GRT Backup / Restore of Active Directory: Error unable to obtain image list

[Bofrost]

we just shut down one of our old DCs to which the GRT Backup of our AD was configured.

Now i created a new Policy for our new DC, to backup the AD with the option to granular restore items.
The storage location is the local disk of the media-server.

The backup finishes with the status code "1". When i try to browse in the Active Directory container with BAR (run as administrator) i got the Error message "Database System Error".

bpbrm log:

13:07:36.646 [200.9640] <4> db_error_add_to_file: from client DCnew: TRV - Starting granular backup processing for (System State\Active Directory). This may take a while...
13:07:36.849 [200.9640] <16> bpbrm main: from client DCnew: ERR - Unable to obtain image list. Confirm this client has access to images on server 'NBU' for client 'DCnew'
13:07:36.849 [200.9640] <2> set_job_details: Tfile (457485): LOG 1488370056 16 bpbrm 200 from client DCnew: ERR - Unable to obtain image list. Confirm this client has access to images on server 'NBU' for client 'DCnew'

13:07:36.849 [200.9640] <2> send_job_file: job ID 457485, ftype = 3 msg len = 171, msg = LOG 1488370056 16 bpbrm 200 from client DCnew: ERR - Unable to obtain image list. Confirm this client has access to images on server 'NBU' for client 'DCnew'

13:07:36.849 [200.9640] <4> db_error_add_to_file: from client DCnew: ERR - Unable to obtain image list. Confirm this client has access to images on server 'NBU' for client 'DCnew'
13:07:36.849 [200.9640] <16> bpbrm main: from client DCnew: ERR - Refer to the 'Configuring the hosts for backups that use Granular Recovery Technology (GRT) in virtual environments' section of the Exchange Administrator's Guide for more information
13:07:36.849 [200.9640] <2> set_job_details: Tfile (457485): LOG 1488370056 16 bpbrm 200 from client DCnew: ERR - Refer to the 'Configuring the hosts for backups that use Granular Recovery Technology (GRT) in virtual environments' section of the Exchange Administrator's Guide for more information

13:07:36.849 [200.9640] <2> send_job_file: job ID 457485, ftype = 3 msg len = 238, msg = LOG 1488370056 16 bpbrm 200 from client DCnew: ERR - Refer to the 'Configuring the hosts for backups that use Granular Recovery Technology (GRT) in virtual environments' section of the Exchange Administrator's Guide for more information

13:07:36.849 [200.9640] <4> db_error_add_to_file: from client DCnew: ERR - Refer to the 'Configuring the hosts for backups that use Granular Recovery Technology (GRT) in virtual environments' section of the Exchange Administrator's Guide for more information
13:07:36.849 [200.9640] <4> bpbrm main: from client DCnew: TRV - Granular processing failed!
13:07:36.849 [200.9640] <2> set_job_details: Tfile (457485): LOG 1488370056 4 bpbrm 200 from client DCnew: TRV - Granular processing failed!

These things i already checked:

- the services on the client are running with dom-admin rights
- the hostname of the Media- and Master-Server can be resolved by the Client
- The NFS Client service is running, the NFS Server is stopped and disabled (on the client)
- In the Policy i checked the option "enable granular restore"
- The servernames are all case sensitive
- in the nbfsd log i can see that the Share is mounted succesfully
- there is no firewall active

I hope someone has an idea, what to check next?

[pats_729]

Hi,

If you are sure that name resolution isnt a problem then Create a "No.Restrictions" touch file in the following directory on Master Server.

For Windows master server:
<install dir>\Veritas\NetBackup\db\altnames\No.Restrictions

For UNIX/Linux master server:
/usr/openv/netbackup/db/altnames/No.Restrictions

[Bofrost]

The "No.Restrictions" File already exist. As with the old DC everything worked fine...
Sorry i forgot to tell.

[pats_729]

See if you can run command from Client

bplist -B -C <clientname> -t 13 -l -R /

See if you can list images first.

[Lowell_Palecek]

... and then look in the bprd log for the BPLIST request. Look for this on your failed browse, too. Bprd enforces the image access restrictions, whether the bplist or bprestore comes from CLI or an internal NetBackup call. If you have the logging turned up, the bprd log should tell you who it thinks the requester is (look for "peer") and why it is denied access.

[Lowell_Palecek]

Also, we'd rather you use the Distributed Application Mapping on the master server configuration rather than No.Restrictions. In the mapping, you tell specifically which client is allowed access to the backup client's images.

[Lowell_Palecek]

Apologies for the property name and documentation. It's called the Distributed Application Restore Mapping, but it applies to browse as well. The NetBackup Administration Guide Volume 1 says it's for SharePoint farms and Exchange DAGs, but it applies to any policy type.

I confirmed this by doing an MS-Windows backup of the E:\ drive on one system and browsing the image on another.

The left column of the mapping is the client in your backup policy. The right column is the "browse client" to which you are granting browse access and the ability to initiate a restore. The format of the client names (short vs. FQDN, uppercase vs. lower) doesn't matter so long as DNS lookup on the names in the mapping matches lookup for the policy client and browse client.