Forum Discussion

HoldTheLine's avatar
HoldTheLine
Level 4
10 years ago

7.72 Upgrade: You must deploy NetBackup Machine certificate on this host.

We are stuck going from 7.6.0.2 to 7.7.2 at the console, unable to login.  We have a case open and are waiting for callback but thought I would throw it out here too.  Some searching turned up the 7.7.2 admin doc with instructions on how to activate the cert using bpnbaz -ProvisionCert  but we get errors:

bpnbaz -ProvisionCert  <Master Hostname>
You will have to restart NBSL service on the target host if it is a Media Server
Do you want to continue(y/n)y
Setting up security on target host: jtclpswnbum01 - Failed to provision certificate
The file: DeploySecurityCerts.progress has been updated in the current directory with results of this operation
Provisioning Security Certificate failed on some hosts, to deploy it manually, use 'bpnbaz -ProvisionCert <targetHost>'
command.
Unable to configure target host.

 


Also tried this:

 

bpnbaz.exe -SetupMaster
You will have to restart NetBackup services on this machine after the command completes successfully.
Do you want to continue(y/n)y
Gathering configuration information.
ERROR: Failed to start security services - nbazd
Unable to start the Netbackup Security service. Check other messages to see if it's Netbackup Authentication or Authoriz
ation service

 


I tried the hostname everyway I can think of, short name, long name, caps, no caps etc same result.  There is some logging in the log directory

bpjava-msvc:

11:38:49.385 [22304.9892] <16> session_dispatch: Request count = 0 tag = 510
11:38:49.385 [22304.9892] <2> populateCertificatePath: auth.c.1718: vnet_get_machine_credential_path( ) failed
11:38:49.385 [22304.9892] <4> populateCertificatePath: bpjava-msvc unable to find Machine Certificate.
11:38:49.385 [22304.9892] <4> command_SECURE_CHANNEL_INIT: Could __not__ find certificate that could be used for SSL handshake. You must deploy NetBackup Machine certificate on this host.
11:38:49.385 [22304.9892] <16> poll_listen: can't find file descriptor 0000000000000220 in polling table


I am baffled, any ideas?

 

 

Backup and Recovery
NetBackup

9 Replies

  • mnolan's avatar
    mnolan
    Level 6
    10 years ago

    One of the times I've dealt with this, looking further in the bpjava-msvc log we found that customer was pointing to an IP on the master for a mgmt interface that did not have a name.

    That name did not resolve and did not have a cert so we did the ProvisionCert against that IP address.  It could also be done to the name it resolves to.

    To see if that is the case, could you attach the full relelvant bpjava-msvc log?

  • HoldTheLine's avatar
    HoldTheLine
    Level 4
    10 years ago

    We got past the authentication issue by going through a huge list of instructions sent by the tech.  So we are able to login but now have a new issue:

     

    - any images that were backed up before the upgrade are failing to duplicate, they all have this error:

     

    Error bpduplicate (pid=3964) Could not lock backupid

    If thats not enough fun for a totally miserable upgrade we are unable to restore ANY images that were created before going to 7.7.2.

    Considering rolling back, never seen anything like this.

  • Will_Restore's avatar
    Will_Restore
    Level 6
    10 years ago

    any images that were backed up before the upgrade are failing to duplicate, they all have this error:

    Error bpduplicate (pid=3964) Could not lock backupid

    If thats not enough fun for a totally miserable upgrade we are unable to restore ANY images that were created before going to 7.7.2.

     

    Sounds like a major problem. Open a support case & escalate right away. And please let us know the outcome here. 

  • Nicolai's avatar
    Nicolai
    Moderator
    10 years ago

    Sound like a issue we had during upgrade from 7.1 to 7.6

    Please check if this tech note apply - both cover the same topic but with different subject :

    If the IDIRSTRUCT file is deleted or modified, data loss condition may occur, active tapes may be de-assigned.

    http://www.veritas.com/docs/000090290

    No images show up for a restore when there are valid images in the NetBackup catalog on the master, but it does display directories and files.

    http://www.veritas.com/docs/000041498

    And if the tech notes apply, you really need to raise the severity level of the support case.

  • Mark_Solutions's avatar
    Mark_Solutions
    Level 6
    10 years ago

    Out of interest can you tell us the O/S etc of this Master Server

    I have done three 7.7.2 Master Server upgrades recently and have no experienced anything like this.

    I would say though that i would never upgrade something if any duplications were outstanding ... I have always felt that too much changes between versions to do that.

    Make sure also that your master has LOTS or RAM and CPU ... 7.7.2 uses lots more of these than previosu versions as well as network resources and the "could not lock backupid" can relate to a lack of resources between the media sevrers and master server.

    Other things of note i have noticed is that you have to run the upgrade as a true administrator .. not one that is just part of a group that is in the administrators group

    And you need a 7.7.2 media server straight away too do the catalog backup as any other version media server will not back it up properly.

    My last upgrade on Windows from 7.6.0.4 to 7.7.2 pretty much killed the Master .. fortunately it was a VM so we could double the number of CPUs, RAM and paging file to get it working again.

    Just some thoughts...

  • HoldTheLine's avatar
    HoldTheLine
    Level 4
    10 years ago

    Hey everyone, thanks for the ideas.  We have a solution!

     

    The OS is Windows 2008, and a while back we added disk space on a differnet drive letter and moved the images directory to that drive, then linked it via the command mklink.  There have not been any issues with this, and there have been a few upgrades since then (to 7.5, then 7.6, etc)

    For whatever reason, going from 7.6.0.2 to 7.7.2 the link was not - recognized?  Not sure if that is the correct term, but we had some pretty sharp Veritas techs. step in and after some poking around noticed that the images directory on the root drive was a different size than the imges directory on the expansion - and sure enough the only files that were on the root drive had time stamps after the upgrade.  So the catalog was aware of prior backups but not able to access them since the required files were not on the root drive.  The fix was to copy the files from the root to the expansion drive, remove \veritas\netbackup\db\images and link it again to the expansion drive.  Bingo!  EVerything started working after that.

     

    So while we have a solution it's still not clear exactly why this link was broken in the first place.  Will be discussing it with our BCS as soon as we can, who knows maybe we discoverd some new, rare potential issue :)

     

     

  • Marianne's avatar
    Marianne
    Level 6
    10 years ago
    Unfortunately we now have two separate issues in one post which makes selecting a solution difficult. We are actually missing the real solution for the original issue in the opening post. You mentioned the following : " We got past the authentication issue by going through a huge list of instructions sent by the tech." If the list is too long to paste in a reply, please be so kind and post the list of instructions as .txt attachment. The idea is to help others with similar issues. About the issue of image link that was not recognised / broken during the upgrade - please ask your Support engineer to test this in their labs and issue a TN and/or escalate to Engineering if the problem can be replicated. Thanks for sharing your experience!
  • HoldTheLine's avatar
    HoldTheLine
    Level 4
    10 years ago

    Sorry about that, is there a way to split out the seperate issues?  I would be glad to share the solutions for each.  As far as the instructions sent that resolved the authentication issue, I am attaching them to this reply.

     

  • Marianne's avatar
    Marianne
    Level 6
    10 years ago

    The new issue should have been split out to a new discussion in your post of 17 March.

    You can Request split solution to mark multiple posts.