Name
msdpcldutil — the immutable cloud storage utility
SYNOPSIS
create --bucket bucket_name --volume volume_name --mode retention_mode --min min_time --max max_time [--storageclass storage_class] [--credfile cred_file] [--enable_sas] [--enable_sp] [--enable_iama] [--enable_sts] [--enable_oauth]
list [--bucket bucket_name | --filter bucket_name_filter] [--volume volume_name] [--credfile cred_file] [--enable_sas] [--enable_sp] [--enable_iama] [--enable_sts] [--enable_oauth]
update mode --bucket bucket_name --volume volume_name --mode COMPLIANCE --live live_untildate [--credfile cred_file] [--enable_sas] [--enable_sp] [--enable_iama]
update range --bucket bucket_name --volume volume_name --min min_time --max max_time [--credfile cred_file] [--enable_sas] [--enable_sp] [--enable_iama] [--enable_sts] [--enable_oauth]
update live --bucket bucket_name --volume volume_name --live live_untildate [--credfile cred_file] [--enable_sas] [--enable_sp] [--enable_iama] [--enable_sts] [--enable_oauth]
update inherit --bucket bucket_name --volume volume_name --inherit inherit_value [--credfile cred_file] [--enable_sas] [--enable_sp] [--enable_iama] [--enable_sts] [--enable_oauth]
platform list
platform checkperm [ - bucket bucket-name] [--role role_name]
history list --bucket bucket_name --volume volume_name
history download --bucket bucket_name --volume volume_name --filepath path_name --starttime start_time --endtime end_time --output output_path
--help
create --help
list --help
update mode --help
update range --help
update live --help
support listcv --help
support deletecv --help
lazy-delete enable
lazy-delete disable
lazy-delete update
lazy-delete list
--version
On UNIX systems, the directory path to this command is /usr/openv/pdde/pdcr/bin/
DESCRIPTION
Use the msdpcldutil command to create, update, delete, and list cloud immutable volume for AWS S3 storage, S3-compatible cloud storage, Azure blob storage, and Google storage.
This utility is only supported on Red Hat Linux.
Set the following environment variables before you use msdpcldutil for AWS S3 immutable storage:
export MSDPC_ACCESS_KEY=your_access_key_id export MSDPC_SECRET_KEY=your_secret_key export MSDPC_REGION=your_region export MSDPC_PROVIDER=amazon
MSDPC_ACCESS_KEY is the AWS access key associated with an IAM user. MSDPC_SECRET_KEY is the secret key associated with the access key. MSDPC_REGION is the AWS region where the bucket is created or accessed. MSDPC_PROVIDER is the name of the S3-compatible cloud storage provider.
Set the following environment variables before you use msdpcldutil for S3-compatible cloud storage:
export MSDPC_ACCESS_KEY=your_access_key_id export MSDPC_SECRET_KEY=your_secret_key export MSDPC_REGION=your_region export MSDPC_PROVIDER=s3-compatible export MSDPC_ENDPOINT=your_s3_endpoint_url
In addition to the parameters shown, you can now provide MSDPC_CMS_CRED_NAME to run the msdpcldutil commands for AWS as shown:
export MSDPC_PROVIDER=vamazon export MSDPC_REGION=your_region export MSDPC_CMS_CRED_NAME=your_credential_name export MSDPC_MASTER_SERVER=your_primary server_name export MSDPC_ALIAS=your_storage_server_name_your_alias_name
MSDPC_CMS_CRED_NAME is the credential name provided that stores the credentials.
MSDPC_ALIAS is the cloud alias created using csconfig.
Set the following environment variables before you use msdpcldutil for Azure blob immutable storage:
export MSDPC_ACCESS_KEY=your_storage_account export MSDPC_SECRET_KEY=your_access_key export MSDPC_REGION=your_region export MSDPC_PROVIDER=azure export MSDPC_ENDPOINT=https://your_storage_account.blob.core.windows.net/
Similar to Amazon, you can use MSDPC_CMS_CRED_NAME for Azure storage.
export MSDPC_CMS_CRED_NAME=your_credential_name
Set the following environment variables to configure the proxy settings. The settings include HTTP, HTTPS, SOCKS, and NTLM authentication:
MSDPC_PROXY_URL=[http/https/socks/socks4/socks5/socks4a]://ProxyHost: ProxyPort MSDPC_PROXY_AUTH=NTLM or none MSDPC_PROXY_DOMAIN=$NTLM domain name MSDPC_PROXY_USER=$proxy_user MSDPC_PROXY_PASSWD=$proxy_password
You are not required to set the environment variables if the NetBackup media server is deployed on an Amazon EC2 instance. You can use IAM role-based authentication. An access key, secret key, region, endpoint, and the provider are set automatically.
export MSDPC_ACCESS_KEY= export MSDPC_SECRET_KEY= export MSDPC_REGION= export MSDPC_ENDPOINT= export MSDPC_PROVIDER=
Set the following environment variables before you use msdpcldutil for Google storage:
export MSDPC_PROVIDER=vgoogle export MSDPC_REGION=your_region export MSDPC_ENDPOINT=storage.googleapis.com export MSDPC_MASTER_SERVER=your_primary server_name export MSDPC_ALIAS=your_alias_name export MSDPC_CMS_CRED_NAME=your_credential_name
Use the - enable_sas option with FortKnox Azure and AzureGov storage.
Use the -enable_oauth option with FortKnox Google.
Use the -enable_sts option with FortKnox Amazon and AmazonGov storage.
When you provide this option, the environment variables are used as follows:
MSDPC_ACCESS_KEY is the credential name, not the account name.
MSDPC_ALIAS is the alias of the storage volume that is associated with the credential. MSDPC_MASTER_SERVER is the master server. When you provide these two environment variables, they are used to query the NetBackup CMS for the credentials. In this case, MSDPC_SECRET_KEY is ignored.
If you do not provide MSDPC_ALIAS and MSDPC_MASTER_SERVER, provide MSDPC_ACCESS_TOKEN. It is used to query Recovery Vault directly for the credentials. You can optionally provide MSDPC_RVLT_SERVICE_URI to specify the Recovery Vault service endpoint. It is nrv.veritas.com by default.
If MSDPC_ALIAS, MSDPC_MASTER_SERVER, and MSDPC_ACCESS_TOKEN environment variables are not provided for Recovery Vault that results in an error.
Besides these parameters, you can provide MSDPC_CMS_CRED_NAME directly, which is the credential name.
If you do not set the environment variables and IAM role-based authentication does not exist, msdpcldutil enters interactive mode. You can enter the parameters at the command-line prompt as follows:
Enter Provider id: amazon Enter region: us-east-2 Enter Access key: xxxxxxxxx Enter secret key: Enter Credential Name: primary_server_name Enter alias: primary_server_name_cloud-lsu
Ensure that you previously created the alias with the csconfig command, otherwise this action fails.
Use the -enable_sp option for Service Principal with Azure blob and AzureGov storage. When you provide this option, the environment variables are used as follows:
export MSDPC_CMS_CRED_NAME=your_cms_credential_name export MSDPC_ALIAS=your_alias_name export MSDPC_REGION=your_region export MSDPC_PROVIDER=azure export MSDPC_ENDPOINT=https://your_storage_account.blob.core.windows.net/
MSDPC_CMS_CRED_NAME is the Service Principal credential NetBackup stores in the Credential Management Service.
MSDPC_ALIAS is the name of the alias in the CloudStore. The alias must have the authorization type CREDS_SERVICE_PRINCIPAL. You can view or add aliases using csconfig -instance where the authorization type shows up under creds_broker.
Use the -enable_iama option for IAM Role Anywhere with Amazon and AmazonGov storage. When you provide this option, the environment variables are used as follows:
export MSDPC_CMS_CRED_NAME=your_cms_credential_name export MSDPC_ALIAS=your_alias_name export MSDPC_REGION=your_region export MSDPC_PROVIDER=amazon
MSDPC_CMS_CRED_NAME is the IAM Role Anywhere credential NetBackup stores in the Credential Management Service.
MSDPC_ALIAS is the name of the alias in the CloudStore. The alias must have the authorization type CREDS_IAM_ROLE_ANYWHERE. You can view or add aliases using csconfig -instance where the authorization type shows up under creds_broker.
Use msdpcldutil support deletecv to delete MSDP cloud volume on MSDP storage server, regardless of its immutability status. While deleting, use MSDPC_ACCESS_KEY and MSDPC_SECRET_KEY to set the cloud's password, which has cloud administrator privileges.
If the primary server and the current storage server are not the same computer, you must set MSDPC_MASTER_USER and MSDPC_MASTER_PASSWD to configure the passwords. If you do not set the environment variables, you can resolve this issue by manually entering the passwords instead.
Before deletion, you can use msdpcldutil support listcv to view the detailed information about the volumes. The msdpcldutil support deletecv cloud_clean command deletes all files that are related to this volume in the cloud.
MSDP lazy delete allows you to retain the uploaded data to the cloud for the failed jobs for a certain period. When the failed job is run again, NetBackup tracks the metadata for successfully uploaded data, and uploads only the missing fragments. The MSDP lazy delete is enabled by default. It retains the metadata of failed jobs for 2 days by default. You can update it or disable it by using the msdpcldutil lazy-delete command.
OPTIONS
- --bucket bucket_name, -b bucket_name
The bucket name in AWS S3 and S3 compatible storage or the container name in Azure blob.
- --credfile credfile_path
The credential file that contains the environment variables in the following format:
MSDPC_ACCESS_KEY=your_storage_account MSDPC_SECRET_KEY=your_access_key MSDPC_REGION=your_region MSDPC_PROVIDER=your_provider
- --debug
This option provides a more detailed log for debugging.
- --enable_sas
Shared access signatures (SAS) authentication method on Azure blob storage. The default value is false.
- --enable_sp
Service Principal authentication method using Credential Management Service on Azure blob storage. The default value is false.
- --enable_sts
Security Token Service (STS) authentication method on Amazon storage. The default value is false.
- --enable_oauth
Open authorization method on Google storage. The default value is false.
- --enable_iama
IAM Role Anywhere authentication method on Amazon storage. The default value is false.
- --inherit enable|disable, -i enable|disable
When you switch retention mode from ENTERPRISE mode to COMPLIANCE mode, use the inherit option to specify retention time behavior. You can either inherit the retention time from the ENTERPRISE mode or overwrite it with the new retention time for the COMPLIANCE mode. If you want to inherit the retention time, specify enable. If you want to overwrite the retention time, specify disable.
- --live live_utildate, -l live_utildate
The cloud immutable volume live duration. This value is set as YYYY-MM-DD hh:mm:ss timezone. For a value of noon on August 18, 2025 in UTC, use 2025-08-18 12:00:00 UTC.
- --max max_duration, -M max_duration
The maximum object locking duration: number plus D or Y. The value of 12Y means 12 years.
- --min min_duration, -N min_duration
The minimum object locking duration: number plus D or Y. The value of 12D means 12 days.
- --mode retention_mode, -m retention_mode
The retention mode for the immutable cloud storage. The option has two possible values:
COMPLIANCE mode:
Users cannot overwrite or delete the data that is protected using the compliance mode for the defined retention period. Once you set a retention period for the data storage, you can extend it but cannot shorten it.
ENTERPRISE mode:
Users require special permissions to disable the retention lock and then delete the image. Only the cloud administrator user can disable the retention lock and then the delete the image if required. You can use the enterprise mode to test the retention period behavior before you use compliance mode.
- --storageclass storage_class, -s storage_class
Amazon S3 storage class, such as STANDARD_IA or GLACIER_IR. The default is STANDARD.
For Amazon Recovery Vault, only STANDARD_IA and GLACIER_IR are applicable.
- --userid user_id, -u user_id
The AWS user ID in aws sts get-caller-identity. The default is null. This option is only available for AWS S3 immutable storage.
- --volume volume_name, -v volume_name
The volume name is the directory name under the S3 bucket or the Azure blob container.
EXAMPLES
Example 1: Create a cloud immutable volume.
/usr/openv/pdde/pdcr/bin/msdpcldutil create -b bucketname -v volumename --mode ENTERPRISE --min 1D --max 30D
Example 2: Update the cloud immutable volume mode.
/usr/openv/pdde/pdcr/bin/msdpcldutil update mode -b bucketname -v volumename --mode COMPLIANCE --live 2021-12-31 --inherit enable
Example 3: Update the cloud immutable volume minimum and maximum retention periods.
/usr/openv/pdde/pdcr/bin/msdpcldutil update range -b bucketname -v volumename --min 1D --max 90D
Example 4: Update the cloud immutable volume live duration.
/usr/openv/pdde/pdcr/bin/msdpcldutil update live -b bucketname -v volumename -l 2022-01-31
Example 5: Review the Amazon permissions of the current user.
/usr/openv/pdde/pdcr/bin/msdpcldutil platform checkperm --role backup-admin --bucket bucketname /usr/openv/pdde/pdcr/bin/msdpcldutil platform checkperm --role cloud_admin
Example 6: Enable, disable, and update lazy delete configuration.
/usr/openv/pdde/pdcr/bin/msdpcldutil lazy-delete list -b bucketname /usr/openv/pdde/pdcr/bin/msdpcldutil lazy-delete enable -b bucketname -d 3 /usr/openv/pdde/pdcr/bin/msdpcldutil lazy-delete disable -b bucketname /usr/openv/pdde/pdcr/bin/msdpcldutil lazy-delete update -b bucketname -d 5