Reference: NetBackup 7.0 Security and Encryption Guide

1. Install and configure Symantec Product Authentication Service (Complete Root + Authentication Broker installation) on the master server.
2. Install and configure Symantec Product Authorization Service on the master server.
3. Configure NetBackup master server for Access Control (Create Groups, give permissions, add users etc…)

Note: We will configure Access Control using Active Directory.

• Product Authentication Installation

1. Start installation as Administrator by launching installer from the following path: NetBackup_Installation_Media_Path\Addons\x86\ICS\Authentication\VxSSVRTSatSetup.exe
2. If this is an upgrade, you will be asked to upgrade this package. Select Yes and continue your installation.
3. On the “Setup Type” screen, select “Complete” and click Next
4. Select Root + Authentication Broker as broker mode
5. Choose the service to be started automatically (You can choose to start manually, it depends on your configuration. it was the option that i selected) and click Next
6. Enter your desired password for Root\Authentication Password when appears (Choose a password with at least 8 digits) and click Next
7. After the installation is completed, click Finish

• Product Authorization Installation

1. Start installation as Administrator by launching installer from the following path:  NetBackup_Installation_Media_Path\Addons\x86\ICS\Authorization\VRTSazSetup.exe
2. If this is an upgrade, you will be asked to upgrade this package. Select Yes and continue your installation.
3. On the “Setup Type” screen, select “Custom” and click Next
4. On “Select Features” screen click Next
5. When the “Question” screen is displayed, select No to install the service in Read-Write mode.
6. After the installation is completed, click Finish

• If you want to check your installation so far,

Open a command prompt and go inside the following path:

%ProgramFiles(x86)%\VERITAS\Security\Authentication\bin  (on a x64 Server)

and issue the command:

vssat showbrokermode

You should be able to see an output similar to this:

showbrokermode
———————-
———————-
Broker mode is : 3
———————-

• Access Control Configuration

Run the following command (Command Prompt):

bpnbaz -setupmaster

Enter y when asked to continue,

When asked, enter your user password which you logged on your windows server with. (Administrator password in our setup). After this point the system begings to gather configuration information.

After the command is completed restart all NetBackup services on your netbackup master server. (bpdown/bpup)

After this point, you can configure your groups and users inside “NetBackup Administration Console -> Master Server -> Access Management. (Example Screenshot to be added soon).

Reference: http://seer.entsupport.symantec.com/docs/265914.htm

16.11.2009 17:13:47 – expected media FSD300; found media D300L4
16.11.2009 17:13:47 – end Label; elapsed time: 00:03:43
media manager found wrong tape in drive(93)

From GUI, after clicking right-clicking on your tape, ensure that “Verify media label before performing operation” checkbox is cleared.

Then retry your labeling operaiton.

incorrect media found in drive index 0, expected FSD300, found D300L4, FREEZING FSD300

Reference : http://seer.entsupport.symantec.com/docs/276993.htm

Try to re-label your tapes, using the GUI or the bplabel command.

2. Enable and start xinetd on SSIM server (xinetd is not started automatically)

chkconfig xinetd on

service xinetd start

3. Enable Automated Backup on SSIM server
- Open Information Manager Web configuration page and click on Database Utilities.
- Select Options on Database Utilities page
- Click on Enabled in Options.
- If you want to set a time of day for daily backups, select a time from the Maintenance time drop-down list inside General Maintenance section.
- Click Apply to apply your changes.

4. Create a new policy on NetBackup server:
- Select Standard as the policy type
- Select Linux Redhat 2.6 for Client’s operating system
- Select /dblog as the backup selection

You can add other directories or you can select ALL_LOCAL_DRIVES if you want.

5. Try a Manual Backup and check if it works.

ORA-27054: NFS file system where the file is created or resides is not mounted with correct options
Additional information: 2

the cause is possibly your are trying to restore your database to an NFS mount point which is not mounted correctly.

The following is for Solaris 10:

Change your /etc/vfstab entry

From:

Nfs_Host:/nfs/oracle – /oradata   nfs   –   yes   -

To:

Nfs_Host:/nfs/oracle – /oradata   nfs   –   yes   hard, bg,proto=tcp, vers=3, suid, rsize=32768, wsize=32768, intr,noac

Then, unmount and re-mount your volumes through /etc/vfstab

“Missing Path” or “Unused element address”

There can be many reasons causing this error, but you can try the folllowing:

Update your drivers from the following url, then delete and re-configure tape drives on Netbackup.

http://seer.entsupport.symantec.com/docs/287850.htm

Alternate path:
Windows: C:\deneme_yeni
Unix: /deneme_yeni

NetBackup master server name: netbackup

1. Regardless of the operating system, you must create a rename file. This file will be for which is changed to what…
Create the rename file, eg rename_file.txt
If you are restoring on windows, Your file should look like this,
change /C/deneme to /C/deneme_yeni

If you are restoring on unix, your file should look like this,
change /deneme to /deneme_yeni

Don’t forget, this file MUST end with a blank line.
On windows, drive letters MUST always be uppercase

2. Start your restore using bprestore command like the following:

Windows,
bprestore -R /C/rename_file.txt -C netbackup  /C/deneme

Unix,
bprestore -R /rename_file.txt -C netbackup /deneme

The above command will restore from your last backup. To restore from a spesific time, try to use -s and -e switches.

bprestore -R /C/change_file.txt -C netbackup -s 07/14/2009 00:00:00 -e 07/14/2009 02:00:00 /C/deneme

If you want to log your progress, use -L switch.

bprestore -L /C/deneme1.log -R /C/change_file.txt -C netbackup -s 07/14/2009 00:00:00 -e 07/14/2009 02:00:00 /C/deneme

http://seer.entsupport.symantec.com/docs/276755.htm

It fails with an error like : “dependant services fail to start”

Try to reinstall Service Pack 2 on to your client, and after the reboot the service should come up without problems.

ORA-28001: the password has expired

As stated, your rman user’s password has expired. You should either change the password, and of course change password in every RMAN script as well.

Or you can do something like this:

1. Create a new profile which has no password expiry

2. Alter your rman user to the new profile

sqlplus /as sysdba

CREATE PROFILE rman_PROFILE

LIMIT

PASSWORD_LIFE_TIME UNLIMITED;

alter user rman PROFILE rman_PROFILE;

Now, you can retry your backup.

Reference : http://www.orafaq.com/forum/t/82806/0/

server name not found in the NetBackup configuration

1. You were trying to expire a media from emm database:

bpexpdate -m media_id -d 0

Solution: Try to add -host media_server_hostname to end of the command

bpexpdate -m media_id -d 0 -host media_server

Please add your knowledge about this error…

Thanks.

05/31/2009 11:24:48 – Warning bpbrm (pid=14316) from client exchangeServer: WRN – Exchange database recovery may have failed. Please check the event log for further details.
05/31/2009 11:27:02 – end reading; read time: 0:03:36
05/31/2009 11:27:03 – Warning bpbrm (pid=14316) from client exchangeServer: WRN – Exchange database recovery may have failed. Please check the event log for further details.
05/31/2009 11:27:04 – Error bpbrm (pid=14316) client restore EXIT STATUS 185: tar did not find all the files to be restored
05/31/2009 11:27:04 – restored from image exchange2_1243565471; restore time: 0:04:24
05/31/2009 11:27:15 – end Restore; elapsed time 0:21:45
the requested operation was partially successful (1)

After backing up your files, and while dismounted, remove every file from the database and log directories and re-try your backup again.

For example: You have a database named First Storage Group. Database files reside in d:\db\First Storage Group and Db log files reside in d:\logs\First Storage Group

After backing up them, go into these directories and delete everything in, then re-try your restore.

Not the most efficient way, but works. Any other solutions are always welcome :)

Encryption in Policy - Attributes window

2. Make sure that: Under NetBackup Management -> Host Properties -> Clients -> Client Properties -> Encryption window, “Encryption Permissions” is either “Allowed” or “Required“; “Enable Encryption” is selected.
You can change Encryption types according to your needs, Standard Encryption -> AES-128-CFB is the default.

Encryption configuration in Client Properties Window

3. On the client, create a keyfile with the following command (in this example netbackup is installed in C:\Program Files\Veritas\Netbackup directory), dc01 is the hostname of the client. You will be asked for a passphrase. Do not lose this passphrase or you may not be able to recover your files.

C:\Program Files\Veritas\Netbackup\bin\bpkeyutil -clients client_hostname

Creating a keyfile for encryption

You will see that keyfile.dat will be created inside C:\Program Files\Veritas\Netbackup\var directory.

keyfile.dat created by bpkeyutil

4. Start a manual backup and see if it works.

5. You can also test that, after deletion of the C:\Program Files\Veritas\Netbackup\var\keyfile.dat you can not backup nor restore your files. After re-creation of this file, you can backup and/or restore.

Restore without keyfile.dat

23:19:16 30.05.2009: Restore Started

23:19:23 (61.001) Restoring from image created 30.05.2009 23:13:32

23:19:32 (61.001) INF – TAR STARTED

23:19:33 (61.001) INF – Beginning restore from server w2003srv to client dc01.

23:19:39 (61.001) FTL – tar received an invalid archive

23:19:39 (61.001) INF – TAR EXITING WITH STATUS = 13

23:19:39 (61.001) INF – TAR RESTORED 0 OF 1 FILES SUCCESSFULLY

23:19:39 (61.001) INF – TAR KEPT 0 EXISTING FILES

23:19:39 (61.001) INF – TAR PARTIALLY RESTORED 0 FILES

23:19:39 (61.001) Status of restore from image created 30.05.2009 23:13:32 = file read failed

23:19:45 (61.xxx) INF – Status = the restore failed to recover the requested files.

Backup without keyfile.dat

30.05.2009 23:16:17 – started

30.05.2009 23:16:18 – estimated 192 kbytes needed

30.05.2009 23:16:18 – started process bpbrm (1364)

30.05.2009 23:16:26 – connecting

30.05.2009 23:16:27 – connected; connect time: 00:00:01

30.05.2009 23:16:31 – begin writing

30.05.2009 23:17:30 – Critical bpbrm(pid=1364) from client dc01: FTL – tar had an unexpected error

30.05.2009 23:17:34 – end writing; write time: 00:01:03

tar had an unexpected error(184)

There can be many reasons for having this error. One i faced was, when the system has McAfee Enterprise Virusscan installed and configured. The “access protection” can block your update and you can have this problem.

As suggested, Disable “access protection” while the update, and it should update successfuly.

Note : This is actually an incomplete troubleshooting tip. Please share your knowledge about this problem.

Thanks.

Prerequisites:

1. NetBackup version must be 6.5.4 or higher on both NetBackup media server and client.

2. The following services must be installed on NetBackup media server:

Microsoft Services on NFS : Client for NFS
Microsoft Services on NFS : Microsoft Services for NFS administration
Microsoft Services on NFS : RPC External data representation
Microsoft Services on NFS : RPC Port Mapper
Microsoft Services on NFS : Server for NFS

To install, open “Start -> Settings -> Control Panel -> Add or Remove Programs -> Add/Remove Windows Components”, choose “Other Network File and Print Services -> Details” , choose “Microsoft Services for NFS -> Details” and choose the required packages that are listed above.

Microsoft Services Installation on Media Server

3. The following services must be installed on client.

Microsoft Services on NFS : Client for NFS
Microsoft Services on NFS : Microsoft Services for NFS administration
Microsoft Services on NFS : RPC External data representation
Microsoft Services on NFS : RPC Port Mapper

Microsoft Service for NFS Installation on DC

4. “Server for NFS” on NetBackup media server must be disabled and portmap service must be enabled and started.

Server for NFS on Media Server

Type the following command from the command line to start and enable portmap service

sc config portmap start= auto
[SC] ChangeServiceConfig SUCCESS

5. “NetBackup Client” on the client must not be started with “Local System” but must be started with a Domain Administrator Account (Administrator in this example).

NetBackup Client on DC

Policy Creation:

Use policy wizard and create your backup policy as a normal “Windows-NT” but on the “Backup Selection” window, make sure “Windows 2003/Active Directory Application Mode:\” and “Windows 2003/Shadow Copy Components” are added.

Active Directory Application Mode

Shadow Copy Components

That’s all, try a backup and after the backup, if you try to restore from the client, you should be able to see your Active Directory objects like that:

Active Directory Restore

First possible reason is: If you have upgraded windows 2003 from R1 SP2 to R2, this can be the reason. Try to reinstall Service Pack 2 for R2. This should possibly solve your problem.

One of the reasons is you made a mistake writing in the script, and its giving and error and the scripts returns an error code other than zero.

In that case you will see log entries similar to this:

00:06:16.311 [15443] <4> bpbkar: INF – bpbkar exit normal
00:06:16.327 [15443] <4> bpbkar: INF – EXIT STATUS 0: the requested operation was successfully completed
00:06:16.328 [15443] <4> bpbkar: INF – setenv FINISHED=1
00:06:16.372 [15443] <4> bpbkar: INF – START bpend_notify
00:06:16.372 [15443] <4> bpbkar: /usr/openv/netbackup/bin/bpend_notify.Oracle_test oracle Oracle_test Full FULL 0
00:06:17.325 [15443] <4> bpbkar: INF – END bpend_notify
00:06:17.326 [15443] <16> bpbkar: ERR – bpend_notify returned 2
00:08:27.195 [16268] <4> bpbkar main: real locales <LC_CTYPE=en_US;LC_NUMERIC=en_US;LC_TIME=en_US;LC_COLLATE=en_US;LC_MONETARY=C;LC_MESSAGES=en_US;LC_PAPER=C;LC_NAME=C;LC_ADDRESS=C;LC_TELEPHONE=C;LC_MEASUREMENT=C;LC_IDENTIFICATION=C>

Inventory Robot

2. On the Robot Inventory window, select “Update Volume configuration” and “Empy media access port prior to update”

Robot Inventory

3. Click “Advanced Options” if you need to change any configuration for new added volumes. We suggest you to choose your SCRATCH pool for newly added volumes, so they are moved by netbackup to any volume pool, whenever needed.

Volume Pool for Inventory

4. Click on “Start” when you are ready for robot inventory. Make sure, you have choosed the correct “Device Host” if you have different media manager hosts.

Start Robot Inventory

NEW_STREAM directive is used to manually start another stream of backup withing a backup selection. You add “NEW_STREAM” directive first, then you add your selection after this directive.

When a backup starts with this policy, it will create a new backup stream for every NEW_STREAM line, and backup the selection in parallel.

Reference : http://seer.entsupport.symantec.com/docs/267291.htm