NetBackup™ Upgrade Guide

Last Published:
Product(s): NetBackup (10.2)
  1. Introduction
      About the NetBackup 10.2 Upgrade Guide
      Available NetBackup upgrade methods
    3. About changes in NetBackup 10.2
        About NetBackup database changes
        Windows compiler and security requirements for NetBackup 9.1 and later installation and upgrade
        Java GUI and JRE installation optional for some computers
        Logging directory permissions require reset on rollback
        Upgrades from NetBackup and earlier are not supported
        External certificate authority certificates supported in NetBackup 8.2 and later
      About Veritas Usage Insights
      Best practices for Veritas Usage Insights
  2. Planning for an upgrade
    1. General upgrade planning information
        About planning a NetBackup 10.2 upgrade
        How to plan for an upgrade to NetBackup 10.2
        Legacy logging directory security update
        Notifications, Messages, and Resiliency configuration information are not upgraded
        Known catalog backup limitation
        About security certificates for NetBackup hosts
        About automatic file changes from an upgrade
        Reduce the job database size before upgrade
        Known SUSE Linux primary server upgrade issue
      Performance and tuning considerations
    3. About upgrade tools
        About Veritas Services and Operations Readiness Tools
        Recommended SORT procedures for upgrades
        About the NetBackup preinstall checker
        About the NetBackup database analyzer tool
    4. Upgrade operational notes and limitations
        Creating the user account to support the NetBackup web server
        NetBackup IT Analytics Data Collector installed for NetBackup 10.2
        About NetBackup 10.2 support for Fibre Transport Media Server with RHEL 7.5 and later
        MSDP changes in NetBackup 8.1
        Potential required changes for NetApp clusters
        Errors when Bare Metal Restore information is replicated using Auto Image Replication
        Upgrade issue with pre-8.1 clients and 8.1 or later media servers
  3. Primary server upgrade
      About primary server upgrades
      Preinstall procedure for upgrading to NetBackup 10.2
      Performing local, remote, or clustered server upgrades on Windows systems
      Performing silent upgrades on Windows systems
      Upgrading Linux server software to NetBackup 10.2
      Silently upgrading NetBackup primary server software on Linux
      Post-install procedure for upgrading to NetBackup 10.2
      About NetBackup startup and shutdown scripts
      Completing your system update after an upgrade
  4. Media server upgrade
      Preinstall procedure for upgrading media servers to NetBackup 10.2
      Upgrading NetBackup media servers to NetBackup 10.2
      Silently upgrading NetBackup media server software on Linux
  5. MSDP upgrade for NetBackup
      MSDP upgrade considerations for NetBackup 8.1
      About MSDP rolling data conversion
      About MSDP fingerprinting algorithm changes
  6. Client upgrade
      About client upgrades
      Preinstall procedure for upgrading clients to NetBackup 10.2
      Upgrading UNIX and Linux clients with the NetBackup upgrade script
      Upgrade of the UNIX and Linux client binaries with native installers
  7. NetBackup Deployment Management with VxUpdate
      About VxUpdate
      Commands used in VxUpdate
      Repository management
      Deployment policy management
      Manually initiating upgrades from the primary server using VxUpdate
      Manually initiating upgrades from the media server or client using VxUpdate
      Deployment job status
      New EEB management view
  8. Appendix A. Reference
      NetBackup primary server web server user and group creation
      NetBackup database user
      Generate a certificate on the inactive nodes of a clustered primary server
      About the NetBackup Java Runtime Environment
      Add or Remove Java GUI and JRE after upgrade
      About the NetBackup web user interface
      About the NetBackup answer file
      Manual install or uninstall of the NetBackup IT Analytics Data Collector
      Configure Data Collector manually for NetBackup
      Manually upgrading the Data Collector
      Persistent Java Virtual Machine options
      About RBAC bootstrapping
      About NetBackup software availability
      Additional post-upgrade steps for NetApp clusters
      Using NetApp disk arrays with Replication Director
      About compatibility between NetBackup versions
      Upgrade requirements for UNIX and Linux
      Upgrade requirements for Windows and Windows clusters
      Requirements for Windows cluster upgrades
      Removing a clustered media server by migrating all data to a new media server
      Post upgrade procedures for Amazon cloud storage servers
      Upgrading clients after servers are upgraded
      Upgrade failure rollback steps
      Size guidance for the NetBackup primary server and domain

How to plan for an upgrade to NetBackup 10.2

Several factors must be considered when you prepare for an upgrade to NetBackup 10.2.

Database user, port, and disk space requirements

For Linux environments, the new NetBackup database must have a non-root user for operations. You are prompted for the non-root user if the root user starts the NetBackup daemons. The username must meet the criteria shown:

  • Root accounts are not allowed.

  • Accounts with access to the sudo utility are not allowed.

  • The username must be 1-31 characters.

  • The username must contain only English characters.

  • Do not use the nbwebsvc user as the scale-out database user.

  • For more details, see:

If the NetBackup daemons already start with a non-root user this same account is used to run the NetBackup database.

The new database has a connection pooler service that by default uses port 13787. Confirm that this port is available for database operation before upgrade. Failure to provide valid port numbers renders NetBackup unusable until the port issues are resolved.

If this port is not available, you can change the value with the answer file during a Linux upgrade. The Linux interactive upgrade does not have a prompt. For a Windows primary server, you can change the port value by selecting the Custom installation path during upgrade. More information about the answer file is available:

See About the NetBackup answer file.

During upgrade, additional disk space is required for the conversion. The space is necessary to create the new PostgreSQL databases as well as to store the temporary .dat files. Veritas expects the new database to be approximately the same as the old database. The temporary .dat files require space equivalent to size of the current ASA .db files.

On Linux primary servers, the database files are in the /usr/openv/db/data directory. On Windows primary servers, the database files are in the install_path\Veritas\NetBackupDB\data directory.

Starting NetBackup daemons and services as non-administrative user

New to NetBackup 9.1, you can start most of the NetBackup daemons and services as a non-root user. Veritas recommends that you start the NetBackup services as a non-root user. If you decide to use a less privileged user, you must plan accordingly. Ensure that the user account has access to the paths of disaster recovery files, external certificate authority (ECA) files, and temporary files.

On UNIX and Linux, you see a new prompt during the primary server upgrade. The new prompt asks you to provide a service user, preferably a non-root user. You must create this user in advance and the user must have nbwebgrp as the secondary group.

The service user is used as the database user if it is a non-root account. In this case, you are not prompted for a separate database user.

On Windows, you can use the Local Service built-in account as the service account. This option is available in the Custom upgrade path for primary servers.

You can use the nbserviceusercmd command to change the service user on media servers and clients after the installation completes. Refer to the NetBackup Commands Reference Guide for more information about the nbserviceusercmd command. For more details about the service user account, refer to

On Windows, if services such as the NetBackup Legacy Network Service or the NetBackup Client Service run as an administrator account other than Local System, their Log on as value isn't changed.

Changes to Cloud protection policies

When a user upgrades from a pre-NetBackup 9.1 environment to a NetBackup 9.1 or later environment, changes are made to Cloud protection plans. If the pre-upgrade environment has one protection plan with multiple cloud assets from different cloud provider types, that plan is split into one protection plan per cloud provider type after upgrade. The assets are distributed among the new protection plans based on the cloud provider type. For example, if there was a WeeklyBackups protection plan that contained Amazon, Azure, and Google assets, it is split as shown:

  • WeeklyBackups: Contains only the Amazon assets.

  • WeeklyBackups_azure: Contains only the Azure assets.

  • WeeklyBackups_gcp: Contains only the Google assets.

Media Server Deduplication Pool rolling conversion

The NetBackup 8.1 upgrade includes a rolling conversion of the Media Server Deduplication Pool (MSDP).

By default, the rolling conversion is performed when the system is not busy. In other words, the conversion runs when backups, restores, CRQP, CRC checks, compaction, etc. are not active. This conversion is not expected to affect normal system operations. After the rolling conversion is finished, there is no difference between the converted system and a new installation. More information about the rolling conversion is available.

See MSDP upgrade considerations for NetBackup 8.1.

See About MSDP rolling data conversion.

Specify security administrator for RBAC

If you plan to use role-based access control (RBAC), you must designate a security administrator. More information is available:

See About the NetBackup web user interface.

See NetBackup Web UI Administrator's Guide.

Addition of web service account for NetBackup installation and upgrade

Beginning with NetBackup 8.0, the NetBackup primary server includes a configured Tomcat web server to support critical backup operations. This web server operates under user account elements with limited privileges. These user account elements must be available on each primary server (or each node of a clustered primary server). More information is available:

See NetBackup primary server web server user and group creation.


It is recommended that you save the details of the user account that you use for the NetBackup Web Services. A primary server recovery requires the same NetBackup Web Services user account and credentials that were used when the NetBackup catalog was backed up.


If the NetBackup PBX is running in secure mode, please add the web service user as authorized user in PBX. More information about determining PBX mode and how to correctly add users is available.

Upgrades of Linux clustered NetBackup 8.2 with NAT enabled

Upgrades of NetBackup 8.2 Linux clusters with NAT enabled incorrectly identify the NAT state. As a result, NAT is disabled after the upgrade to 10.2. After you complete the NetBackup 10.2 upgrade, you must turn NAT on again. More information is included in the post-upgrade procedure.

See Post-install procedure for upgrading to NetBackup 10.2.

Move the NetBackup database from any btrfs file systems

Veritas does not support the installation or upgrade of the NetBackup database on a btrfs file system. If the NetBackup database resides on a btrfs file system, move the database to a supported file system (such as ext4 or xfs) before you start the upgrade. The database files reside on the primary server in the directories under /usr/openv/db. More information about moving the database before an upgrade is available. See Preinstall procedure for upgrading to NetBackup 10.2.

Environment variable for certificate key size in upgrades from NetBackup 8.2 and earlier

This information is applicable to NetBackup upgrades of 8.2 and earlier environments.

NetBackup uses security certificates to authenticate NetBackup hosts for secure communication. The security certificates conform to the X.509 Public Key Infrastructure (PKI) standard. A NetBackup primary server acts as the certificate authority (CA) and issues digital certificates to hosts. NetBackup supports the following certificate key sizes: 2048 bits, 3072 bits, 4096 bits, and 8192 bits.

With a NetBackup 9.1 upgrade, new root CA with 2048 bit key strength is deployed. To use a certificate key size larger than 2048 bits, set the NB_KEYSIZE environment variable on the primary server before you start the installation.

For example:


The NB_KEYSIZE can only have the following values: 2048, 3072, 4096, and 8192.


If the FIPS mode is enabled on the primary server, you can only specify 2048 bits or 3072 bits as a value for the NB_KEYSIZE environment variable.


You should carefully choose the key size for your environment. Choosing a large key size may reduce performance. You should consider all factors to determine the correct key size for your environment.

For more information about CA migration and certificate key sizes, see the NetBackup Security and Encryption Guide.

Table: Overview of the upgrade process shows the overview of the upgrade procedure.

Table: Overview of the upgrade process



More information


Review operating system requirements and confirm the computer meets all requirements.

See Upgrade requirements for UNIX and Linux.

See Upgrade requirements for Windows and Windows clusters.

See Requirements for Windows cluster upgrades.


Confirm that the web server user account and group account are created and enabled.

More information is available:

See NetBackup primary server web server user and group creation.


Begin the upgrade process

See About primary server upgrades.