Just upgraded my NetBackup environment from 8.2 to 8.3 and I noticed the following bugs with Exchange policies.
1. When I try to create a new policy I simply can't finish the procedure because of the following error:
Please select a valid snapshot method using 'Snapshot Client Options'.
Now when I hit the corresponding "Options" button on the policy screen, nothing happens and I'm not able to see the usual screen where the VSS method is chosen by default with it's corresponding parameters. Everytime I hit the "Options" button literally nothing happens and the only way to save the policy is by unticking the "Perform snapshot backups" checkbox which at least will let you hit the "OK" button at the bottom.
When I reopen the same policy, the "Perform snapshot backups" checkbox is once again ticked but still there is no way to modify anything within the "Options" section.
2. When I run the newly created policy, I receive the following error message:
This type of backup is not supported on this version of Exchange
the client type is incorrect in the configuration database (72)
By my best knowledge both Windows Server 2019 and Exchange 2019 CU6 are fully supported and my policy is set just as per the expected rules according to the NBU documentation. So all in all right now it is impossible to backup Exchange with the new NBU 8.3 version.
Any suggestions you may have are highly welcome.
For the record I don't have active support contract with Veritas therefore I can't open a support ticket with the vendor.
One more thing...
I tried creating the policy through another NBU Console that was installed on one of my media servers. Unfortunately that didn't help at all. I'll try to create / modify the policy via CLI and see if that would help.
Just another update:
I tried some modifications throuhg CLI via the "bpplinfo" command but nothing really helped. Although I can modify any other parameter of the policy via CLI, it just doesn't want to cooperate with the "snapshot" parameters.
I also tried making the modifications manually through the policy's "info" file under the "VERITAS\NetBackup\db\class\" folder by adding the...
... parameters to it but that also didn't make any difference. In fact the parameters were immediately removed by NBU in the background.
I looked also at some other policy types against the snapshot option and unfortunately the result is all the same.
Apparently this seems to be a huge bug in NBU 8.3 so be carefull with your upgrades for the time being. If anyone from Veritas is monitoring this topic please take a look at this issue ASAP as it may affect a lot of customers. Also if you have any suggestions then please let me know, so that I can put some additional tests in my LAB.
Thanks for reaching out. I have let engineering know about this possilbe issue. If I hear anything I will update this thread.
As I stated in my initial post I don't have an active support contract with Veritas therefore I can't open cases. Of course I would gladly raise a ticket if there is a side option option to do so therefore feel free to let me know the options
The issue was noticed in my own LAB and on multiple NBU master instances.
This post is making the rounds in engineering. the QA lead says they have tested this.
I’ve been running Exchange tests with 8.3 and post-8.3 now and then all along, although I mainly test released versions while working on customer cases. Right now I have a post-8.3 version. I'll install 8.3 release and try it.
My master server is Windows. What's yours?
We have had multiple engineers attempt to recreate the issue but we have been unsuccessful in reproducing as you have described. The engineers believe this may be something unique or specific to your environment. Please contact Support, either (866) 837-4827 or https://www.veritas.com/support/en_US , so they can assist in troubshooting and finding a solution.
Unfortunately I don't have active support contract with Veritas so the support case won't budge at all. I've raised one just in case via the support portal but it will likely be rejected due to lack of entitlement validation.
Anyway thanks for looking into this. I will keep testing on my own and will post results in case I get further outcome.
I just did a completely separated VM instance freshly installed with NBU 8.3. The Snapshot button still doesn't work so I'll keep investigating on the VM instance if there might be any component that is interfering with it.
At least now we know that this behavior is not related to the NBU upgrade itself from 8.2 to 8.3.
So I continued the troubleshooting process by testing out multiple scenarios and I think I managed to crack the case a bit. The problem with the snapshot button not working in policies occurs when NBU is set to run under a domain service account. When NBU is set to run under "Local System" account the snapshot button works properly although I haven't yet tested if Exchange would be backed up this way.
So I was wondering if anything may have changed around the required permissions for service accounts with NBU 8.3. Prior the upgrade my service account was set with the following "User Rights Assignments" on the NBU master server:
- Act as part of the operating system
- Back up files and directories
- Create a token object
- Log on as a service
- Manage auditing and security log
- Replace a process level token
- Restore files and directories
Also the service account is a member of the server's Local Administrators group.
Let me know if perhaps I'm missing any additional permissions that might be mandatory.
In the meantime I have tested my workaround of setting all relevant NetBackup services to run under LocalSystem account and now the Exchange based policies are working just fine. I was able to take full backups including granularity over them and there were no failures at all.
Please note that I haven't changed any of the services on the media servers but just the master server. Furthermore I kept the Messaging Broker and Web Management service running under the "nbwebsvc" service account which in my case is also domain based. Also the NetBackup clients are still running under their dedicated service accounts too.
By the way I found out that this workaround solved another issue for me with Active Directory GRT backups about which I posted the details here:
Obviously the situation with changing the service accounts is not ideal so in my opinion this problem should be investigated further by the backend engineers and perhaps release notes should be updated as well.
Let me know your thoughts.
Could you please specify if your colleagues have tried to reproduce the issue by using domain service accounts when deploying NBU ? I can clearly reproduce this problem on brand new instances, but if I use a default installation which utilizes LocalSystem account then the issue wont appear for sure.
Thanks for the clarification.
Well... this is rather strange situation then. Would you mind posting the security settings that the engineers used for their domain account ? I would gladly make the comparisons to see if anything is out of shape. I still have a spare NBU 8.2 instance in my LAB which is working absolutely fine with domain account but for some reason NBU 8.3 simply refuses to cooperate the same way where both servers have been installed identically. They share the very same Local Security Policy settings for the domain account's "Access Rights" section and also they are receiving the very same GPO's centrally from AD. Furthermore I could reproduce this problem on both newly installed and upgraded NBU 8.3 instances.
At this point I assume there must be some sort of a missing security setting required by NBU 8.3 but I simply couldn't find any clues related to this or at least not within the NBU 8.3 documentation & release notes. Is there a tech note on the website outlining the exact mandatory security settings requirement for NBU master server's domain account ?
@asg2ki My apoligies but at this point you will need to work with Vertias Support for any further assistnace as VOX is not an appropriate place for troubleshooting issues. As you noted you above where you stated that you do not have a support contract, I would recommend that you contact Veritas Sales or a Partner to purchase a contract.
No problems, I fully understand the point and of course I agree with it.
On the contrary I'm not likely to buy any contracts on my own since my personal home lab is nothing like a company or production based one and therefore I don't have a corporate budget to spend. Would have been nice though if Veritas provided a separate support program for IT generalists which doesn't make it necessary for them to sell a kidney or two :)
Anyway thanks a lot for your input.