NVP-vProxy: Backups marked as failed but all VMs were successful "Unable to find selected vCenter container work item with ID "vm-MOREF"

The NetWorker VMware Protection (NVP) integration is configured with the vProxy Appliance. 
The NetWorker Management Console (NMC) Monitoring tab shows a VMware Policy workflow in a failed status, but all VMs backed up successfully.
The VMware Protection Group is configured using Dynamic Association with Rules to determine which virtual machines and containers are dynamically in the group.

The backup summary shows the following error:

The error can also be seen in the backup action logs on the NetWorker server:

• Linux: /nsr/logs/policy/POLICY_NAME/WORKFLOW_NAME/ACTION_JOBID.raw
• Windows (Default): C:\Program Files\EMC NetWorker\nsr\logs\policy\POLICY_NAME\WORKFLOW_NAME\ACTION_JOBID.raw
• NetWorker: How to use nsr_render_log to render .raw log files

[root@nsr ~]# nsr_render_log "/nsr/logs/policy/VMware Protection/VMware Protection - Full VM/backup_192212.raw"
151761 09/12/2025 01:08:33 PM  1 5 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR notice Action backup vmware-vproxy 'backup' has initialized as 'vproxysave job' with job id 192212
204343 09/12/2025 01:08:33 PM  0 26 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR info Starting nsrvim.
185813 09/12/2025 01:08:33 PM  0 0 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR info Calling the nsrvim program to collect the inventory data.
185814 09/12/2025 01:08:33 PM  0 0 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR info Setting default timeout 1800.
185818 09/12/2025 01:08:33 PM  0 0 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR info Using a timeout of 1800 seconds for the nsrvim request. Minimum timeout is 360 seconds. Maximum timeout is 3600 seconds.
204344 09/12/2025 01:08:34 PM  0 26 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR info Getting list of VM work items.
0 09/12/2025 01:08:34 PM  1 5 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR notice 09/12/25 13:08:34.166306 nsrvproxy_save-D0 libCURL SSL support is Enabled.
165099 09/12/2025 01:08:39 PM  3 0 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR error Unable to find selected vCenter container work item with ID "vm-23014" in vCenter, the work item will be skipped.
165099 09/12/2025 01:08:39 PM  3 0 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR error Unable to find selected vCenter container work item with ID "vm-23013" in vCenter, the work item will be skipped.
205578 09/12/2025 01:08:39 PM  1 5 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR notice Transport mode selected from the user for backup: 'Auto'.
205578 09/12/2025 01:08:39 PM  1 5 0 3478079296 18737 0 nsr.amer.lan nsrvproxy_save NSR notice Transport mode selected from the user for backup: 'Auto'.
...

The error message reports VMware Managed Object Reference (MoRef) IDs. These IDs are associated with VMware Template VMs. 

This is identified using one of two methods:

vProxy vmconfig:

1. Open an SSH session to one of the vProxies on the vCenter and login as admin.
2. Switch to root: sudo su -
3. Go to the vProxy bin directory: cd /opt/emc/vproxy/bin
4. Load the vProxy environment variable file: source /opt/emc/vproxy/unit/vproxy.env
5. Run the following command, replacing the VALUES with the corresponding ones from your environment:

./vmconfig -c info -k "vm-MOREF" -l moref -p 'Password-for-vCenter' -u username-for-vCenter -v vcentername

Example:

nsr-vproxy:~ # cd /opt/emc/vproxy/bin
nsr-vproxy:/opt/emc/vproxy/bin # source /opt/emc/vproxy/unit/vproxy.env
nsr-vproxy:/opt/emc/vproxy/bin # ./vmconfig -c info -k "vm-23013" -l moref -p '!Password1' -u networker_user@vsphere.local -v vcsa.amer.lan
VM Config
vCenter: "vcsa.amer.lan", User: "networker_user@vsphere.local", Password: "!Password1", Lookup Mode: "moref", Lookup Key: "vm-23013", HypervisorMode: "vSphere", Command: "info"
Logged into vCenter 'vcsa.amer.lan'.
Connected to session on vCenter 'vcsa.amer.lan' Version '8.0.3 build-24322831, API:8.0.3.0', Uuid:e5390e5f-912e-4818-ad6e-ea9b878ff57d.
Found virtual machine 'win-template' with MORef 'vm-23013'.
vm-23013: Name: "win-template".
vm-23013: CBT Enabled: false.
vm-23013: Migration Enabled: false.
vm-23013: Backup Locked: false.
Disconnected from session on vCenter 'vcsa.amer.lan'.
Logged out from vCenter 'vcsa.amer.lan'.

VMware Managed Object Browser (MOB):

1. Open a web browser and enter the following URL, replacing the VALUES with your environment-specific ones: https://VCENTER_ADDRESS/mob/?moid=VM-MOREF
2. Enter your vCenter user credentials when prompted.

Example:

The rule configured in the NetWorker protection group dynamically picks up VMs at the time of backup. The VMware Template VMs are picked up because there is a rule set to include the VM template. For example: 

• There is a VirtualMachine Name-based rule set to include VMs that contain a specific string. The template string matches.
• There is a VmFolder Name-based rule set to exclude certain "VM and Template" folders in VMware. The VM templates are not in the VMware folder and are picked up as part of the workflow.

NetWorker does not support backups of VMware templates. The workflow is warning that the VM is skipped because it is not supported. The workflow is marked as failed so that corrective action can be taken to remove it from the rule-based selection. 

The VM templates must be excluded from the dynamic selection. 

Update the "rule" used by the NetWorker protection group. The following are some examples of how the templates can be removed from dynamic selection. One or more of the rules could be configured depending on the VMware environment and how you want to manage the dynamic rule-based selections. The method used to prevent the templates is at the discretion of the VMware and NetWorker Administrators.

• Move the VMware Templates to a specific folder in VMware. Create a Name-based rule in NetWorker to not include that folder in the backups.
   
• If the Template VMs contain a common string (for example: template). Create a Name-based rule to not include VMs that include that string.
   
• In VMware, create a category tag and assign that tag to the template VMs. This must be done by the VMware Administrator. In NetWorker create a Tag-based rule to not include VMs or Templates with that tag.
  • See: NVP vProxy: Category Tagging based VMware Protection

Once the Templates are no longer picked up by dynamic selection, the workflow is marked successful or failed depending on the Virtual Machine backup completion status.

NVP vProxy: Unable to find the selected VM work item with UUID "UUID" in vCenter, the work item will be skipped.