Search <book_title>...

Veritas NetBackup™ Status Codes Reference Guide

Last Published: 2019-07-01

Product(s): NetBackup (8.2)

NetBackup status code: 5987

Message: Cannot fetch the host ID of the NetBackup master server. The master server does not have the certificate.

Explanation: The master server does not have the certificate or the NetBackup Service Layer (NBSL) on the master server is down.

Recommended Action: Ensure that the following occurs:

NBSL is running on the master server
If NBSL is running on the master server, ensure that the host ID-based certificate is deployed on the master server
If the host ID-based certificate is deployed and if you still see this error, refer to the Resolving the master server host name change issue procedure..

Resolving the master server host name change issue

This error may occur if the master server host name is changed from a Fully Qualified Domain Name (FQDN) to a short name (or vice versa) in any of the following scenarios:

NetBackup installation after a disaster
Manual update in the NetBackup configuration file (bp.conf file on the UNIX or Windows registry).

In the following example, NetBackup is installed on a master server with a short name and the catalog backup is run. After a disaster, NetBackup is installed on the master server in a disaster recovery mode, but this time with FQDN. However, the identity of the master server (or disaster recovery package) is restored with the short name. This can cause failure when reissuing the client certificates, automatically renewing the client certificates and deploying new certificates on clients.

To resolve this issue, use the following steps:

Log on to the master server.
Run following command:
UNIX:
/usr/openv/netbackup/bin/nbcertcmd -ping
Windows:
Install_path\NetBackup\bin\nbcertcmd -ping
- If the command is executed successfully, proceed to next step.
- If it fails with the exist status code 8509 (The specified server name was not found in the web service certificate), then carry out the steps that are provided in the following technote:
  https://www.veritas.com/support/en_US/article.000126751
  Proceed to the next step.
Stop and start the NetBackup Web Management Console service on the master server. Use following the NetBackup command:
UNIX:
/usr/openv/netbackup/bin/nbwmc -terminate
/usr/openv/netbackup/bin/nbwmc -start
Windows:
install_path\NetBackup\wmc\bin\nbwmc.exe -stop -srvname "NetBackup Web Management Console"
install_path\NetBackup\wmc\bin\nbwmc.exe -start -srvname "NetBackup Web Management Console"

Perform the user login on the master server. Use the following command:

install_path/netbackup/bin/bpnbat -login -loginType WEB

For example:

install_path\netbackup\bin\bpnbat -login -loginType WEB
      Authentication Broker [abc.example.com is default]:
      Authentication port [0 is default]:
      Authentication type (NIS, NISPLUS, WINDOWS, vx, unixpwd,
						 ldap)[WINDOWS is default]:
      Domain [abc.example.com is default]: 
      Login Name [administrator is default]:
      Password:
      Operation completed successfully.

Note the value of the key Client_Name for the master server. For a clustered master server, note the value of the key Cluster_Name This can be found at the following locations:
UNIX:/usr/openv/netbackup/bp.conf
Windows:HKEY_LOCAL_MACHINE\SOFTWARE\Veritas\NetBackup\CurrentVersion\Config
This value can either be the FQDN or the short name. For example, abc.example.com.
Note the host ID of the master server. You can obtain its value by using the following command:
install_path/netbackup/bin/nbcertcmd -listCertDetails
For a clustered master setup, use the following command:
install_path\netbackup\bin\nbcertcmd -listCertDetails -cluster
This command may return multiple records (if only one record is returned, select the host ID provided in that record).
- If the host name obtained in step 5 is FQDN, then pick the record where the "Issued By" entry matches its short name.
- If the host name obtained in step 5 is a short name, then pick the record where the "Issued By" entry matches its FQDN.
For example:
```
install_path\netbackup\bin\nbcertcmd -listCertDetails   

Master Server : abc
Host ID : xxxxxx-4201-4c6a-xxxx-xxxxx
Issued By : /CN=broker/OU=root@abc/O=vx
Serial Number : 0x62e108c90000000c
Expiry Date : Aug 21 08:42:54 2018 GMT
SHA1 Fingerprint : 50:89:AE:66:12:9A:29:4A:66:E9:DB:71:37:
  C7:EA:94:8C:C6:0C:A0


Master Server : xyz
Host ID : yyyyyy-4785-4252-yyyy-yyyyy
Issued By : /CN=broker/OU=root@xyz.master1.com/O=vx
Serial Number : 0x6ede87a70000000a
Expiry Date : Aug 21 09:52:13 2018 GMT
SHA1 Fingerprint : FE:08:C2:09:AC:5D:82:57:7A:96:5C:C1:4A:
  E6:EC:CA:CC:99:09:D2

Operation completed successfully.
```
Here, 2 records are returned. For the first record, the issuer name provided in the "Issued By" field matches the short name of the client_name obtained in step 5. Select the host ID that appears in the first record.
Add a host ID-to-host name mapping. Map the host ID of the master server that you have obtained in step 6 to the host name that you have obtained in step 5.
Use the following command:
install_path/netbackup/bin/admincmd/nbhostmgmt -a -i host_ID -hm host_name
For example:
```
install_path/netbackup/bin/admincmd/nbhostmgmt -a -i 
  xxxxxx-4201-4c6a-xxxx-xxxxx -hm abc.example.com

abc.example.com is successfully mapped to xxxxxx-4201-4c6a-xxxx-xxxxx.
```
You can also add this host ID-to-host name mapping using the NetBackup Administration Console. Use the Security Management > Host Management > Hosts tab.
Renew the host ID-based certificate of the master server by using the following command:
install_path/netbackup/bin/nbcertcmd -renewCertificate
For a clustered master server, use the following command:
install_path\netbackup\bin\nbcertcmd -renewCertificate -cluster
Continue with the certificate deployment on a client (this can be either a reissue certificate, the automatic renewal of a certificate, or a new certificate deployment).

Click here to view technical notes and other information on the Veritas Support website about this status code.