Running DB2 backup/restore jobs from client as non-root user

[Alex_Vasquez]

I have someone that is attempting to run backups/restore using an account called db2Maint. As I understand, this is not a root user account which is how they want it. The db2Maint account should only be able to perform basic Netbackup functions such as backups and restores.

For some reason that account can't seem to perform any functions where it concerns backups and restores. They are doing it from an AIX box and using a script, I believe, to run these jobs.

Here's the script she's running, or the part with the user info, I believe.

#
# Initialize the backup command line.
# Customize the number of sessions and buffer options for your environment.
#
#CMD_LINE="db2 BACKUP DATABASE $MY_DB2 ONLINE $MY_SCHED LOAD $MY_LIB BUFFER 1024"
CMD_LINE="db2 backup database $MY_DB2 LOAD $MY_LIB BUFFER 1024"
#CMD_LINE="db2 BACKUP DATABASE $MY_DB2 user db2inst1 using 00hcrap $MY_SCHED OPEN 4 SESSIONS BUFFER 1024"
#CMD_LINE="db2 BACKUP DATABASE $MY_DB2 user db2inst1 using 00hcrap $MY_SCHED BUFFER 1024"
#
# Change MY_USER to the proper DB2 user for performing backups
#
MY_USER=db2maint
#MY_USER=root
echo "Executing: $CMD_LINE"
su - $MY_USER -c "$CMD_LINE"
RETURN_STATUS=$?
# Return 0 for success, non-zero for errors
exit $RETURN_STATUS


Here is the log that was generated from on of the job attempts:

16:02:36.010 **WARNING** Locale definition file not found. Using defaults
16:02:36.010 <2> logparams: -sb -rdbms db2 -S brveritas -to 900 -c Angeles7_DB2 -s Default-Application-Backup -clnt Angeles7 -FULL -b Angeles7_1127775755 -jobid 707
16:02:36.015 <4> bphdb main: INF - setenv DB2_POLICY=Angeles7_DB2
16:02:36.015 <4> bphdb main: INF - setenv DB2_SCHED=Default-Application-Backup
16:02:36.015 <4> bphdb main: INF - setenv DB2_SERVER=brveritas
16:02:36.015 <4> bphdb main: INF - setenv DB2_CLIENT=Angeles7
16:02:36.015 <4> bphdb main: INF - setenv DB2_FULL=1
16:02:36.015 <4> bphdb main: INF - setenv DB2_INCR=0
16:02:36.015 <4> bphdb main: INF - setenv DB2_CINC=0
16:02:36.015 <4> bphdb main: INF - setenv DB2_USER_INITIATED=0
16:02:36.015 <4> bphdb main: INF - setenv DB2_SCHEDULED=1
16:02:36.015 <4> bphdb sync_server: INF - BACKUP START
16:02:36.153 <4> bphdb sync_server: INF - CONTINUE BACKUP message received.
16:02:36.154 <2> bphdb get_filelist: INF - Read filename:
16:02:36.154 <2> bphdb get_filelist: INF - Read filename:
16:02:36.154 <4> bphdb do_backup: INF - Processing /usr/openv/netbackup/ext/db_ext/db2/scripts/ng_full_online_backup
16:02:36.155 <4> bphdb keepalive_timeout: INF - bphdb still working.
16:02:36.155 <2> bphdb keepalive_timeout: INF - bphdb- Sending a keepalive.
16:02:36.155 <4> bphdb do_backup: INF - Keepalives will be sent every 450 seconds.
16:02:36.155 <4> bphdb do_backup: INF - Waiting for the child status.
16:02:36.165 <4> bphdb do_backup: INF - Child executing /usr/openv/netbackup/ext/db_ext/db2/scripts/ng_full_online_backup
16:02:37.680 <16> bphdb do_backup: ERR - Script exited with status = 4
16:02:37.692 <16> bphdb Exit: ERR - bphdb exit status = 6: the backup failed to back up the requested files
16:02:37.693 <4> bphdb Exit: INF - EXIT STATUS 6: the backup failed to back up the requested files
16:02:40.314 **WARNING** Locale definition file not found. Using defaults
16:02:40.314 <2> logparams: -sb -rdbms db2 -S brveritas -to 900 -c Angeles7_DB2 -s Default-Application-Backup -clnt Angeles7 -FULL -b Angeles7_1127775759 -jobid 707
16:02:40.315 <4> bphdb main: INF - setenv DB2_POLICY=Angeles7_DB2
16:02:40.315 <4> bphdb main: INF - setenv DB2_SCHED=Default-Application-Backup
16:02:40.315 <4> bphdb main: INF - setenv DB2_SERVER=brveritas
16:02:40.315 <4> bphdb main: INF - setenv DB2_CLIENT=Angeles7
16:02:40.315 <4> bphdb main: INF - setenv DB2_FULL=1
16:02:40.315 <4> bphdb main: INF - setenv DB2_INCR=0
16:02:40.315 <4> bphdb main: INF - setenv DB2_CINC=0
16:02:40.315 <4> bphdb main: INF - setenv DB2_USER_INITIATED=0
16:02:40.315 <4> bphdb main: INF - setenv DB2_SCHEDULED=1
16:02:40.315 <4> bphdb sync_server: INF - BACKUP START
16:02:40.528 <4> bphdb sync_server: INF - CONTINUE BACKUP message received.
16:02:40.528 <2> bphdb get_filelist: INF - Read filename:
16:02:40.529 <2> bphdb get_filelist: INF - Read filename:
16:02:40.529 <4> bphdb do_backup: INF - Processing /usr/openv/netbackup/ext/db_ext/db2/scripts/ng_full_online_backup
16:02:40.529 <4> bphdb keepalive_timeout: INF - bphdb still working.
16:02:40.529 <2> bphdb keepalive_timeout: INF - bphdb- Sending a keepalive.
16:02:40.529 <4> bphdb do_backup: INF - Keepalives will be sent every 450 seconds.
16:02:40.529 <4> bphdb do_backup: INF - Waiting for the child status.
16:02:40.529 <4> bphdb do_backup: INF - Child executing /usr/openv/netbackup/ext/db_ext/db2/scripts/ng_full_online_backup
16:02:41.966 <16> bphdb do_backup: ERR - Script exited with status = 4
16:02:41.966 <16> bphdb Exit: ERR - bphdb exit status = 6: the backup failed to back up the requested files
16:02:41.966 <4> bphdb Exit: INF - EXIT STATUS 6: the backup failed to back up the requested files


it would seem to me, from this log, that there is a file or something missing, rather than a permissions issue. But I'm just not sure why the root user account works and not the non root account. Any pointers would be well received. Thanks.

[MayurS]

Hi Alex,

I have never worked on DB2 backups;
But from the below output in the log it seems that there is permission issue.
16:02:41.966 <16> bphdb do_backup: ERR - Script exited with status = 4

[Alex_Vasquez]

I'm still not so sure about that. It appears, according to the log file, that there is a file missing or something to that effect.

"16:02:36.010 **WARNING** Locale definition file not found. Using defaults


It appears to be looking for a .conf file that isn't there. Below is the script file that DBA is using for this.

#!/bin/sh

#bcpyrght
#***************************************************************************
#* $VRTScprght: Copyright 1993 - 2003 VERITAS Software Corporation, All Rights Reserved $ *
#***************************************************************************
#ecpyrght

#
# These environment variables are initialized by Netbackup (bphdb)
#

echo "DB2_CLIENT = $DB2_CLIENT"
echo "DB2_SERVER = $DB2_SERVER"
echo "DB2_POLICY = $DB2_POLICY"
echo "DB2_SCHED = $DB2_SCHED"
echo "DB2_FULL = $DB2_FULL"# Is 1 if Full backup scheduled
echo "DB2_CINC = $DB2_CINC"# Is 1 if Cumulative incremental scheduled
echo "DB2_INCR = $DB2_INCR"# Is 1 if Differential incremental scheduled

#
# Change MY_LIB to the correct NetBackup library name for your host:
#Solaris or Linux 32-bit = nbdb2.so
#Solaris 64-bit = nbdb2.so64
#AIX or HPUX 32-bit = nbdb2.sl
#AIX or HPUX 64-bit = nbdb2.sl64
#

MY_LIB=/usr/openv/netbackup/bin/nbdb2.sl

#
# Change MY_DB2 to the correct DB2 instance name for your database.
#

#MY_DB2=MCYDB_ST
MY_DB2=TEST
#
# Use the NetBackup schedule type to set DB2 full or incremental options.
#

if ; then
MY_SCHED=""
elif ; then
MY_SCHED="INCREMENTAL"
elif ; then
MY_SCHED="INCREMENTAL DELTA"
else
MY_SCHED=""
fi

#
# Initialize the backup command line.
# Customize the number of sessions and buffer options for your environment.
#

#CMD_LINE="db2 BACKUP DATABASE $MY_DB2 ONLINE $MY_SCHED LOAD $MY_LIB BUFFER 1024"
CMD_LINE="db2 backup database $MY_DB2 LOAD $MY_LIB BUFFER 1024"
#CMD_LINE="db2 BACKUP DATABASE $MY_DB2 user db2inst1 using 00hcrap $MY_SCHED OPEN 4 SESSIONS BUFFER 1024"
#CMD_LINE="db2 BACKUP DATABASE $MY_DB2 user db2inst1 using 00hcrap $MY_SCHED BUFFER 1024"


#
# Change MY_USER to the proper DB2 user for performing backups
#

MY_USER=db2maint
#MY_USER=root
echo "Executing: $CMD_LINE"
su - $MY_USER -c "$CMD_LINE"

RETURN_STATUS=$?

# Return 0 for success, non-zero for errors

exit $RETURN_STATUS

[Mark_Kimball]

I wouldn't worry about that .conf file. It is the locale configuration file for date and time formats for each supported locale, according to the Systems Administrator's Guide for 5.1. Plus the message is simply a warning, not a failure.

I would worry about rights, though. Mayur is clear as to why. More than likely the db2Maint user doesn't have rights to remove the file you're archiving. Maybe you intended to have that archive be a backup? Even so, restores with a user that doesn't have full rights might be a little tricky.

Mark

[Brice_Avila_2]

I understand that DB2 restores from a user that is not in the DB2 instance group won't be allowed until NBU 5.1 MP4 / 5.0 MP6. HTH.

Brice Avila

[Alex_Vasquez]

Apparently the fix to this issue was that the account that needed to do these restores/bakcups needed to be part of the instanced group and also have rights for backups/restores in the DB2 admin group as well, if that makes sense. The DBA had to add these rights.