Status 5 during restore of client-side encrypted backup image: unable to find the decryption key in the file

Restore of a NetBackup client fails with Status 5 and in some cases the failure also produces a Status 184 or a Status 24.

 

The following message may also be displayed in the Activity Monitor Detailed Job Status for the restore:

 

10/20/2009 11:49:22 AM -restored image rosvmbmr-03_1256055339 - (tar had an unexpected error(184));restore time 00:00:19
10/20/200911:49:22 AM - Warning bprd(pid=3280) Restore must be resumed prior to firstimage expiration on 11/3/2009 10:15:39AM
10/20/2009 11:49:22 AM - endRestore; elapsed time:00:00:20
10/20/2009 11:49:25 AM -begin reading
10/20/2009 11:49:25 AM- Critical bpbrm(pid=984) from client rosvmbmr-03: FTL - tar had an unexpectederror  
10/20/2009 11:49:26 AM- end reading; read time:00:00:01
the restore failed torecover the requestedfiles(5)
10/20/2009 11:49:33 AM -Error bpbrm(pid=984) client restore EXIT STATUS 184: tar had an unexpectederror  

 

In verbose 5 NetBackup tar logging on the client, the following entries are seen:

 

11:49:25.828 AM: [1560.3472]<4> BufferManagerLegacySharedMemory::loadBlockNumber(): INF - Set CurrentBlock Number = (3).
11:49:25.828 AM:[1560.3472] <16> Encryptor::setDecryptionInfo[2](): ERR -InvalidStateException: Unable to find the decryption key in thefile.
11:49:25.843 AM: [1560.3472]<32> UnpackerTAR::startObject(): FTL - OperationFailedException:startObject operationfailed.
11:49:25.859 AM: [1560.3472]<16> NBUException::traceException():(
An Exception of type[Veritas::NetBackup::Ncf::OperationFailedException] was thrown. Details aboutthe exception follow...:
Errorcode  = (-1008).
Srcfile    =(UnpackerTAR.cpp).
SrcLine    =(378).
Description = (startObjectoperation failed).
Operationtype=(Restore).
)
11:49:25.859AM: [1560.3472] <16> NBUException::traceException():(
An Exception of type[Veritas::NetBackup::Ncf::InvalidStateException] was thrown. Details about theexception follow...:
Errorcode  = (-1001).
Srcfile    =(Encryptor.cpp).
SrcLine    =(944).
Description = (Unable to findthe decryption key in the file).

The above indicates that theNetBackup client's keyfile.dat does not contain the pass-phrase needed for this restore.

The encryption key is located on the client at:

/usr/openv/var/keyfile.dat  (UNIXclient)
<install_path>\Veritas\NetBackup\var\keyfile.dat  (Windows client)

To restore a client-side encrypted backup, the pass-phrase used at backup time is needed for the client being restored to.  This may be missing from the keyfile.dat if this is a restore from a complete system loss or if this is a restore to an alternate client.

To add a passphrase to the keyfile.dat on the client, use the following command (initiated on the client being restored to):

Note:  If this is a redirected restore to an alternate client when a new passphrase is added, all subsequent backups will be encrypted with this newly generated key.  For this reason, before adding a passphrase to another client's keyfile.dat it is advised to make a backup copy of the client's existing keyfile.dat and then add the new passphrase as described below.  After the restore operation, copy the original keyfile.dat file back into place to allow subsequent backups to continue using the original keyfile.dat.

Here are the client-side commands to add a pass-phrase:

Windows:

<install_path>\Veritas\NetBackup\bin\bpkeyutil.exe
Enter new NetBackup pass phrase:**********
Re-enter new NetBackup pass phrase:*** *******

UNIX:

/usr/openv/netbackup/bin/bpkeyutil
Enter new NetBackup pass phrase: **********
Re-enter new NetBackup passphrase: **********



Once the correct key has been added, try the restore once again.