Networker 7.6.2 and VADP

Do you have SYSTEM@w2k3vz.comparex.bud also on admin list of backup server?

Was the config done by your or wizard?

Hi!

I did two things:

1. Recreate the directory on c:\mnt and create directory for the proxy because Savegrp complain to this dir. (Cannot delete C:\mnt\vm-esrs directory)

2. Add the admin user: SYSTEM@*

And the backup is running fine now.

BR: Paul

Hi,

Zoltan (the owner of this thread) went on holiday and I took over his testing activities.

I somewhat streamlined the backup scenario to make the roles of the participating hosts, virtual machines more clear:

reposrv.comparex.bud: this is a Vmware virtual machine, running Windows server O/S, this is the Networker server (NW 7.6.2), and this machine is to handle Data Domain backup devices (across an IP network and OST/BOOST)

w2k3vz.comparex.bud: this is also a Vmware virtual machine, Windows server O/S, this is the VADP proxy, having Networker client SW

vm-esrs.comparex.bud: this is also a Vmware virtual machine, Windows server O/S, this is the virtual server to be backed up

vm-vcenter1: the Vmware vCenter Management Server (both super-user "administrator" and a custom "VADP user" - based on the "VADP role" access rights recommendations - were tried, with the same results)

Here are the client definitions of the VADP proxy and the VM to be backed up:

                        type: NSR client;

                        name: vm-esrs;

                      server: reposrv.comparex.bud;

                   client id: \

f0626b8a-00000004-4db975ac-4db975ab-00cd5000-8f208356;

            scheduled backup: Enabled;

                     comment: ;

             Save operations: ;

            archive services: Disabled;

                    schedule: Default;

               browse policy: Month;

            retention policy: Month;

                  statistics: elapsed = 176840, index size (KB) = 0,

                              amount used (KB) = 0, entries = 0;

               index message: ;

       index operation start: ;

              index progress: ;

             index operation: Idle;

              index save set: ;

                   directive: ;

                       group: vmware;

                    save set: *FULL*;

                save set MBT: *FULL*;

  Backup renamed directories: Disabled;

          Checkpoint enabled: Disabled;

      Checkpoint granularity: Directory;

                    priority: 500;

   File inactivity threshold: 0;

File inactivity alert threshold: 0;

               remote access: Administrator@w2k3vz.comparex.bud,

                              system@w2k3vz.comparex.bud,

                              SYSTEM@w2k3vz.comparex.bud,

                              "user=system, host=w2k3vz.comparex.bud",

                              "user=SYSTEM, host=W2k3VZ.comparex.bud",

                              "user=SYSTEM, host=W2k3VZ";

                 remote user: ;

                    password: ;

              backup command: nsrvadp_save;

     application information: VADP_HYPERVISOR=vm-vcenter1;

                        ndmp: No;

             NDMP array name: ;

       De-duplication backup: No;

         De-duplication node: ;

                        Pool: ;

          Data Domain backup: No;

         Probe resource name: ;

              virtual client: Yes;

               physical host: sresxf02.comparex.bud;

           Proxy backup type: VADP;

           Proxy backup host: w2k3vz;

             executable path: ;

    server network interface: ;

                     aliases: vm-esrs, vm-esrs.comparex.bud;

                  index path: ;

          owner notification: ;

                 parallelism: 4;

physical client parallelism: Disabled;

               archive users: ;

               storage nodes: nsrserverhost;

       recover storage nodes: ;

         clone storage nodes: ;

                  hard links: Disabled;

             short filenames: Disabled;

                         BMR: Disabled;

                 BMR options: ;

                 backup type: Filesystem;

               backup config: ;

                    hostname: reposrv.comparex.bud;

               administrator: \

"group=Administrators,host=reposrv.comparex.bud",

                              "user=administrator,host=reposrv.comparex.bud",

                              "user=system,host=reposrv.comparex.bud",

                              "user=administrator,domain=comparex.bud",

                              "user=zoltan.voros,domain=comparex.bud",

                              "user=system,host=w2k3vz.comparex.bud",

                              "user=administrator,host=w2k3vz.comparex.bud",

                              "user=Administrator,host=w2k3vz.comparex.bud",

                              "user=SYSTEM,host=w2k3vz.comparex.bud",

                              "user=SYSTEM,host=W2k3VZ.comparex.bud",

                              "user=SYSTEM,host=W2k3VZ";

          ONC program number: 390109;

          ONC version number: 2;

               ONC transport: TCP;

              client OS type: Windows NT Server on Intel;

                        CPUs: 1;

           NetWorker version: 7.6.2.Build.631;

              enabler in use: Yes;

       licensed applications: ;

               licensed PSPs: ;

I tried to create the new VM client, and also re-create the VADP proxy, using the wizard.

You can see (from the client definitions), that in "remote access" (and also in the administrators of the server itself, plus the members of the "Administrators" user groups) we tried to include various combinations of the privileges referred to in the error messages as missing. ("39077:save: error, permission denied, `SYSTEM' on `w2k3vz.comparex.bud' must have remote access privilege to client vm-esrs")

I tried to run the save group in very verbose (-vvvvv) mode - no real additional info. I also ran the underlying save ("nsrvadp_save.exe") command with the proper attributes and flags. The result is the same. What we see is that the virtual disks are seen by the VADP proxy (and look to be available in a temp dir structure under C:\mnt\vm-esrs), mounting seems to be OK, but then the save command fails with "permission denied". And then the mounted virtual disks immediately unmounted, and the nsrvadp_save command and the savegroup exits with an error.

Thanks.

Regards,

Geza

Hi.

Thanks.

Now, can anyone explain why this workaround is needed, and how to permanently and correctly fix the issue? (Because system@* is not a particularly nice idea from a security and authorization perspective...)

Geza

Can you, for test, add only system@ and see if that works?  If yes, from there is easy to isolate what is really missing.

Hello,

I tried to add, but it didn't work.

I add these both the Users/Administrator and both the client's remote access list.

Br

Zoltan

The first line should be enough, but maybe you should try without the domain name part. Or define the VADP proxy as  w2k3vz.comparex.bud and not only w2k3vz.

I use the form system@vadproxy.som.dom in the remote access and it works well if I have defined the VADP proxy as vadproxy.som.dom.

And even though VADP seem to be much more reliable than VCB I still have some issues with it. I haven't found a way to disable the quiesced snapshots the same way as with VCB (NO_QUIESCE=1 in config.js). Yes, I know that by disabling the SYNC or VSS vmware driver in vmware tools I have a workaround, but i don't want to disable it completely, only for the VADP backups.