Restoring the disaster recovery package on Linux
After a disaster, you need to restore the disaster recovery package that corresponds to the catalog backup that you want to restore. This package is created during the catalog backup and contains the NetBackup primary server host identity. You must restore the host identity before you can perform a catalog recovery.
Note the following about restoring the disaster recovery package and catalog recovery:
Catalog recovery does not recover the host identity. To restore the host identity or disaster recovery package, you must install NetBackup in the disaster recovery mode and import the required package. After you recover the disaster recovery package, you can recover the catalog.
After you restore the disaster recovery package, you must immediately perform catalog recovery.
Note the following when you want to recover a clustered primary server:
The disaster recovery package contains the identity files and configuration only for the virtual name.
After the DR installation, the virtual name's certificate is restored.
Cluster node-specific certificates and configuration options are not backed up and therefore are not recovered. You must redeploy or reconfigure NetBackup or external certificates after the DR installation.
After a catalog recovery, NetBackup freezes the removeable media that contains the catalog backup. This operation prevents a subsequent accidental overwrite action on the final catalog backup image on the media. This final image pertains to the actual catalog backup itself, and its recovery is not part of the catalog recovery. You can unfreeze the media.
If external CA-signed certificates are used in your NetBackup domain, ensure the following:
In case of file-based external certificates, ensure that the certificate file path is configured, accessible, and is the same as the one that was backed up.
Note the following if you used a Windows certificate store as a certificate store before the disaster and the certificate files were not backed up during catalog backup. You must manually configure the external certificate for the host after the disaster. Refer to the following article:
You have configured the required certificate revocation lists (CRL) before you begin the disaster recovery installation, if applicable.
For more information on the CRLs, refer to the NetBackup Security and Encryption Guide.
In some cases when an external certificate was configured on the primary server before the disaster, the DR installation fails. You can set an environment variable that lets you correct the external certificate configuration.
You can restore the disaster recovery package of the NetBackup primary server either during installation or after installation.
See Restore the disaster recovery package during NetBackup installation on Linux.
See Restore the disaster recovery package after NetBackup installation on Linux.
The following procedure describes how to restore the disaster recovery package during the installation of NetBackup.
To restore the disaster recovery package of the NetBackup Appliance, you must follow a different procedure.
See Restore the disaster recovery package after NetBackup installation on Linux.
To restore the disaster recovery package during NetBackup installation
- Start the NetBackup software installation.
Refer to the "Installing server software on UNIX systems" section in the NetBackup Installation Guide.
- When the following message appears, press Enter to continue:
Is this host a master server? [y/n] (y)
- When the following message appears, select Y.
Are you currently performing a disaster recovery of a master server? [y/n] (y)
- When the following message appears, provide the name and the path of the disaster recovery package that you want to restore.
Enter the name of your disaster recovery package along with the path, or type q to exit the install script:
If external certificates are used in your domain, a warning message is displayed. When the installer waits during subsequent steps, configure the external certificate configuration options as per step 6.
- When you are prompted, provide the passphrase that is associated with the disaster recovery package that you want to restore.
Caution:
Ensure that you specify the appropriate passphrase.
If you specify a wrong passphrase or the passphrase is lost, you need to deploy security certificates on all hosts after installation. The disaster recovery package cannot be restored during installation. To restore the disaster recovery package after installation, refer to the following article:
Enter your disaster recovery passphrase, or enter q to exit installation:
The following message appears:
Validating disaster recovery passphrase...
If the passphrase is validated, continue with the installation.
- (Conditional) If external CA-signed certificates are used in your NetBackup domain, do the following:
Review the value of the ECA_CRL_CHECK configuration option.
For more information on catalog backup and external certificate configuration options, refer to the NetBackup Administrator's Guide, Volume I.
If the ECA_CRL_CHECK configuration option is set to DISABLE, you do not need to do the CRL configurations.
If the ECA_CRL_CHECK configuration option is enabled, you are prompted to configure the CRL.
The UNIX installer does not wait for any action but proceeds to the next step in the installer. When the installer waits after the following step, you can configure the CRLs and continue with the DR installation.
Configure the CRLs and continue with the DR installation.
Depending on the value that is specified for the ECA_CRL_PATH option, make the required CRLs available.
If ECA_CRL_PATH is not specified, NetBackup uses the CRLs from the CRL distribution point (CDP) of the peer host's certificate. Ensure that the URLs that are available in the CDP are accessible.
If ECA_CRL_PATH is specified, NetBackup uses the CRLs that are available in the directory that is specified for this option. Copy the valid CRLs in the directory that you specify for ECA_CRL_PATH.
(Conditional) If the DR_PKG_MARKER_FILE environment variable was set before the DR installation, a message indicates that the touch file exists. After you complete the external certificate configuration, delete the touch file.
NetBackup services are started.
- (Conditional) If the key management service (KMS) was configured on the primary server before the disaster, run the following command to start the KMS service:
/usr/openv/netbackup/bin/nbkmscmd -discoverNBKMS
- Refer to the "Installing server software on UNIX systems" section in the NetBackup Installation Guide.
The following procedure describes how to restore the disaster recovery package after the installation of NetBackup.
Use this option to restore the disaster recovery package of the NetBackup Appliance.
To restore the disaster recovery package after NetBackup installation
- Run the nbhostidentity -import -infile file_path command after NetBackup installation.
Refer to the NetBackup Commands Reference Guide.
- Clean up the allowed list cache and restart the NetBackup services on all hosts in the domain.
- Refresh the certificate revocation list (CRL) using the following command:
nbcertcmd -getcrl
- If the key management service (KMS) was configured on the primary server before the disaster, run the following command to start the KMS service:
/usr/openv/netbackup/bin/nbkmscmd -discoverNBKMS
- Carry out the given step to remove the NetBackup certificate files in the following scenario:
NetBackup was configured to use only external CA-signed certificates before the disaster and it was configured to use NetBackup certificates or both NetBackup and external certificates before you manually imported the disaster recovery package.
Remove the NetBackup certificate files using the following command:
configureWebServerCerts -removeNBCert
More Information