Solved: good find

thesunlover · ‎11-07-2011

Hi, After installed and enabled encryption, I got this status code 46. I've tried both regular encryption and legacy encryption. Here is some info:

-------------------------------------------------------------------------

nbserver# bpinst -LEGACY_CRYPT -verbose nbclient
BPCD protocol version 6.5.0 on client nbclient
40-bit library version is 3.1.0.40 on client nbclient
56-bit library version is 3.1.0.56 on client nbclient
BPCD platform is linuxS_x86_2.6 for client nbclient
Current configuration entries are:
CRYPT_KEYFILE = /usr/openv/var/keyfile
CRYPT_LIBPATH = /usr/openv/lib
CRYPT_OPTION = required
CRYPT_STRENGTH = des_56
V_PATH_SHARE = /usr/openv/share
No update of NetBackup configuration required for client nbclient
No update of NetBackup pass phrase required for client nbclient

nbserver# bpkeyutil -display -client nbclient
Key File version: 2
Key count: 2
1. Key creation time: Fri Nov 4 13:34:36 2011
Digest of key: 1B 2F 0F 67 ...
2. Key creation time: Fri Nov 4 13:50:50 2011
Digest of key: 80 18 E5 47 ...

nbserver# bppllist dhcp_nbclient -U | grep -i encrypt
Client Encrypt: yes

nbclient# cat /usr/openv/netbackup/bp.conf
SERVER = nbserver
CLIENT_NAME = nbclient
# V_PATH_SHARE = /usr/openv/share
# CRYPT_KEYFILE = /usr/openv/netbackup/keyfile.dat
CRYPT_KEYFILE = /usr/openv/var/keyfile.dat
CRYPT_LIBPATH = /usr/openv/lib
CRYPT_OPTION = required
CRYPT_STRENGTH = des_56
# V_PATH_SHARE = /usr/openv/share
CRYPT_KIND = NONE

nbclient# file /usr/openv/var/keyfile.dat
/usr/openv/var/keyfile.dat: data

-------------------------------------------------------------------------

If I change CRYPT_OPTION=required to CRYPT_OPTION=denied, 46 issue is gone. I've verifed that we have valid license key for encryption.

Please help and thank you in advance!

CRZ · ‎11-15-2011

NetBackup is functioning as intended, but it's just a piece of software - it can't always determine whether the admin is ALSO functioning as intended.

The bottom line is BMR and Encryption don't get along, but we're not going to deny you an installation of Encryption because all your policies may currently be collecting BMR info.

You can ALWAYS *install* Encryption and NetBackup isn't going to complain because NetBackup doesn't know your intent. Maybe all your policies collect BMR information right now, but you have plans to change some of those policies later. Or maybe you want to create entirely new policies for your newly installed Encryption Option.

Your issue here REALLY was setting CRYPT_OPTION = REQUIRED in your bp.conf file. It would have been better set to ALLOWED if you wanted to run BOTH policies with Encryption and policies with BMR.

I now suspect your other thread asking how to enable Encryption from the command line was an attempt to get around a greyed out option from BMR being checked. Was that the case? Setting BOTH BMR and Encryption - if it's even possible, and I hope it's not, but don't know for sure - would lead to disaster...or at the very least, lead to no valid backups.

If you had opened a support case, probably the first thing your TSE would have done is asked for a look at your policy, either with bppllist output, collecting nbsu output, or hopping on a WebEx with you and asking you to show them the policy in the GUI. In all of these cases, I'm certain we would have been able to resolve your case pretty quickly once we had a look at the policy - specifically, the Encryption and BMR collection settings. You have been here a lot over the past couple weeks, though, and always with questions about Encryption, so I am starting to suspect you may not have a Support contract. I would strongly encourage looking into acquiring one.

View solution in original post

Marianne · ‎11-07-2011

Please ensure that bpcd log folder exists on the client (under /usr/openv/netbackup/logs)

Please try another backup with encryption enabled, then post client's bpcd log as attachment (please rename log to bpcd.log or bpcd.txt).

**** EDIT ****

Please close your other encryption-related posts?

https://www-secure.symantec.com/connect/forums/find-whether-encryption-installed

https://www-secure.symantec.com/connect/forums/legacy-encryption-netbackup-65

Handy NetBackup Links

MKT · ‎11-07-2011

Not sure the 6.5 level but these command outputs would also help:

http://www.symantec.com/docs/HOWTO43773

# bptestnetconn -f -s
----------------------------------------------------------------------
FL:               knothead.min.veritas.com -> 10.80.73.101     :      0 ms [local]
FL:                         www.google.com -> 74.125.19.106    :      0 ms
FL:               r2d2.starwars.galaxy.com -> 0.0.0.0          :      4 ms
FL:                      whoknows.what.com -> 209.139.193.224  :      0 ms [cluster/ri]
FL:                                  zebra -> 10.80.120.103    :      0 ms
FL:                           lawndartsvm2 -> 10.80.74.153     :      0 ms
FL:                           lawndartsvm1 -> 10.80.74.154     :      0 ms
----------------------------------------------------------------------
Slow (>5 sec) or/and failed forward lookups:
                        r2d2.starwars.galaxy.com :      0 sec [FAILED]
----------------------------------------------------------------------
Total elapsed time: 0 sec

Example 4 - Report all reverse DNS lookup times for all NetBackup servers in the configuration.

# bptestnetconn -r -s
----------------------------------------------------------------
RL:     10.80.73.101 -> knothead.min.veritas.com                 :      0 ms
RL:    74.125.19.106 -> nuq04s01-in-f106.1e100.net               :    156 ms MISMATCH
RL:    **LKUP FAIL** -> r2d2.starwars.galaxy.com                 :      0 ms
RL:  209.139.193.224 -> **LKUP FAIL**                            :    739 ms
RL:    10.80.120.103 -> zebra.min.veritas.com                    :      0 ms
RL:     10.80.74.153 -> lawndartsvm2.min.veritas.com             :      0 ms
RL:     10.80.74.154 -> lawndartsvm1.min.veritas.com             :      0 ms
----------------------------------------------------------------
Slow (>5 sec) or/and failed/mismatched reverse lookups:
                 www.google.com :      0 sec [MISMATCH] -> nuq04s01-in-f106.1e100.net
       r2d2.starwars.galaxy.com :      0 sec [FAILED]
              whoknows.what.com :      0 sec [FAILED]
----------------------------------------------------------------
Total elapsed time: 1 sec

thesunlover · ‎11-07-2011

How can I close them? Mark as a solution? I did it.

Yasuhisa_Ishika · ‎11-07-2011

Are you restarting backups from the job that run before you enabled cilent encryption in policy?
If so, try to initiate new backup from policy -> manual backup.

Marianne · ‎11-07-2011

What is the patch level on the master? Client seems to be unpatched, right?

With most of these add-on options it is important that the client is at the same patch level as the master and media server. Please patch client to the same level as the server.

PLEASE create bpcd folder on client for further troubleshooting.

Handy NetBackup Links

thesunlover · ‎11-08-2011

Thanks. That's what I did many times - manual backup.

thesunlover · ‎11-08-2011

You are right. The server and the client are in different patch versions.

nbserver# bpgetconfig -s nbserver -A -L | egrep 'Version|Patch|Platform'
NetBackup Client Platform = Solaris, Solaris_x86_10_64
Version Name = 6.5
Version Number = 650000
Patch Level = 6.5.3

nbserver# bpgetconfig -s nbclient -A -L | egrep 'Version|Patch|Platform'
NetBackup Client Platform = Linux, SuSE2.6
Version Name = 6.5
Version Number = 650000
Patch Level = 6.5

So I'll have to upgrade the client version?

Thanks a lot!

Marianne · ‎11-08-2011

I know for a fact that certain options (such as BMR) requires server and client to be the same version. the same probably applies to encryption...

Please let us know if patching the client solves the problem.

Handy NetBackup Links

thesunlover · ‎11-08-2011

Client bpcd.log is not existing. Any quick config instruction?
Here is output of bptestbpcd:

nbserver# bptestbpcd -client nbclient -debug -verbose
16:28:37.929 [7777] <2> bptestbpcd: VERBOSE = 0
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.990: host_cache_size: 200 0x000000c8
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.991: cache_time: 3600 0x00000e10
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.1003: host_failed_cache_size: 40 0x00000028
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.1004: cache_time: 3600 0x00000e10
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.990: host_cache_size: 200 0x000000c8
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.991: cache_time: 3600 0x00000e10
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.1003: host_failed_cache_size: 40 0x00000028
16:28:37.930 [7777] <2> init_cache: vnet_hosts.c.1004: cache_time: 3600 0x00000e10
16:28:37.943 [7777] <2> vnet_vnetd_service_socket: vnet_vnetd.c.2043: VN_REQUEST_SERVICE_SOCKET: 6 0x00000006
16:28:37.943 [7777] <2> vnet_vnetd_service_socket: vnet_vnetd.c.2057: service: bpcd
16:28:37.983 [7777] <2> logconnections: BPCD CONNECT FROM 10.1.6.140.39030 TO 10.1.5.71.13724
16:28:37.983 [7777] <2> vnet_connect_to_vnetd_extra: vnet_vnetd.c.179: msg: VNETD CONNECT FROM 10.1.6.140.39031 TO 10.1.5.71.13724 fd = 5
16:28:37.995 [7777] <2> vnet_vnetd_connect_forward_socket_begin: vnet_vnetd.c.532: VN_REQUEST_CONNECT_FORWARD_SOCKET: 10 0x0000000a
16:28:38.036 [7777] <2> vnet_vnetd_connect_forward_socket_begin: vnet_vnetd.c.549: ipc_string: /tmp/vnet-31433320701655974338000000000-CDpp9y
1 1 1
10.1.6.140:39030 -> 10.1.5.71:13724
10.1.6.140:39031 -> 10.1.5.71:13724
16:28:38.250 [7777] <2> bpcr_get_peername_rqst: Server peername length = 30
16:28:38.360 [7777] <2> bpcr_get_hostname_rqst: Server hostname length = 5
16:28:38.470 [7777] <2> bpcr_get_clientname_rqst: Server client name length = 5
16:28:38.580 [7777] <2> bpcr_get_version_rqst: bpcd version: 06500000
16:28:38.690 [7777] <2> bpcr_get_platform_rqst: Server client platform length = 14
16:28:38.800 [7777] <2> bpcr_get_version_rqst: bpcd version: 06500000
16:28:38.800 [7777] <2> bpcr_patch_version_rqst: bpcd version 0x06500000 is too old for the BPCD_PATCH_VERSION_RQST
16:28:38.800 [7777] <2> bpcr_patch_version_rqst: bpcd returned failure: 16
16:28:38.800 [7777] <16> bpcr_patch_version_rqst() failed, status = 16, errno = 0: get_patch_version
16:28:38.910 [7777] <2> bpcr_get_version_rqst: bpcd version: 06500000
16:28:38.910 [7777] <2> bpcr_patch_version_rqst: bpcd version 0x06500000 is too old for the BPCD_PATCH_VERSION_RQST
16:28:38.910 [7777] <2> bpcr_patch_version_rqst: bpcd returned failure: 16
16:28:38.910 [7777] <16> bpcr_patch_version_rqst() failed, status = 16, errno = 0: get_patch_version
PEER_NAME = nbserver.mydomain.com
HOST_NAME = nbclient
CLIENT_NAME = nbclient
VERSION = 0x06500000
PLATFORM = linuxS_x86_2.6
PATCH_VERSION =
SERVER_PATCH_VERSION =
16:28:38.910 [7777] <2> vnet_connect_to_vnetd_extra: vnet_vnetd.c.179: msg: VNETD CONNECT FROM 10.1.6.140.39032 TO 10.1.5.71.13724 fd = 6
16:28:38.923 [7777] <2> vnet_vnetd_connect_forward_socket_begin: vnet_vnetd.c.532: VN_REQUEST_CONNECT_FORWARD_SOCKET: 10 0x0000000a
16:28:38.964 [7777] <2> vnet_vnetd_connect_forward_socket_begin: vnet_vnetd.c.549: ipc_string: /tmp/vnet-31434320701656902332000000000-uGbqMw
10.1.6.140:39032 -> 10.1.5.71:13724
<2>bptestbpcd: EXIT status = 0
16:28:38.966 [7777] <2> bptestbpcd: EXIT status = 0

Thanks!

thesunlover · ‎11-08-2011

In the bptestbpcd output above, there is an error:

<16> bpcr_patch_version_rqst() failed, status = 16

Does this mean something?

Will_Restore · ‎11-08-2011

https://www-secure.symantec.com/connect/forums/status-code-800-again-please-help

Marianne · ‎11-08-2011

The error should go away once you have upgraded the client.

Please let us know once you have done that.

Handy NetBackup Links

thesunlover · ‎11-10-2011

Thank you! The erro 46 is gone. A new error 9 is now showing up.

nbclient:/usr/openv/netbackup/logs/bpbkar]# cat log.111011
09:11:30.180 [9986] <4> bpbkar main: real locales <C>
09:11:30.180 [9986] <4> bpbkar main: standardized locales - lc_messages <C> lc_ctype <C> lc_time <C> lc_collate <C> lc_numeric <C>
09:11:30.180 [9986] <16> bpbkar: ERR - read() of KEYREADFD failed. Count = 0 Schedule Count = 0 Errno = 32: Broken pipe
09:11:30.180 [9986] <16> bpbkar: ERR - Could not read key file
09:11:30.180 [9986] <16> bpbkar: ERR - bpbkar FATAL exit status = 9: an extension package is needed, but was not installed
09:11:30.180 [9986] <4> bpbkar: INF - EXIT STATUS 9: an extension package is needed, but was not installed
09:11:30.317 [9986] <16> bpbkar: ERR - read server exit status = 6: the backup failed to back up the requested files
09:11:30.317 [9986] <4> bpbkar: INF - setenv FINISHED=0

I've studied this document: http://www.symantec.com/business/support/index?page=content&id=TECH38781
but can not find anything wrong with the library path.

thesunlover · ‎11-10-2011

Encryption backup is successful on two clients and policies. I will post more questions about it later. Thank you again!

Marianne · ‎11-14-2011

Does your last post mean that status 46 is resolved?

Please share what was done to fix the problem? Upgrade the client?

Handy NetBackup Links

thesunlover · ‎11-14-2011

46 errors are gone on 3 systems, but still existing on some other systems. I am working on it.

thesunlover · ‎11-15-2011

I've found the solution for error 46:

The command 'bpinst -ENCRYPTION -verbose -policy_names mypolicy' runs ok, but 'bppllist mypolicy -U | grep -i encrypt' returns 'Client Encrypt: no', then got the error 46.

Solution: Go to GUI policy and de-select 'Collect disaster recovery information for Bare Metal Restore'. Then select 'Encryption'.

I've found this solution by myself with lots of time involved, then got two more results:

https://www-secure.symantec.com/connect/forums/cannot-enable-policy-encryption-attribute-651
http://www.symantec.com/business/support/index?page=content&id=TECH53142

I have to say that NetBackup is not well designed here.

Thanks!

Will_Restore · ‎11-15-2011

Troubleshooting:
This problem occurs because NetBackup does not allow both Bare Metal Restore (BMR) and Encryption to be enabled in the same policy.

http://www.symantec.com/docs/TECH53142

Marianne · ‎11-15-2011

It always helps to share all relevant information.

You knew that BMR was enabled in the policy - we did not.

Handy NetBackup Links

VOX

status code 46 - after encryption enabled