Veritas NetBackup™ Troubleshooting Guide

Last Published:
Product(s): NetBackup (8.2)
  1. Introduction
    1.  
      NetBackup logging and status code information
    2.  
      Troubleshooting a problem
    3.  
      Problem report for Technical Support
    4.  
      About gathering information for NetBackup-Java applications
  2. Troubleshooting procedures
    1.  
      About troubleshooting procedures
    2. Troubleshooting NetBackup problems
      1.  
        Verifying that all processes are running on UNIX servers
      2.  
        Verifying that all processes are running on Windows servers
    3.  
      Troubleshooting installation problems
    4.  
      Troubleshooting configuration problems
    5.  
      Device configuration problem resolution
    6.  
      Testing the master server and clients
    7.  
      Testing the media server and clients
    8.  
      Resolving network communication problems with UNIX clients
    9.  
      Resolving network communication problems with Windows clients
    10. Troubleshooting vnetd proxy connections
      1.  
        vnetd proxy connection requirements
      2.  
        Where to begin to troubleshoot vnetd proxy connections
      3.  
        Verify that the vnetd process and proxies are active
      4.  
        Verify that the host connections are proxied
      5.  
        Test the vnetd proxy connections
      6.  
        Examine the log files of the connecting and accepting processes
      7.  
        Viewing the vnetd proxy log files
    11. Troubleshooting security certificate revocation
      1.  
        Troubleshooting cloud provider's revoked SSL certificate issues
      2.  
        Troubleshooting cloud provider's CRL download issues
      3.  
        How a host's CRL affects certificate revocation troubleshooting
      4.  
        NetBackup job fails because of revoked certificate or unavailability of CRLs
      5.  
        NetBackup job fails because of apparent network error
      6.  
        NetBackup job fails because of unavailable resource
      7.  
        Master server security certificate is revoked
      8.  
        Determining a NetBackup host's certificate state
      9.  
        Troubleshooting issues with external CA-signed certificate revocation
    12.  
      About troubleshooting networks and host names
    13. Verifying host name and service entries in NetBackup
      1.  
        Example of host name and service entries on UNIX master server and client
      2.  
        Example of host name and service entries on UNIX master server and media server
      3.  
        Example of host name and service entries on UNIX PC clients
      4.  
        Example of host name and service entries on UNIX server that connects to multiple networks
    14.  
      About the bpclntcmd utility
    15.  
      Using the Host Properties window to access configuration settings
    16.  
      Resolving full disk problems
    17. Frozen media troubleshooting considerations
      1.  
        Logs for troubleshooting frozen media
      2.  
        About the conditions that cause media to freeze
    18. Troubleshooting problems with the NetBackup web services
      1.  
        Viewing NetBackup web services logs
      2.  
        Troubleshooting web service issues after external CA configuration
    19.  
      Troubleshooting problems with the NetBackup web server certificate
    20. Resolving PBX problems
      1.  
        Checking PBX installation
      2.  
        Checking that PBX is running
      3.  
        Checking that PBX is set correctly
      4.  
        Accessing the PBX logs
      5.  
        Troubleshooting PBX security
      6.  
        Determining if the PBX daemon or service is available
    21. Troubleshooting problems with validation of the remote host
      1.  
        Viewing logs pertaining to host validation
      2.  
        Enabling insecure communication with NetBackup 8.0 and earlier hosts
      3.  
        Approving pending host ID-to-host name mappings
      4.  
        Clearing host cache
    22. About troubleshooting Auto Image Replication
      1. Troubleshooting Auto Image Replication
        1.  
          Targeted AIR trusted master server operation failed in case of external certificate configuration
      2.  
        About troubleshooting automatic import jobs
    23.  
      Troubleshooting network interface card performance
    24.  
      About SERVER entries in the bp.conf file
    25.  
      About unavailable storage unit problems
    26.  
      Resolving a NetBackup Administration operations failure on Windows
    27.  
      Resolving garbled text displayed in NetBackup Administration Console on a UNIX computer
    28.  
      Unable to logon to the NetBackup Administration Console after external CA configuration
    29.  
      Troubleshooting file-based external certificate issues
    30.  
      Troubleshooting Windows certificate store issues
    31.  
      Troubleshooting backup failures
    32.  
      Troubleshooting backup failure issues with NAT clients
    33.  
      Troubleshooting issues with the NetBackup Messaging Broker (or nbmqbroker) service
  3. Using NetBackup utilities
    1.  
      About NetBackup troubleshooting utilities
    2.  
      About the analysis utilities for NetBackup debug logs
    3.  
      About the Logging Assistant
    4.  
      About network troubleshooting utilities
    5. About the NetBackup support utility (nbsu)
      1.  
        Output from the NetBackup support utility (nbsu)
      2.  
        Example of a progress display for the NetBackup support utility (nbsu)
    6. About the NetBackup consistency check utility (NBCC)
      1.  
        Output from the NetBackup consistency check utility (NBCC)
      2.  
        Example of an NBCC progress display
    7.  
      About the NetBackup consistency check repair (NBCCR) utility
    8.  
      About the nbcplogs utility
    9. About the robotic test utilities
      1.  
        Robotic tests on UNIX
      2.  
        Robotic tests on Windows
  4. Disaster recovery
    1.  
      About disaster recovery
    2.  
      About disaster recovery requirements
    3.  
      Disaster recovery packages
    4.  
      About disaster recovery settings
    5.  
      Recommended backup practices
    6. About disk recovery procedures for UNIX and Linux
      1. About recovering the master server disk for UNIX and Linux
        1.  
          Recovering the master server when root is intact
        2.  
          Recovering the master server when the root partition is lost
      2.  
        About recovering the NetBackup media server disk for UNIX
      3.  
        Recovering the system disk on a UNIX client workstation
    7. About clustered NetBackup server recovery for UNIX and Linux
      1.  
        Replacing a failed node on a UNIX or Linux cluster
      2.  
        Recovering the entire UNIX or Linux cluster
    8. About disk recovery procedures for Windows
      1. About recovering the master server disk for Windows
        1.  
          Recovering the master server with Windows intact
        2.  
          Recovering the master server and Windows
      2.  
        About recovering the NetBackup media server disk for Windows
      3.  
        Recovering a Windows client disk
    9. About clustered NetBackup server recovery for Windows
      1.  
        Replacing a failed node on a Windows VCS cluster
      2.  
        Recovering the shared disk on a Windows VCS cluster
      3.  
        Recovering the entire Windows VCS cluster
    10.  
      Generating a certificate on a clustered master server after disaster recovery installation
    11.  
      About restoring disaster recovery package
    12.  
      About the DR_PKG_MARKER_FILE environment variable
    13.  
      Restoring disaster recovery package on Windows
    14.  
      Restoring disaster recovery package on UNIX
    15. About recovering the NetBackup catalog
      1.  
        About NetBackup catalog recovery on Windows computers
      2.  
        About NetBackup catalog recovery from disk devices
      3.  
        About NetBackup catalog recovery and symbolic links
      4. About NetBackup catalog recovery and OpsCenter
        1.  
          Specifying the NetBackup job ID number after a catalog recovery
      5.  
        NetBackup disaster recovery email example
      6. About recovering the entire NetBackup catalog
        1.  
          Recovering the entire NetBackup catalog using the Catalog Recovery Wizard
        2.  
          Recovering the entire NetBackup catalog using bprecover -wizard
      7. About recovering the NetBackup catalog image files
        1.  
          Recovering the NetBackup catalog image files using the Catalog Recovery Wizard
        2.  
          Recovering the NetBackup catalog image files using bprecover -wizard
      8. About recovering the NetBackup relational database
        1.  
          Recovering NetBackup relational database files from a backup
        2.  
          Recovering the NetBackup relational database files from staging
        3.  
          About processing the relational database in staging
      9.  
        Recovering the NetBackup catalog when NetBackup Access Control is configured
      10.  
        Recovering the NetBackup catalog from a nonprimary copy of a catalog backup
      11.  
        Recovering the NetBackup catalog without the disaster recovery file
      12.  
        Recovering a NetBackup user-directed online catalog backup from the command line
      13.  
        Restoring files from a NetBackup online catalog backup
      14.  
        Unfreezing the NetBackup online catalog recovery media
      15.  
        Steps to carry out when you see exit status 5988 during catalog recovery

Troubleshooting Windows certificate store issues

The web service certificate is issued by an unknown certificate authority when using Windows certificate store

Problem

The web service certificate cannot be trusted while enrolling the host certificate.

Cause

This issue is caused by one of the following:

  • The web service certificate that is used for communication is not configured properly.

  • The root certificate in the certificate chain of web service certificate is not present in the Trusted Root Certification Authorities of the Windows certificate store.

Solution

To resolve the issue, review the following causes and run the following command to determine the current state of the problem.

Install_Path/bin/ nbcertcmd -enrollCertificate -preCheck -server server_name

Install_Path refers to the following:

On Windows: VERITAS\NetBackup\bin

On Unix: /usr/openv/netbackup/bin

Solution for the cause: The web service certificate that is used for communication is not configured properly

Check if web server is configured with valid certificate along with its CA certificates.

  • Run the following command to list the certificates that are configured for the web server.

    Install_Path/nbcertcmd -listallcertificates -jks

    On Windows: C:\Program Files\ VERITAS\NetBackup\bin\nbcertcmd -listallcertificates -jks

    On Unix: /usr/openv/netbackup/bin/netbackup/bin/nbcertcmd -listallcertificates -jks

  • Ensure that all the certificates in the chain (except the root CA certificate) are present in the jks.

    Check the following parameters in the nbcertcmd -listallcertificates -jks output.

    • Alias name: eca

    • Entry type: PrivateKeyEntry

    If they are not present, add the CA chain in the end of the entity certificate file that is the web service certificate file. The web service certificate should be at the top, its issuer CA certificate is below that, issuer of that CA certificate is below that, and so on.

    If the certificate chain has only two certificates ( root certificate and web service certificate), the certificate file has only one certificate that is the web service certificate.

    Run the configureWebServerCerts command.

Solution for the cause: The root certificate in the certificate chain of the web service certificate is not present in the Windows certificate store
  • Run the certlm.msc command.

    In the certificate management window, open the store named Trusted Root Certificate Authorities.

    The Trusted Root Certificate Authorities store contains all the self-signed certificates that are trusted by that machine.

    • In case certlm.msc does not work, you can access the Windows certificate store by running the mmc.exe command.

    • File > Add Remove Snap in.

    • Select the certificates from the left side.

    • Click Add.

    • Select the Computer account.

    • Click Next > Finish > OK.

    • Click Trusted Root Certification Authorities > Certificates.

    • Check if the root CA certificate in the certificate chain used to configure the web service is present in the Trusted Root Certificate Authorities store.

  • If the root CA certificate is not present, click All Actions > Import, select .PEM / .CRT / .CER file of the certificate and click Import.

    All the certificates should be imported in the local machine store and not in the current user store.

    You can verify the current store in the certificate management window.

Problem

Certificate's public key algorithm is not supported.

The public key algorithm is not supported by NetBackup. Currently only the RSA algorithm is supported.

Cause

The certificate with given path exists in windows cert store but its signature algorithm is not supported.

Solution

You need to use the certificate with public key algorithm that is supported by NetBackup.

For more details on enrollment of external certificates in NetBackup, refer to the NetBackup Security and Encryption Guide.

Problem

Private key for the given certificate is not available.

The certificate in specified by the path does not have a corresponding private key imported in Windows certificate store.

Cause

This is typically caused by importing a .crt, .cer, or .pem certificate manually in the Windows certificate store instead of .pfx.

Solution

Ensure that the certificate has its private key imported.

  • Run the certlm.msc command.

    In case certlm.msc does not work, you can access the Windows certificate store by running the mmc.exe command.

    File > Add Remove Snap in

  • Navigate to your certificate.

  • Open your certificate by double-clicking it.

    The certificate with the private key should have a message stating that you have a private key corresponding to this certificate.

  • If certificate is to be manually enrolled, import a .pfx file and not just the .cer or .crt file.

For more details on enrollment of external certificates in NetBackup, refer to the NetBackup Security and Encryption Guide.

Problem

Certificate with the given subject name is not found

Could not find the certificate when a special keyword $hostname is used in ECA_CERT_PATH

Cause

The certificate does not exist in the local machine store for the given ECA_CERT_PATH.

One of the attributes from store name, issuer name, or subject name does not match the one in the local machine store.

Solution
  • Check if the certificate exists in the local machines store. Do the following:

    • Run the certlm.msc command.

      In case certlm.msc does not work, you can access the Windows certificate store by running the mmc.exe command.

      File > Add Remove Snap in.

    • Check if the certificate exist

  • Verify that the following criteria are satisfied:

    • Certificate location is a path or comma separated paths where each path is specified using store name, issuer name and subject name separated by (\) slash.

    • Store name must exactly match the store your certificate is in.

    • Issuer name and subject name should always be part of ECA_CERT_PATH. If nothing is specified for issuer name, it means any issuer can be considered.

    • $hostname is special keyword and can be used in subject name. When finding the certificate $hostname is replaced with actual FQDN of the host.

    • When using $hostname, the certificate must have FQDN as a part of CN.

    • Double quotes to be used in case the backward slash (\) is present in the actual Store name, Issuer name or Subject name.

    • Though the subject name is always part of ECA_CERT_PATH, CN=example CN is not allowed.

      The subject in ECA_CERT_PATH should be any sub-string of actual CN, OU, O, L, S, C and so on.

For more details on enrollment of external certificates in NetBackup, refer to the NetBackup Security and Encryption Guide.