NetWorker: Backup fails with: Unable to create session channel with nsrexecd on host client-name to execute command 'savefs ....

Summary: Backup fails with Unable to create session channel with nsrexecd on host client-name to execute command 'savefs -s server-name -c client-name -g

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

NetWorker client-based backup fails with: 
Unable to create session channel with nsrexecd on host client-name to execute command 'savefs -s server-name -c client-name'

Cause

There is a communication issue between the server and client.

Resolution

Initial Steps:

  • Check that nsrexecd is running on the client. 
    • Linux: ps -ef | grep nsrexecd
Windows: tasklist | findstr nsrexecd

       
  • If client services are not running, start them and monitor for any service issues: 
    • Linux: systemctl start networker
Windows: net start nsrexecd

       
  • Service startup issues can be monitored in the client's daemon.raw file:
  • Confirm that name resolution is working correctly from both the NetWorker server and client using nslookup. The FQDN, shortname, and IP should all return correctly.

Connectivity Troubleshooting:

  • Check that nsradmin can connect from server to client and vice versa:
nsradmin -p nsrexecd -s client-name
Where 'client-name' is the hostname of the client as defined in the NetWorker config.
  • Check the port range on the server and client, with nsrports to confirm they match. The default service port range used by NetWorker is 7937-9936.
  • On the NetWorker server, check which ports/processes are visible from the client: 
nsrrprcinfo -p client-name
Where 'client-name' is the hostname of the client as defined in the NetWorker config. 
PS C:\Windows\system32> nsrrpcinfo -p winsrvr2k16.emclab.local
PROGRAM VERSION PROTOCOL PORT SERVICE
100000  2       tcp      7938 nsrportmapper  Port Mapper
100000  2       udp      7938 nsrportmapper  Port Mapper
390436  1       tcp      8655 nsrexecd       GSS Authentication
390435  1       tcp      9220 nsrexecd       Resource Mirror
390113  1       tcp      7937 nsrexecd       Remote Execution
390440  1       tcp      9500 nsrexecd_nsrfa Remote File Access
Ports are dynamically assigned from the configured port range. 
  • Check if there is a software firewall running on the client, and that if there is, the port range included the NetWorker ports:
    • Linux:  
      firewall-cmd --list-all
      A typical config, with the default NetWorker ports is:
# firewall-cmd --list-all
public (active)
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces: ens3
  sources:
  services:
  ports: 7937-9936/tcp
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
        rule family="ipv4" source ipset="jump-servers" service name="ssh" accept
However a misconfigured firewall config might look like: 
# firewall-cmd --list-all
public (active)
  target: %%REJECT%%
  icmp-block-inversion: yes
  interfaces: ens3
  sources:
  services:
  ports: 7936-7996/tcp
  protocols:
  forward: no
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks: echo-reply echo-request
  rich rules:
        rule family="ipv4" source ipset="jump-servers" service name="ssh" accept
Windows:
Open Windows Defender Firewall with Advanced Security and review the inbound and outbound rules. Check for any rules blocking or restricting the NetWorker port range (as shown with nsrports). The Local Port column displays the port range the rule is applied to. 
 
NOTE: The operating system administrator should be engaged to review any additional operating system settings or software which could potentially block communication. If no operating system level configurations are found the communication may be blocked by a network device. The network admin should also be engaged to review any potential network configurations which may block communication.
  • It is recommended to use the default port range (7937-9936) when possible. The port range can be set using the nsrports command:
nsrports -S 7937-9936
Once the port range is correct, nsradmin should connect, and the backup should work.

Affected Products

NetWorker Family, NetWorker
Article Properties
Article Number: 000207523
Article Type: Solution
Last Modified: 20 Apr 2023
Version:  4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.