Veritas NetBackup™ Commands Reference Guide

Last Published:
Product(s): NetBackup (8.2)
  1. Introduction
    1.  
      About NetBackup commands
    2.  
      Navigating multiple menu levels
    3.  
      NetBackup command conventions
    4.  
      NetBackup Media Manager command notes
    5.  
      IPV6 updates
  2. Appendix A. NetBackup Commands
    1.  
      acsd
    2.  
      add_media_server_on_clients
    3.  
      backupdbtrace
    4.  
      backuptrace
    5.  
      bmrc
    6.  
      bmrconfig
    7.  
      bmrepadm
    8.  
      bmrprep
    9.  
      bmrs
    10.  
      bmrsrtadm
    11.  
      bp
    12.  
      bparchive
    13.  
      bpbackup
    14.  
      bpbackupdb
    15.  
      bpcatarc
    16.  
      bpcatlist
    17.  
      bpcatres
    18.  
      bpcatrm
    19.  
      bpcd
    20.  
      bpchangeprimary
    21.  
      bpclient
    22.  
      bpclimagelist
    23.  
      bpclntcmd
    24.  
      bpclusterutil
    25.  
      bpcompatd
    26.  
      bpconfig
    27.  
      bpdbjobs
    28.  
      bpdbm
    29.  
      bpdgclone
    30.  
      bpdown
    31.  
      bpduplicate
    32.  
      bperror
    33.  
      bpexpdate
    34.  
      bpfis
    35.  
      bpflist
    36.  
      bpgetconfig
    37.  
      bpgetdebuglog
    38.  
      bpimage
    39.  
      bpimagelist
    40.  
      bpimmedia
    41.  
      bpimport
    42.  
      bpinst
    43.  
      bpkeyfile
    44.  
      bpkeyutil
    45.  
      bplabel
    46.  
      bplist
    47.  
      bpmedia
    48.  
      bpmedialist
    49.  
      bpminlicense
    50.  
      bpnbat
    51.  
      bpnbaz
    52.  
      bppficorr
    53.  
      bpplcatdrinfo
    54.  
      bpplclients
    55.  
      bppldelete
    56.  
      bpplinclude
    57.  
      bpplinfo
    58.  
      bppllist
    59.  
      bpplsched
    60.  
      bpplschedrep
    61.  
      bpplschedwin
    62.  
      bppolicynew
    63.  
      bpps
    64.  
      bprd
    65.  
      bprecover
    66.  
      bprestore
    67.  
      bpretlevel
    68.  
      bpschedule
    69.  
      bpschedulerep
    70.  
      bpsetconfig
    71.  
      bpstsinfo
    72.  
      bpstuadd
    73.  
      bpstudel
    74.  
      bpstulist
    75.  
      bpsturep
    76.  
      bptestbpcd
    77.  
      bptestnetconn
    78.  
      bptpcinfo
    79.  
      bpup
    80.  
      bpverify
    81.  
      cat_convert
    82.  
      cat_export
    83.  
      cat_import
    84.  
      configureCertsForPlugins
    85.  
      configureMQ
    86.  
      configurePorts
    87.  
      configureWebServerCerts
    88.  
      create_nbdb
    89.  
      csconfig cldinstance
    90.  
      csconfig cldprovider
    91.  
      csconfig meter
    92.  
      csconfig throttle
    93.  
      csconfig reinitialize
    94.  
      duplicatetrace
    95.  
      importtrace
    96.  
      jbpSA
    97.  
      jnbSA
    98.  
      ltid
    99.  
      manageClientCerts
    100.  
      mklogdir
    101.  
      nbauditreport
    102.  
      nbcatsync
    103.  
      NBCC
    104.  
      NBCCR
    105.  
      nbcertcmd
    106.  
      nbcertupdater
    107.  
      nbcldutil
    108.  
      nbcloudrestore
    109.  
      nbcomponentupdate
    110.  
      nbcplogs
    111.  
      nbdb_admin
    112.  
      nbdb_backup
    113.  
      nbdb_move
    114.  
      nbdb_ping
    115.  
      nbdb_restore
    116.  
      nbdb_unload
    117.  
      nbdbms_start_server
    118.  
      nbdbms_start_stop
    119.  
      nbdc
    120.  
      nbdecommission
    121.  
      nbdelete
    122.  
      nbdeployutil
    123.  
      nbdevconfig
    124.  
      nbdevquery
    125.  
      nbdiscover
    126.  
      nbdna
    127.  
      nbemm
    128.  
      nbemmcmd
    129.  
      nbfindfile
    130.  
      nbfirescan
    131.  
      nbftadm
    132.  
      nbftconfig
    133.  
      nbgetconfig
    134.  
      nbhba
    135.  
      nbholdutil
    136.  
      nbhostidentity
    137.  
      nbhostmgmt
    138.  
      nbhypervtool
    139.  
      nbimageshare
    140.  
      nbinstallcmd
    141.  
      nbjm
    142.  
      nbkmsutil
    143.  
      nboraadm
    144.  
      nborair
    145.  
      nbpem
    146.  
      nbpemreq
    147.  
      nbperfchk
    148.  
      nbplupgrade
    149.  
      nbrb
    150.  
      nbrbutil
    151.  
      nbregopsc
    152.  
      nbreplicate
    153.  
      nbrepo
    154.  
      nbrestorevm
    155.  
      nbseccmd
    156.  
      nbsetconfig
    157.  
      nbsnapimport
    158.  
      nbsnapreplicate
    159.  
      nbsqladm
    160.  
      nbstl
    161.  
      nbstlutil
    162.  
      nbstop
    163.  
      nbsu
    164.  
      nbsvrgrp
    165.  
      resilient_clients
    166.  
      restoretrace
    167.  
      stopltid
    168.  
      tl4d
    169.  
      tl8d
    170.  
      tl8cd
    171.  
      tldd
    172.  
      tldcd
    173.  
      tlhd
    174.  
      tlhcd
    175.  
      tlmd
    176.  
      tpautoconf
    177.  
      tpclean
    178.  
      tpconfig
    179.  
      tpext
    180.  
      tpreq
    181.  
      tpunmount
    182.  
      verifytrace
    183.  
      vltadm
    184.  
      vltcontainers
    185.  
      vlteject
    186.  
      vltinject
    187.  
      vltoffsitemedia
    188.  
      vltopmenu
    189.  
      vltrun
    190.  
      vmadd
    191.  
      vmchange
    192.  
      vmcheckxxx
    193.  
      vmd
    194.  
      vmdelete
    195.  
      vmoprcmd
    196.  
      vmphyinv
    197.  
      vmpool
    198.  
      vmquery
    199.  
      vmrule
    200.  
      vmupdate
    201.  
      vnetd
    202.  
      vssat
    203.  
      vwcp_manage
    204.  
      vxlogcfg
    205.  
      vxlogmgr
    206.  
      vxlogview
    207.  
      W2KOption

Name

nbseccmd — run the NetBackup Security Configuration service utility

SYNOPSIS

nbseccmd -drpkgpassphrase

nbseccmd - getsecurityconfig -insecurecommunication | -autoaddhostmapping [-masterserver master_server_name]

nbseccmd - setsecurityconfig -insecurecommunication on|off | -autoaddhostmapping on|off [-masterserver master_server_name]

nbseccmd -setuptrustedmaster -add | -update | -remove -masterserver master_server_name -remotemasterserver remote_master_server [-domainname domain_name] [-username username] -fpfile filename

nbseccmd -setuptrustedmaster - add | -update | -remove -info answer_file

nbseccmd -help

On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/admincmd/

On Windows systems, the directory path to this command is install_path\NetBackup\bin\admincmd\

DESCRIPTION

Use the nbseccmd command to establish trust relationships among various master servers.

You must have root or administrator permissions to use this command if NetBackup Access Control (NBAC) is enabled.

Note:

If the source or the target master server version is NetBackup 8.0 or earlier, please refer to the NetBackup Commands Guide for 8.0 or earlier. The command has undergone a number of changes for NetBackup 8.2.

OPTIONS

-autoaddhostmapping [on|off]

Use this option to manage the addition of host ID to the host name or the IP addresses that the master server automatically detects.

Hosts may have multiple host names or IP addresses associated with them. For successful communication among hosts, all relevant host names and IP addresses must be mapped to the respective host IDs. During communication, NetBackup may detect new host names or IP addresses with respect to a host ID.

When you use the -getsecurityconfig, the option takes no parameters, and reports the current setting for the -autoaddhostmapping value.

When you used the -setsecurityconfig option, this option enables or disables automatic host mapping. Use the on parameter to automatically map the host ID to the host name or the IP addresses detected. Disable this action with the off parameter.

-domainname domain_name

Specifies the domain to which the user that is specified in -username belongs. You are prompted to enter a password to validate the credentials of the remote master server host.

The -domainname option is mandatory for a target master server that uses NetBackup certificates.

-drpkgpassphrase

The -drpkgpassphrase option is used to specify the passphrase that is used to encrypt disaster recovery packages. If a passphrase already exists, it is overwritten.

Note:

You must set the passphrase for successful catalog backups. Failure to set the passphrase results in failed catalog backups.

The disaster recovery package stores the identity of the NetBackup master server and is created during each catalog backup.

These packages are encrypted with the passphrase that you specify here. You must provide this passphrase when you reinstall NetBackup on the master server after a disaster.

Before using this command, you must run the bpnbat command to log on:

bpnbat -login -loginType WEB

When you set the passphrase, please note:

  • Passphrase must contain a minimum of eight characters and a maximum of 1024 characters.

  • The existing passphrase and the new passphrase must be different.

  • You must be an authorized user with administrator or root privileges or you must be an Enhanced Auditing user to run the nbseccmd -drpkgpassphrase command.

  • Only the characters that are listed are supported for the passphrase:

    • White spaces

    • Uppercase and lowercase characters (A to Z, a to z)

    • Numbers (0 to 9)

    • The special characters shown: ~ ! @ # $ % ^ & * ( ) _ + - = ' { } [ ] | : ; ' " , . / ? < >

    Caution:

    If you enter an unsupported character, you may face issues during disaster recovery package restore. The passphrase may not be validated and you may not be able to restore the disaster recovery package.

-fpfile filename

This option accepts the root certificate fingerprint information that is required for validating the root certificate of the remote master server. You can store the fingerprint details in a text file.

-getsecurityconfig -autoaddhostmapping | -insecurecommunication

Use this option to get the security configuration information for NetBackup. When you use the -autoaddhostmapping option, you get the value for the -autoaddhostmapping option. When you use the -insecurecommunication option, you get the value for the -insecurecommunication option.

-info answerfile

The -info option accepts the information that is required for setting up a trusted master server. The information is stored in an answer file, which is a text file. It contains the following entries:

masterserver:
remotemasterserver:
trusttype:
domainname:
username:
password:
token:
fpfile:

The password is optional in the answer file. If you do not provide a password, you are prompted for the password when you run the command.

Note:

The trusttype value is valid only for master servers at version 8.0 and earlier. Possible values for trusttype are mutualtrust, remoteonly, and localonly. The trusttype of localonly does not require a domain name or user credentials.

The entries in your answer file must match the format that is shown in the example.

Example sample file:

masterserver:testmaster1
remotemasterserver:testmaster2
trusttype:mutualtrust
domainname:testdomain
username:Administrator
password:abc123
-insecurecommunication [on | off]

Use this option to manage insecure communication within your NetBackup environment. The on parameter enables insecure communication with all NetBackup hosts that are present in the NetBackup environment. Disable insecure communication with the off parameter.

Veritas implemented new security features in 8.1 which are not present in NetBackup 8.0 and earlier. NetBackup communicates with 8.0 and earlier hosts insecurely. For increased security, upgrade all your hosts to the current version of NetBackup, and then use this option with the on parameter. This action ensures that only secure communication is possible between NetBackup hosts.

-masterserver master_server_name

Specifies the name of the master server that the user has logged into. Auto Image Replication uses this name for the current master server or the source master server.

-remotemasterserver remote_master_server

Specifies the name of the remote master server with whom the trust is to be established. Auto Image Replication uses this name for the target master server.

-remoteonly | -localonly | -mutualtrust

Specifies the way that a trust must be established. Either the local master (source) trusts the remote master (target) or vice versa. If neither of these options is specified, a two-way trust (-mutualtrust) is established.

-setsecurityconfig -autoaddhostmapping | -insecurecommunication

Use this option to set the security configuration information for NetBackup. When you use the -autoaddhostmapping option, you set the behavior for the addition of host names and IP addresses. When you use the -insecurecommunication option, you set the behavior for secure communication.

-setuptrustedmaster -add | -update | -remove

Add, update, or remove inter-domain trust across master servers. To update a trust relationship, run the -update option on both the source and the target server. Both servers must be on version 8.1. or later. You must use the -update option if after you establish a trust, you upgrade the source or the target master server to version 8.1 or later. To remove a trusted master server, the domain, user name, and password are not required.

You can update the trust with external certificate to the trust with NetBackup certificate and vice versa.

You must run the bpnbat command to remove a trusted master before you can use the -setuptrustedmaster option. Log on locally on the master server you want to remove and use the bpnbat command as shown: bpnbat -login -loginType WEB

To remove the trust that is added using an external certificate, you do not need to run the bpnbat -login command.

-username username

Specifies the logon user name of the remote master server host. This option is used with the -domainname option. You are prompted to enter a password to validate the credentials of the remote master server host. If you specify only the domain name, you are prompted to enter the Authorization Token of the remote master server.

The -username option is mandatory for the target master server that uses NetBackup certificate.

EXAMPLES

Example 1 - Set up a trusted master server using user credentials.

nbseccmd -setuptrustedmaster -add -masterserver testmaster1
-remotemasterserver testmaster2 -domainname testdomain -username 
Administrator
Password:******

The SHA1 fingerprint of root certificate is 
C7:87:7F:9D:13:B4:67:F6:D9:65:F4:95:EC:DC:D4:50:8C:20:18:BF.

Are you sure you want to continue using this certificate ? (y/n): y

The validation of root certificate fingerprint is successful.
CA certificate stored successfully from server testmaster2.
testdomain.com.
Host certificate received successfully from server testmaster2.
testdomain.com.
Trusted master operation successful.

Example 2 - Set up a trusted master server using authentication token.

nbseccmd -setuptrustedmaster -add -masterserver testmaster1
-remotemasterserver testmaster2 -domainname testdomain
Authorization Token:***** 
The SHA1 fingerprint of root certificate is 
C7:87:7F:9D:13:B4:67:F6:D9:65:F4:95:EC:DC:D4:50:8C:20:18:BF.
Are you sure you want to continue using this certificate ? (y/n): y
The validation of root certificate fingerprint is successful.
CA certificate stored successfully from server testmaster2.
testdomain.com.
Host certificate received successfully from server testmaster2.
testdomain.com.
Trusted master operation successful.

Example 3 - Set up a trusted master server using -fpfile.

nbseccmd -setuptrustedmaster -add -masterserver testmaster1
-remotemasterserver testmaster2 -domainname testdomain -username 
Administrator
-fpfile C:\fp_file

Password:******

The validation of root certificate fingerprint is successful.
CA certificate stored successfully from server testmaster2.
testdomain.com.
Host certificate received successfully from server testmaster2.
testdomain.com.
Trusted master operation successful.

Example 4 - Set up a trusted master server using an answer file.

nbseccmd -setuptrustedmaster -add -info C:\nbseccmd_answerfile.txt

The validation of root certificate fingerprint is successful.
CA certificate stored successfully from server testmaster2.
testdomain.com.
Host certificate received successfully from server testmaster2.
testdomain.com.
Trusted master operation successful.

Example 5 - Update trust after upgrading both the source and master server to version 8.1 and later.

-setuptrustedmaster -update -masterserver testmaster1 -remotemasterserver 
testmaster2
Authorization Token:
Authenticity of root certificate cannot be established.
The SHA1 fingerprint of root certificate is finger_print_details
Are you sure you want to continue using this certificate ? (y/n): y
The validation of root certificate fingerprint is successful.
CA certificate stored successfully from server testmaster2.
Host certificate received successfully from server testmaster2.
Trusted master operation successful

Example 6 - Remove a trusted master server.

-setuptrustedmaster -remove -masterserver testmaster2 -remotemasterserver 
testmaster1

Certificate revoke request processed successfully.
Trusted master operation successful