NetBackup Administration Console
- Extra disk space required for logs and temporary files for the NetBackup Administration Console
- Unable to logon to the NetBackup Administration Console after external CA configuration
- Troubleshooting file-based external certificate issues
- Troubleshooting Windows certificate store issues
- Troubleshooting backup failures
- Troubleshooting backup failure issues with NAT clients or NAT servers
- Troubleshooting issues with the NetBackup Messaging Broker (or nbmqbroker) service
- Issues with email notifications for Windows systems
- Issues with KMS configuration
- Issues with initiating the NetBackup CA migration because of large key size
- Issues with the non-privileged user (service user) account
- Issues with group name format in the auth.conf file
- Troubleshooting the VxUpdate add package process
- Issues with FIPS mode
- Issues with malware scanning
- Issues with NetBackup jobs that are enabled for data-in-transit encryption
- Issues with Unstructured Data Instant Access
- Using NetBackup utilities
- About NetBackup troubleshooting utilities
- About the analysis utilities for NetBackup debug logs
- About the Logging Assistant
- About network troubleshooting utilities
- About the NetBackup support utility (nbsu)
- About the NetBackup consistency check utility (NBCC)
- About the NetBackup consistency check repair (NBCCR) utility
- About the nbcplogs utility
- About the robotic test utilities
- About the NetBackup Smart Diagnosis (nbsmartdiag) utility
- About log collection by job ID
- Disaster recovery
- About disaster recovery
- About disaster recovery requirements
- Disaster recovery packages
- About disaster recovery settings
- Recommended backup practices
- About disk recovery procedures for UNIX and Linux
- About clustered NetBackup server recovery for UNIX and Linux
- About disk recovery procedures for Windows
- About clustered NetBackup server recovery for Windows
- Generating a certificate on a clustered master server after disaster recovery installation
- About restoring disaster recovery package
- About the DR_PKG_MARKER_FILE environment variable
- Restoring disaster recovery package on Windows
- Restoring disaster recovery package on UNIX
- About recovering the NetBackup catalog
- About NetBackup catalog recovery on Windows computers
- About NetBackup catalog recovery from disk devices
- About NetBackup catalog recovery and symbolic links
- About NetBackup catalog recovery
- NetBackup disaster recovery email example
- About recovering the entire NetBackup catalog
- Establishing a connection with NAT media server before catalog recovery
- About recovering the NetBackup catalog image files
- About recovering the NetBackup relational database
- Recovering the NetBackup catalog when NetBackup Access Control is configured
- Recovering the NetBackup catalog from a nonprimary copy of a catalog backup
- Recovering the NetBackup catalog without the disaster recovery file
- Recovering a NetBackup user-directed online catalog backup from the command line
- Restoring files from a NetBackup online catalog backup
- Unfreezing the NetBackup online catalog recovery media
- Steps to carry out when you see exit status 5988 during catalog recovery
- Index
Unable to logon to the NetBackup Administration Console after external CA configuration
Review the troubleshooting following scenarios.
For information on the external CA support in NetBackup, refer to the NetBackup Security and Encryption Guide.
If the vnetd service is down on the host to which the NetBackup Administration Console is connecting
Check if the services are up on the host and try logging in again.
If external certificate's private key is not available or is in an incorrect format, error VRTS-28678 is displayed.
Check if the path provided for the ECA_PRIVATE_KEY_PATH configuration option is valid (it should not be empty).
Check if the path provided for ECA_PRIVATE_KEY_PATH is accessible and also if the private key file has required access permissions.
Provide a valid private key and try logging in again.
In case of Windows certificate store, do the following:
Run the certlm.msc command.
In case certlm.msc is not working, you can access the Windows certificate store by running the mmc.exe command. Go to .
Open the certificate by double clicking it.
The certificate with private key should have a message stating that you have a private key corresponding to this certificate.
If the external certificate is not present while you establish the trust with the NetBackup Administration Console.
Check if the path provided for the ECA_TRUST_STORE_PATH configuration option is not empty.
Check if the path provided for ECA_TRUST_STORE_PATH is accessible and also if the CA certificate file has required access permissions.
Provide a valid external certificate and try logging in.
In case of Windows certificate store, do the following:
Check if the root CA certificate is added in the Windows Cert Store's Trusted Root Certificate Authorities.
Run certlm.msc command. In the certificate management window, open the store named Trusted Root Certificate Authorities. The Trusted Root Certificate Authorities store contains all the self-signed certificates that are trusted by that machine.
In case certlm.msc is not working, you can access the Windows certificate store by running mmc.exe. Go to .
Select certificates from left hand side.
Click .
Select computer account. Click Next.
Click and then .
Click .
Check if the root CA certificate in the certificate chain is present in the Trusted Root Certificate Authorities store.
If the root CA certificate is not present, do the following:
Click .
Select .PEM or .CRT or .CER file of the certificate and click .
Note:
All the certificates should be imported in the local machine store and not in the current user store. You can verify the current store in the certificate management window.
Add a valid external CA certificate and try logging in.
If an external CA-signed certificate is not present or not accessible, the following error is displayed:
The host does not have external CA-signed certificate. The certificate is mandatory to establish a secure connection.
Check if the path provided for ECA_CERT_PATH in NetBackup configuration file is not empty.
Check if the path provided for ECA_CERT_PATH points to the entire certificate chain.
Check if the path provided for ECA_CERT_PATH is accessible and also if it has required access permissions.
Provide a valid external CA-signed certificate and try logging in.
In case of Windows certificate store, do the following:
Check if ECA_CERT_PATH contains the appropriate value: Windows Certificate Store Name\Issuer Name\Subject Name. Verify if the certificate exists in the Windows certificate store.
Run the certlm.msc command.
In case certlm.msc is not working, you can access the Windows certificate store by running the mmc.exe.
File > Add Remove Snap in.
Navigate to your certificate as per your input Windows Certificate Store Name\Issuer Name\Subject Name.
Open your certificate by double-clicking it.
Ensure that it is valid, has a private key, a correct issuer name, and a correct subject name.
If you are using $hostname in Subject name, check that certificate subject has fully qualified domain name of the host.
If this is not the case, either change the ECA_CERT_PATH or put the right certificate in Windows certificate store and then try logging in.
Certificate revocation list (CRL) is not signed by a trusted authority.
This may occur at the time of login if the master server was configured to use NetBackup certificates and later it was enabled to use external certificates and vice versa. So the NetBackup Administration Console starts using the new CRL if you click Activity Monitor, locks the screen, tries to login again or in the periodic checks after every 1 hour, the certificate revocation status verification fails.
To fix this issue, you need to close the console and login again so that the peer host's certificate and the CRL are in sync.
If logging in again does not fix the issue then the reason can be the new CRL was not downloaded.
Run following command after correcting the CRL format:
UNIX: /usr/openv/netbackup/bin/nbcertcmd -updateCRLCache
Windows: install_path\Veritas\Netbackup\bin\nbcertcmd -updateCRLCache
The revocation status of the host certificate cannot be verified using the CRL, because the CRL format is not valid.
This error can occur if a delta CRL is used.
NetBackup does not support delta CRLs, so you need to use non-delta CRLs.
Run following command after correcting the CRL format:
UNIX: /usr/openv/netbackup/bin/nbcertcmd -updateCRLCache
Windows: install_path\Veritas\Netbackup\bin\nbcertcmd -updateCRLCache
The certificate of the host name is revoked.
If the certificate was revoked in error, reissue a certificate for the host.
If the certificate was revoked intentionally, a security breach may have occurred. Contact your security administrator.
The Certificate Revocation List could not be downloaded. Therefore the certificate revocation status could not be verified.
The possible causes include the following:
ECA_CRL_PATH is missing or has incorrect path.
The CRL file is missing. The CRL file is corrupted.
The CRL file could not be locked.
The CRL file could not be unlocked.
For more information, see the bpjava logs.
The Certificate Revocation List is not updated. Therefore the certificate revocation status could not be verified.
The possible causes include the following:
The next update date / time of the CRL is older than the current system date / time.
The CRL was valid at the time of login. The console was open and now the CRL has become invalid.
Ensure that the system time is correct.
In case the new CRL was not downloaded, run the following command
UNIX: /usr/openv/netbackup/bin/nbcertcmd -updateCRLCache
Windows: install_path\Veritas\Netbackup\bin\nbcertcmd -updateCRLCache
Unable to connect to the NetBackup Web Management Console service.
The possible causes include the following:
The NetBackup Web management Console service is down.
ECA_CERT_PATH does not point to the entire certificate chain.
Web service certificate's issuer and the issuer of the host certificate may not match.
If both the certificates are not issued by the same external CA, certificate trust verification fails.
Review the following:
It is mandatory to provide the path to the certificate file that contains the entire chain of certificates (except the root certificate).
If chain is not specified, the certificate trust verification fails and the console is not able to connect to the web service.
Ensure that the web server's certificate and the host certificate are issued by same external CA.