status code 46 - after encryption enabled

[thesunlover]

Hi, After installed and enabled encryption, I got this status code 46. I've tried both regular encryption and legacy encryption. Here is some info:

-------------------------------------------------------------------------

nbserver# bpinst -LEGACY_CRYPT -verbose nbclient
BPCD protocol version 6.5.0 on client nbclient
40-bit library version is 3.1.0.40 on client nbclient
56-bit library version is 3.1.0.56 on client nbclient
BPCD platform is linuxS_x86_2.6 for client nbclient
Current configuration entries are:
CRYPT_KEYFILE = /usr/openv/var/keyfile
CRYPT_LIBPATH = /usr/openv/lib
CRYPT_OPTION = required
CRYPT_STRENGTH = des_56
V_PATH_SHARE = /usr/openv/share
No update of NetBackup configuration required for client nbclient
No update of NetBackup pass phrase required for client nbclient

nbserver# bpkeyutil -display -client nbclient
Key File version: 2
Key count: 2
1. Key creation time: Fri Nov  4 13:34:36 2011
    Digest of key: 1B 2F 0F 67 ...
2. Key creation time: Fri Nov  4 13:50:50 2011
    Digest of key: 80 18 E5 47 ...

nbserver# bppllist dhcp_nbclient -U | grep -i encrypt
  Client Encrypt:      yes

nbclient# cat /usr/openv/netbackup/bp.conf
SERVER = nbserver
CLIENT_NAME = nbclient
# V_PATH_SHARE = /usr/openv/share
# CRYPT_KEYFILE = /usr/openv/netbackup/keyfile.dat
CRYPT_KEYFILE = /usr/openv/var/keyfile.dat
CRYPT_LIBPATH = /usr/openv/lib
CRYPT_OPTION = required
CRYPT_STRENGTH = des_56
# V_PATH_SHARE = /usr/openv/share
CRYPT_KIND = NONE

nbclient# file /usr/openv/var/keyfile.dat
/usr/openv/var/keyfile.dat: data

-------------------------------------------------------------------------

If I change CRYPT_OPTION=required to CRYPT_OPTION=denied, 46 issue is gone. I've verifed that we have valid license key for encryption.
 

Please help and thank you in advance!

[thesunlover]

BMR is enabled by default during policy setup. BMR and encryption can not be enabled both. If one is enabled, the other is disabled.

Command 'bpinst -ENCRYPTION -policy_names mypolicy' runs well without error. So users have no way to know enabled BMR is blocking encryption from working. This is a bug of NetBackup I think.

[CRZ · Accepted solution]

NetBackup is functioning as intended, but it's just a piece of software - it can't always determine whether the admin is ALSO functioning as intended.

The bottom line is BMR and Encryption don't get along, but we're not going to deny you an installation of Encryption because all your policies may currently be collecting BMR info.

You can ALWAYS *install* Encryption and NetBackup isn't going to complain because NetBackup doesn't know your intent.  Maybe all your policies collect BMR information right now, but you have plans to change some of those policies later.  Or maybe you want to create entirely new policies for your newly installed Encryption Option.

Your issue here REALLY was setting CRYPT_OPTION = REQUIRED in your bp.conf file.  It would have been better set to ALLOWED if you wanted to run BOTH policies with Encryption and policies with BMR.

I now suspect your other thread asking how to enable Encryption from the command line was an attempt to get around a greyed out option from BMR being checked.  Was that the case?  Setting BOTH BMR and Encryption - if it's even possible, and I hope it's not, but don't know for sure - would lead to disaster...or at the very least, lead to no valid backups.

If you had opened a support case, probably the first thing your TSE would have done is asked for a look at your policy, either with bppllist output, collecting nbsu output, or hopping on a WebEx with you and asking you to show them the policy in the GUI.  In all of these cases, I'm certain we would have been able to resolve your case pretty quickly once we had a look at the policy - specifically, the Encryption and BMR collection settings.  You have been here a lot over the past couple weeks, though, and always with questions about Encryption, so I am starting to suspect you may not have a Support contract.  I would strongly encourage looking into acquiring one.

[thesunlover]

NetBackup is good, but I hope it can be better.

We will purchase support contract for NetBackup soon - hopefully.