Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. Cohesity Cloud Scale Technology Manual Deployment Guide for Kubernetes Clusters
  3. Section III. Monitoring and Management
  4. Performing catalog backup and recovery
  5. Restoring a catalog
  6. Primary server corrupted
Cohesity Cloud Scale Technology Manual Deployment Guide for Kubernetes Clusters

Primary server corrupted

  • When catalog backup is taken on external media server

  • When catalog backup is taken on MSDP-X

  1. Copy DRPackages files (packages) located at /mnt/nblogs/DRPackages/ from the pod to the host machine from where Kubernetes Service cluster is accessed.

    Run the kubectl cp <primary-pod-namespace>/<primary-pod-name>:/mnt/nblogs/DRPackages <Path_where_to_copy_on_host_machine> command.

  2. Preserve the data of /mnt/nbdata and /mnt/nblogs on host machine by creating tar and copying it using the kubectl cp <primary-pod-namespace>/<primary-pod-name>:<tar_file_name> <path_on_host_machine_where_to_preserve_the_data> command.
  3. Change CR spec from paused: false to paused: true in primary, mediaServers, and msdpScaleouts sections in environment object using the following command:

    kubectl edit <environment_CR_name> -n <namespace>

  4. Change replica count to 0 in primary server's statefulset using the kubectl edit statefulset <primary-server-statefulset-name> -n <namespace> command.
  5. Clean the PV and PVCs of primary server as follows:
    • Get names of PV attached to primary server PVC (catalog, log and data) using the kubectl get pvc -n <namespace> -o wide command.

    • Delete primary server PVC (catalog, log and data) using the kubectl delete pvc <pvc-name> -n <namespace> command.

    • Delete the PV linked to primary server PVC using the kubectl delete pv <pv-name> command.

  6. (EKS-specific) Navigate to mounted EFS directory and delete the content from primary_catalog folder by running the rm -rf /efs/* command.
  7. Change CR spec paused: true to paused: false in primary server section and reapply yaml with the helm upgrade cloudscale cloudscale-<version>.tgz -n <namespace> --reuse-values --set environment.primary.paused=true command.
  8. Once the primary pod is in ready state, execute the following command in the primary server pod:

    kubectl exec -it -n <namespace> <primary-pod-name> -- /bin/bash

    • Increase the debug logs level on primary server.

    • Create a directory DRPackages at persisted location using mkdir /mnt/nblogs/DRPackages.

    • Change ownership of the DRPackages folder to service user using the chown nbsvcusr:nbsvcusr /mnt/nblogs/DRPackages command.

  9. Copy earlier copied DR files to primary pod at /mnt/nblogs/DRPackages using the kubectl cp <Path_of_DRPackages_on_host_machine> <primary-pod-namespace>/<primary-pod-name>:/mnt/nblogs/DRPackages command.
  10. (Applicable for catalog backup taken on external media server)
    • Execute the following steps in the primary server pod:

      • Change ownership of files in /mnt/nblogs/DRPackages using the chown nbsvcusr:nbsvcusr <file-name> command.

      • Deactivate NetBackup health probes using the /opt/veritas/vxapp-manage/nb-health deactivate command.

      • Stop the NetBackup services using /usr/openv/netbackup/bin/bp.kill_all.

      • Execute the nbhostidentity -import -infile /mnt/nblogs/DRPackages/<filename>.drpkg command.

      • Restart all the NetBackup services using /usr/openv/netbackup/bin/bp.start_all.

    • Verify security settings are back.

    • Add respective media server entry in host properties using NetBackup Administration Console as follows:

      Navigate to NetBackup Management > Host properties > Master Server > Add Additional server and add media server.

    • Restart the NetBackup services in primary server pod and external media server

      • Execute the kubectl exec -it -n <namespace> <primary-pod-name> -- /bin/bash command in the primary server pod.

      • Run the /usr/openv/netbackup/bin/bp.kill_all command. After stopping all services restart the same using the /usr/openv/netbackup/bin/bp.start_all command.

      • Run the /usr/openv/netbackup/bin/bp.kill_all command. After stopping all services restart the services using the /usr/openv/netbackup/bin/bp.start_all command on the external media server.

    • Perform catalog recovery from NetBackup Administration Console.

      For more information, refer to the NetBackup Troubleshooting Guide.

    • Execute the kubectl exec -it -n <namespace> <primary-pod-name> -- /bin/bash command in the primary server pod.

      • Stop the NetBackup services using the /usr/openv/netbackup/bin/bp.kill_all command.

      • Start NetBackup services using the /usr/openv/netbackup/bin/bp.start_all command.

      • Activate NetBackup health probes using the /opt/veritas/vxapp-manage/nb-health activate command.

    • Delete the currently running request router pod using the following command:

      kubectl delete pod <request-router-pod-name> -n <PrimaryServer-namespace>

    • Change CR spec from paused: true to paused: false in primary, mediaServers, and msdpScaleouts sections in environment object using the following command:

      kubectl edit <environment_CR_name> -n <namespace>

    • To configure NetBackup IT Analytics refer to the following topic:

      See Configuring NetBackup IT Analytics for NetBackup deployment.

  11. (Applicable for catalog backup taken on MSDP-X)
    • Execute the following steps (after exec) into the primary server pod:

      • Change ownership of files in /mnt/nblogs/DRPackages using the chown nbsvcusr:nbsvcusr <file-name> command.

      • Deactivate NetBackup health probes using the /opt/veritas/vxapp-manage/nb-health deactivate command.

      • Stop the NetBackup services using the /usr/openv/netbackup/bin/bp.kill_all command.

      • Execute the /usr/openv/netbackup/bin/admincmd/nbhostidentity -import -infile /mnt/ndbdb/usr/openv/drpackage/<filename>.drpkg command.

      • Clear bpclntcmd -clear_host_cacheNetBackup host cache by running the command.

      • Start NetBackup services using the /usr/openv/netbackup/bin/bp.start_all command.

      • Refresh the certificate revocation list using the /usr/openv/netbackup/bin/nbcertcmd -getcrl command.

    • From Web UI, allow reissue of token from primary server for MSDP only as follows:

      Navigate to Security > Host Mappings for the MSDP storage server and select Allow Auto reissue Certificate.

    • Run the primary server reconciler as follows:

      • Run the following command to pause the primary server CR:

        helm upgrade cloudscale cloudscale-<version>.tgz -n netbackup --reuse-values --set environment.primary.paused=true

      • Run the following command to un-pause the primary server CR:

        helm upgrade cloudscale cloudscale-<version>.tgz -n netbackup --reuse-values --set environment.primary.paused=false

    • Edit the environment using kubectl edit environment -n <namespace> command and change paused field to false for MSDP.

    • Verify if MSDP installation is successful and default MSDP storage server, STU and disk pool is created with old names. This takes some time. Hence, wait before the STU and disk pool display on the Web UI before proceeding to the next step.

    • Perform from step 2 in the following section:

      “Scenario 2: MSDP Scaleout and its data is lost and the NetBackup primary server was destroyed and is re-installed”

    • Edit environment CR and change paused: false for media server.

    • Perform full catalog recovery using one of the following options:

      Trigger a catalog recovery from the Web UI.

      Or

      Exec into primary pod and run bprecover -wizard command.

    • Once recovery is completed, restart the NetBackup services:

      Stop NetBackup services using the /usr/openv/netbackup/bin/bp.kill_all command.

      Start NetBackup services using the /usr/openv/netbackup/bin/bp.start_all command.

    • Activate NetBackup health probes using the /opt/veritas/vxapp-manage/nb-health activate command.

    • Verify/Backup/Restore the backup images in NetBackup server to check if the MSDP-X cluster has recovered or not.

    • Verify that the Primary, Media, MSDP and Snapshot Manager server are up and running.

Feedback

Was this page helpful?
Previous

Restoring a catalog

Next

MSDP-X corrupted

Feedback

Was this page helpful?