Veritas NetBackup™ Appliance Upgrade Guide

Last Published:
Product(s): Appliances (
Platform: NetBackup Appliance OS

Requirements and best practices for upgrading NetBackup appliances

This topic describes the requirements and best practices that you should follow anytime you plan to upgrade appliance software.

  • Make sure that your appliance environment currently uses software version 3.0, 3.1, 3.1.1, 3.1.2, or 3.2. Only these versions support a direct upgrade to version


    If you plan to upgrade appliances with versions 3.1.2 or 3.2 that have NetBackup RBAC users, after the upgrade has completed, you must download and run the NetBackup 8.3 RBAC Roles Utility. For details, see the following articles:

  • Starting with software version 3.1, you can perform upgrades from the Appliance Management Console. Appliances that use software versions 2.7.3 and 3.0 are also supported for upgrades through the console, if the appropriate EEB is installed before the upgrade. After you review all upgrade guidelines and perform the required pre-upgrade tasks, refer to the Veritas Appliance Management Guide for the upgrade procedure.


    The Appliance Management Console does not currently support upgrading appliances (nodes) in an HA setup. You must use the NetBackup Appliance Shell Menu to upgrade these appliances.

  • Always perform a full disaster recovery (DR) backup before an upgrade.

    • Master servers

      Make sure that you have a recent and complete NetBackup Catalog backup.

    • MSDP and CloudCatalyst configurations

      Make sure to configure your deduplication pool catalog backup policy and perform a successful backup. For details, refer to the following article:

  • Export and re-import IPsec certificates.

    If IPSec functionality is configured on any appliance that you plan to upgrade, the IPsec certificates may not be retained after the upgrade has completed. To avoid this issue, you must export the IPsec certificates before upgrading those appliances. Use the Network > Security > Export command to perform this task. The Export command copies two .pfx files (serialnumber.pfx and .serialnumber.pfx) to a location that you specify when you run the command.

    Export the IPsec certificates before an upgrade as follows:

    • Log in to the NetBackup Appliance Shell Menu and navigate to the following view:

      Network > Security > Export

    • Enter the following export option details:

      Export [EnterPasswd] [PathValue]

      Where [EnterPasswd] is the field used to answer the question, "Do you want to enter a password?". You must enter yes or no.

      Where [PathValue] is the location where you want to place the exported certificates.

    • After the export has completed, back up both of the .pfx files to a non-appliance location.

      After the upgrade has completed, re-import the IPsec certificates.

      See Post upgrade tasks.

  • Delete previously downloaded release updates, client packages, and client add-ons.

    To make sure that there is enough space in the /inst partition during the upgrade, first delete all previously downloaded release updates, client packages, and client add-ons from the appliance. As a best practice, always remove downloaded packages after all appliances and clients have been upgraded.

    If you do not delete the previously downloaded packages and the /inst directory on the appliance does not contain enough space, the preflight check and the Appliance Upgrade Readiness Analyzer tool prevent the upgrade. Even if enough space exists to allow the upgrade to start, the upgrade may fail if the old client add-ons are not removed. For downloaded packages on high availability (HA) nodes, you must remove the packages from both nodes.

    The following describes the package removal methods for appliances that never had version installed:

    NetBackup Appliance Web Console

    NetBackup Appliance Shell Menu

    • On the appliance to be upgraded, select Manage > Software Updates.

    • In the Downloaded Software Updates table, click the radio button to the left of a release update, client package, or client add-on in the list, then click Delete.

    • On the appliance to be upgraded, check for all downloaded release updates and client packages by entering the following command: Manage > Software > List Downloaded.

    • To remove each downloaded release update and client package, enter the following command: Manage > Software > Delete update_name. Where update_name is the release update or the client package file name.

    • To see a list of all downloaded client add-ons, enter the following command: Manage > Software > List AddOns.

    • To remove each downloaded client add-on, enter the following command: Manage > Software > Rollback eeb_name. Where eeb_name is the client add-on file name.


      You must include the .rpm extension when you enter the client add-on file name.


    You must include the .rpm extension when you enter the client add-on file name.

    If the appliance that you want to upgrade has ever had appliance version installed, it requires a different method for client package removal. The client packages for that version remain on the appliance even if it has been upgraded to a later version. If the appliance was purchased with version or if you ever upgraded to version, you must perform the following tasks to delete the client packages. The only exception is if the appliance was re-imaged to a version different than

    To delete version client packages from an appliance:

    • Open a web browser or an SSH session to the Veritas appliance software update release page.

    • Download and install any later version of the client packages onto the appliance.

    • Delete the newly installed client packages from the NetBackup Appliance Shell Menu. This action also deletes the client packages.


      The client packages cannot be deleted from the NetBackup Appliance Web Console.

  • Follow the same upgrade order for appliances as for traditional NetBackup upgrades. If you use NetBackup OpsCenter, upgrade it first. Then upgrade appliances starting with the master server appliance, followed by all media server appliances.

  • If you have multiple media servers to upgrade, you must perform the upgrade process on each individual media server.

    Appliance media servers (nodes) in an HA setup are updated one at a time. Both nodes must use the same appliance software version. Once you have upgraded one node, you must upgrade the other node immediately.

    See About upgrades for NetBackup Appliance HA setups.

  • If a traditional NetBackup master server is used with an appliance media server, that master server must have the same NetBackup version or later as the media server appliance. For example, before you upgrade a media server appliance to version, first upgrade the NetBackup master server to version

    See About corresponding NetBackup software versions .

  • Make sure that the NetBackup master server is active and running throughout the duration of an appliance media server upgrade. In addition, make sure that the NetBackup processes are started or running on both the master server and the media server.


    Only NetBackup services should be active during an upgrade. All jobs must be stopped, suspended, or prevented from running during an upgrade.

  • If you have enabled the STIG feature on an appliance and you need to upgrade it or install an EEB on it, do not plan such installations during the 4:00am - 4:30am time frame. By following this best practice, you can avoid interrupting the automatic update of the AIDE database and any monitored files, which can cause multiple alert messages from the appliance.

  • NetBackup clients must use the same or an earlier software version as the appliance. Clients cannot run at a later version than the appliance. For example, a client with NetBackup version can only be used with an appliance server with version or later. Client add-ons must also be the same as the client version.

    See About corresponding NetBackup software versions .

  • Upgrades to version 3.2 and later using the NetBackup Appliance Shell Menu or the Appliance Management Console (AMS) do not support ECA deployment. After a successful upgrade, you can enable the ECA for NetBackup. For details, see the NetBackup Appliance Commands Reference Guide. Additionally, you can configure the ECA to the appliance infrastructure services such as mongodb, tomcat, and nginx. For details, see the NetBackup Appliance Security Guide.

  • If you plan to upgrade appliance media servers with software version 3.0 that are configured as an Appliance Management Agent (AMA), the preflight check may fail and prevent the upgrade if the NetBackup security level is set to Very high. The following error message appears:

    Error: Preflight check failed, could not get the path for NB_certcmdTool

    To work around this issue, log in to the NetBackup Appliance Shell Menu from the IPMI console to upgrade these appliances.

  • Use a compatible version of the NetBackup Administration Console to manage the NetBackup services.

    The NetBackup Administration Console is backward-compatible. A patch release (x.x.x.x) console is compatible with a major (x.x) or minor NetBackup release (x.x.x) that shares the same first and second digits.