Veritas NetBackup™ Virtual Appliance Documentation

"Fail Lock" STIG rule only supports local users, not remote users

When STIG is enabled, one of the enforced remediation rules is xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny. This "Fail Lock" rule is intended to lock an account and prevent login access to it if multiple and successive incorrect passwords have been entered. The current implementation for NetBackup appliances enforces this rule for local users. However, authentication by AD, LDAP, or Kerberos users is not supported when this rule is put into effect when STIG is enabled. Those authentication methods can be re-enabled with the appropriate shell menu commands. If you plan to enable STIG, it is recommended to enable it before configuring remote access.

For details about how to work around this issue, see the following article:

https://www.veritas.com/content/support/en_US/article.100048258

IPsec channel configuration failures

For appliances that use versions 3.1.2 and later, IPsec channel configuration between appliances may fail and show the following errors:

[Error] Remote host <appliance_name> does not have valid IPsec configuration.

[Error] Unable to execute sudo /opt/NBUAppliance/scripts/ipsec_utils.pl -check.

[Error] Failed to create HostInfo object for host <appliance_name>.

[Error] SSH command execution failed.

To resolve this issue, contact Veritas Support and refer them to article 100048279.

DR catalog recovery error if catalog is on a remote server

If you mount a remote DR path on an appliance (MountPoints > Mount) and then configure a catalog backup policy from the NetBackup Java console, the backup job to the mounted remote path results in the following error:

exit status 35 cannot make required directory

To resolve this issue, use the Policy Configuration Wizard in the NetBackup Java console to create a DR catalog backup policy for a NetBackup Appliance. For details, see the following article:

https://www.veritas.com/content/support/en_US/article.100048250

Preflight upgrade self-test fails on attempted upgrades to 3.2 and 3.3.0.1

The following issues may cause the preflight upgrade self-test to fail on attempted upgrades to versions 3.2 and 3.3.0.1

Error message appears when configuring MSDP storage during initial configuration

For new deployments of version 3.3.0.1, the following error message may appear during the initial configuration after setting the role and configuring MSDP storage:

- [Error] Failed to enable optimized synthetic full backups (Storage Server Attribute). This appliance may not be used for synthetic full backups. [status: 20; stdout: ; stderr: Could not connect to storage server. Please verify that <server_name> is a valid storage server of the required type and is reachable on the network. If an OpenStorage plug-in is required for this storage server, verify it is installed. Attribute flag OptimizedImage was not set.

Failed to change storage server eagappflx056, invalid command parameter]

The failed process automatically makes a second attempt to enable optimized synthetic full backups which is successful. You can ignore the error message.

Settings > SNMP polling Enable command fails from remote sessions

When you log in to the appliance from a remote machine and run this command, the message Timeout: No Response from <server_name> may occur. To resolve this issue, see the following article:

https://www.veritas.com/content/support/en_US/article.100048415

No email alert for backup failures when MSDP usage shows 92%

Appliances may not generate email alert V-475-103-1000 if backup jobs are failing when MSDP usage is at 92%. Refer to the appliance interfaces to check the disk usage if backup jobs start to fail.

After an upgrade to software version 3.3.0.1, NetBackup CLI users may not be able to log in to the appliance. To resolve this issue, log in to the appliance as the administrator and run the following command:

Support->Service Restart nbapp-nbcli.

If IPSec functionality is configured on any appliance that you plan to upgrade, the IPsec certificates may not be retained after the upgrade has completed. To avoid this issue, you must export the IPsec certificates before upgrading those appliances.

When you attempt to copy a software update to the share directory, do not initiate any other commands until the copy finishes. If you run a command during the copy process, you may see that the software update is listed and available. However, if you install that software update, it can fail.

If you receive an email stating "No license exists" during the initial configuration of a media server, you can safely disregard the email. The email is sent during host name configuration. The license key file is renamed when it is modified with the new host name, and the alert mechanism cannot locate the license temporarily. When the configuration completes, the license is set correctly. You can check the license key with the Main > Manage > License > List command in the NetBackup Virtual Appliance Shell Menu.

If you use NetBackup OpsCenter, the information that displays for the NetBackup Virtual Appliance on the Appliance Hardware page does not apply. The collected hardware information displays as question marks or as error messages similar to the following:

No <part(s)> detected

All of this information can be disregarded.

The Settings > Alerts > CallHome Registration Show command is available in the NetBackup Virtual Appliance Shell Menu. However, the NetBackup Virtual Appliance is not currently supported for registration.

An appliance self-test fails if the log in banner heading or a single line in the login banner message contains only the following text: ERROR:.

Windows 7/8.1 clients cannot automatically access the appliance CIFS shares. To work around this issue, run the following command from a Windows command prompt on the client:

net use /user:admin \\appliance-name *, where appliance-name is the fully qualified domain name (FQDN) of the appliance.

Enter your appliance administrator password at the prompt.

Once you have run this command, the client is able to access the CIFS shares.

For this release of NetBackup Virtual Appliance, Replication Director (RD) restores do not support dynamic multi-pathing (DMP) when the appliance is used as a backup or a recovery host.

The functionality of Active Directory (AD) user names is inconsistent, as described in the following scenarios:

The Main > Settings > Security > Authentication > LDAP > Certificate set path name command in the NetBackup Virtual Appliance Shell Menu does not allow any certificate path names that contain dashes.