Applying WORM locks on DataDomain storage may return with "2060065 WORM invalid max" if there is a time difference between the systems

Problem

Backups to DataDomain give a message of  Failed to set WORM immutable and indelible lock for image:, however the backups themselves are successful

This may happen intermittently and may affect some media servers more than others

Error Message

Detailed status:

Aug 11, 2022 01:00:00 AM - Info bpbrm (pid=12345) validating image for client ClientName
Aug 11, 2022 01:00:00 AM - Info bptm (pid=123456) Applying WORM locks to backupid BackupIdName copy 1 for XXXXX seconds
Aug 11, 2022 01:00:0 AM - Critical bptm (pid=123456) Failed to set WORM immutable and indelible lock for image: BackupIdNameFileName with status: 2060065 WORM invalid max
 

bptm log from media server:

01:00:00.000 [123456.123456] <4> ost_worm_lock_image_copies: Applying WORM locks to backupid BackupIdName copy 1 for XXXXX seconds
01:00:00.000 [123456.123456] <16> 12345:bptm:12345:MediaServer: [588:1B70] ddp_set_retention_time() failed, Path DDPath Err: 5956-nfs setattr failed (nfs: Illegal maximum retention time)
01:00:00.000 [123456.123456] <16> 12345:bptm:12345:MediaServer: C:\Program Files\Veritas\NetBackup\bin\\ost-plugins\libstspiDataDomain.dll:dd_set_image_worm_prop_v12 [STSERR = 2060065] [DDP_ERR= 5956 (Retention time is greater than maximum retention time set on mtree)] [PATH =DDPath ]
01:00:00.000 [123456.123456] <16> bp_sts_worm_lock_image_byname: sts_set_image_worm_prop_byname failed with status : 2060065

Cause

If there is a time difference between the media servers and the storage/master server, the calculated date/time for the WORM lock may differ depending on which media server is used 

If this time difference causes the calculated time to exceed the maximum time configured on the storage, then the DataDomain may return an error of "Illegal maximum retention time"

Details on the Retention lock options for DataDomain storage can be seen on the DataDomain site at  Data Domain: Retention Lock Frequently Asked Questions

Solution

Verify that the time is not out of sync between the master/media servers and the storage, and if it is, ensure that all devices are on the same time (for example, by syncing them with an NTP server)

On media servers, the command nbcertcmd -checkClockSkew can be used to check for any time difference between that media server and the master (if, for example, one media server is affected more than others)

Once the time is in sync between the systems involved, the message should no longer appear