Contents

Dell PowerProtect 19.1 Data Manager Administration And User Guide PDF

1 of 212
1 of 212

Summary of Content for Dell PowerProtect 19.1 Data Manager Administration And User Guide PDF

PowerProtect Data Manager Version 19.1

Administration and User Guide 302-005-718

Rev 02

July 2019

Copyright 2016-2019 Dell Inc. or its subsidiaries. All rights reserved.

Dell believes the information in this publication is accurate as of its publication date. The information is subject to change without notice.

THE INFORMATION IN THIS PUBLICATION IS PROVIDED AS-IS. DELL MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND

WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF

MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. USE, COPYING, AND DISTRIBUTION OF ANY DELL SOFTWARE DESCRIBED

IN THIS PUBLICATION REQUIRES AN APPLICABLE SOFTWARE LICENSE.

Dell Technologies, Dell, EMC, Dell EMC and other trademarks are trademarks of Dell Inc. or its subsidiaries. Other trademarks may be the property

of their respective owners. Published in the USA.

Dell EMC Hopkinton, Massachusetts 01748-9103 1-508-435-1000 In North America 1-866-464-7381 www.DellEMC.com

2 PowerProtect Data Manager Administration and User Guide

9

Getting Started 13 PowerProtect Data Manager software........................................................14 Access the PowerProtect Data Manager UI................................................ 15

Replace the default PowerProtect Data Manager certificate to a self-signed certificate.................................................................... 15 Getting Started.............................................................................. 16 UI tools and options ....................................................................... 17

Managing Users 19 User roles and privileges ............................................................................20

Managing users............................................................................. 20 Default admin user.........................................................................22 Roles............................................................................................. 22 Privileges.......................................................................................25

Reset system generated VM proxy credentials...........................................30 Managing LDAP or AD groups..................................................................... 31 Managing keychains....................................................................................31

Add credentials.............................................................................. 31 LDAP or AD authentication......................................................................... 31

Configuring LDAP or AD authorities and assigning roles................ 32 Example: Configuring an AD authority .......................................... 35 Example: Configuring an LDAP authority....................................... 36 Troubleshooting LDAP configuration issues...................................38

Managing Storage 39 Add protection storage ..............................................................................40 Overview of PowerProtect Data Manager cloud tier................................... 41

Add Data Domain cloud protection storage.................................... 41

Enabling the Microsoft Application Agent for SQL 43 About the Microsoft application agent for SQL.......................................... 44 Install and configure the Microsoft application agent for SQL Server.........44

Prerequisites .................................................................................44 Install the Microsoft application agent...........................................45 Upgrade the Microsoft application agent.......................................47 Uninstall the Microsoft application agent with the setup file..........47 Required privileges for backup and recovery of a stand-alone server ...................................................................................................... 47 Required privileges for backup and recovery of an Always On availability group............................................................................48 Required privileges for backup and recovery of a Failover or Always On Failover Cluster Instance..........................................................48 Stagger SQL discovery jobs in host scale-out environments......... 49

Microsoft SQL Server data protection and replication requirements..........49

Preface

Chapter 1

Chapter 2

Chapter 3

Chapter 4

CONTENTS

PowerProtect Data Manager Administration and User Guide 3

Manage the Microsoft application agent for SQL....................................... 50 Protecting a stand-alone SQL Server..........................................................51 Protecting SQL Server clustered environments.......................................... 51 Support for existing SQL agent backups with PowerProtect Data Manager... 52

Supporting existing SQL agent backups with PowerProtect......... 53 Use the backup discovery tool for PowerProtect Data Manager management of existing backups...................................................53

Enabling the Oracle RMAN Agent 55 About the Oracle RMAN agent...................................................................56 Install and configure the Oracle RMAN agent.............................................56

Install the Oracle RMAN agent...................................................... 56 Upgrade the Oracle RMAN agent.................................................. 58 Uninstall the Oracle RMAN agent...................................................61 Integration with PowerProtect Data Manager software................ 63 Install the PowerProtect Data Manager agent...............................64 Uninstall the PowerProtect Data Manager agent.......................... 66 How the Oracle RMAN agent communicates with PowerProtect Data Manager................................................................................66 Verify the connectivity from ddbmcon........................................... 71 Discover the storage units............................................................. 74

Review Oracle data protection and replication requirements...................... 74 Prerequisites..................................................................................74

Add or manage the Oracle application agent...............................................75 Protecting a stand-alone Oracle server...................................................... 76 Protecting Oracle RAC environments......................................................... 76 Supporting existing Oracle RMAN agent backups with PowerProtect Data Manager..................................................................................................... 77

Support existing Oracle RMAN agent backups with PowerProtect Data Manager................................................................................ 78

Enabling the File System Agent 79 About the File System agent...................................................................... 80 Installing and configuring File System agent...............................................80

Install the File System agent on Linux............................................80 Install the File System agent on Windows ..................................... 81 Silent installation of File System agent...........................................81 Uninstalling the File System agent ................................................82

File System data protection and replication requirements.......................... 82 File System agent prerequisites.....................................................82

Manage the File System agent................................................................... 83 Protecting a File System............................................................................ 84

Managing Assets 87 About asset sources, assets, and storage................................................... 88 Prerequisites for discovering asset sources................................................88 Adding a vCenter Server asset source........................................................88

Add a VMware vCenter Server...................................................... 89 Virtual asset discovery...................................................................90

VM proxy protection engine overview.........................................................91 Add a VM proxy............................................................................. 92 Additional VM proxy actions.......................................................... 93

Discovering an application or File System host ..........................................95

Chapter 5

Chapter 6

Chapter 7

Contents

4 PowerProtect Data Manager Administration and User Guide

Discover an application host.......................................................... 95 Discover a File System Host.......................................................... 96

Managing Protection Policies 97 Protection policies......................................................................................98

Policy retention time considerations..............................................98 Data Domain protection considerations......................................... 98

Before you a create protection policy....................................................... 100 Add a protection policy for virtual machine protection..............................100

On-demand backups of virtual machines......................................105 Additional options for managing virtual machine backups.............105

Add a protection policy for SQL database protection................................105 Add a protection policy for Oracle database protection............................ 109 Add a protection policy for File System protection.................................... 112 Add a Cloud Tier protection policy............................................................. 116 Edit a protection policy.............................................................................. 116 Add or remove assets in a protection policy............................................... 117 Removing expired backup copies............................................................... 118 Export protection ......................................................................................118 Delete a protection policy.......................................................................... 119 Add a Service Level Agreement................................................................. 119 Export Asset Compliance.......................................................................... 122 Dynamic filters ......................................................................................... 123

Creating virtual machine tags in the vSphere Client..................... 123 Add a dynamic filter......................................................................124 Manually run a dynamic filter........................................................125 Edit or delete a dynamic filter ......................................................125 Change the priority of the existing dynamic filter ........................ 126

Restoring Data and Assets 127 View copies............................................................................................... 128 Restore a virtual machine..........................................................................128

Prerequisites to restore a virtual machine.................................... 129 Restore to original........................................................................ 129 Restore to new.............................................................................130 Restore an instant access virtual machine....................................132 File level restore........................................................................... 135 Direct Restore to ESXi................................................................. 137

Restore an application-aware virtual machine backup............................... 138 Performing centralized restore of a File System host................................138

Centralized restore of File Systems in PowerProtect Data Manager .....................................................................................................138

Restore the PowerProtect Data Manager server ..................................... 140 Restore operations for cloud tier...............................................................140

Restore from cloud tier................................................................. 141

Performing Self-service Backup and Restore of Application and File System Agents 143 Performing self-service backups of Microsoft SQL databases.................. 144 Performing self-service backups of Oracle databases............................... 144 Performing self-service backups of File Systems...................................... 145 Restore a SQL application host................................................................. 146 Restore an Oracle application host............................................................146

Chapter 8

Chapter 9

Chapter 10

Contents

PowerProtect Data Manager Administration and User Guide 5

Performing self-service restore of a File System host............................... 147 Using the ddfsadmin utility for File Systems.................................147 Self-service image-level restore of File Systems.......................... 148 Self-service file-level restore of File Systems.............................. 149

Preparing for and Recovering from a Disaster 151 Managing system backups........................................................................ 152 Manage PowerProtect Data Manager backups for disaster recovery........152 Prepare the Data Domain recovery target.................................................153 Configure backups for disaster recovery...................................................153 Configure PowerProtect Data Manager server disaster recovery backups.... 154 Record settings for disaster recovery....................................................... 154 Restore PowerProtect Data Manager from an external Data Domain system ................................................................................................................. 155

Managing Alerts, Jobs, and Tasks 157 Configure Alert Notifications.................................................................... 158 View and manage System Alerts............................................................... 158 View and manage System Alerts............................................................... 159 Monitor jobs and view job details.............................................................. 159 Monitor and view job tasks........................................................................159 Cancel a job or task...................................................................................160 Retry a job or task.....................................................................................160

Best Practices and Troubleshooting 163 Compatibility information.......................................................................... 164 Power off the PowerProtect Data Manager OVA......................................164 Creating a dedicated vCenter user account and assigning the role in vCenter ..................................................................................................................164

Specify the required privileges for a dedicated vCenter user account ....................................................................................... 164

Best practices with the VM Proxy............................................................. 167 Software requirements.................................................................168 PowerProtect Data Manager resource requirements on VMware environment................................................................................. 169 Configuration checklist for common issues.................................. 169 VM Proxy performance and scalability......................................... 170 Increasing the number of instant access sessions......................... 171 Enabling or disabling Changed Block Tracking...............................171 Configure a backup to support vSAN datastores.......................... 172 Disable SSL certification on the vCenter Server...........................172

Troubleshooting backup configuration issues............................................ 173 Troubleshooting virtual machine backup issues......................................... 173

VM Proxy limitations and unsupported features........................... 173 Managing command execution for VM Proxy Agent operations on Linux............................................................................................ 175 SQL Server application-consistent backups fail with error "Unable to find VSS metadata files in directory"....................................... 176 Failed to lock Virtual Machine for backup: Another EMC vProxy operation 'Backup' is active on VM ..............................................176 Windows 2008 R2 VMs may fail to backup with disk.EnableUUID configured to true..................................................................... 176

Chapter 11

Chapter 12

Chapter 13

Contents

6 PowerProtect Data Manager Administration and User Guide

vMotion operations are not allowed during active backup operations .....................................................................................................176 Backups fail if certain characters are used in the virtual machine name, datastore, folder, or datacenter names.............................. 177 Lock placed on virtual machine during backup and recovery operations continues for 24 hours if vProxy appliance fails...........177 Trailing spaces not supported in SQL database names................. 177 SQL databases skipped during virtual machine transaction log backup..........................................................................................177 Accessing Knowledge Base Articles..............................................178

Recover a failed PowerProtect Data Manager backup.............................. 178 Troubleshooting virtual machine restore issues......................................... 179

Troubleshooting instant access restore failures............................ 181 FLR Agent for virtual machine file-level restore............................ 181 Supported platform versions for file-level restore........................ 182 File-level restore and SQL restore limitations............................... 184

Troubleshoot recovery of PowerProtect Data Manager............................ 186 Application agent and File System agent co-existence..............................186 Microsoft application agent for SQL Server application-aware protection.... 188 Troubleshooting Microsoft Application Agent discoveries on Windows 2008 and Application Direct............................................................................... 190 Supporting more than 50 database clients................................................ 190 File System agent limitations..................................................................... 191 Time synchronization required between PowerProtect Data Manager and the systems it interfaces with................................................................... 192 PowerProtect Data Manager allows completion of protection policy when storage unit on the Data Domain cannot be created..................................192 Viewing the DD Boost storage unit password............................................ 193

Modifying the System Settings 195 System settings........................................................................................ 196

Modify the network settings........................................................ 196 Modify the appliance time zone....................................................196 Change the system root user password....................................... 196 Enable replication encryption....................................................... 197 License types............................................................................... 197 PowerProtect Data Manager licenses.......................................... 198

System Support........................................................................................ 198 Register the Secure Remote Services gateway............................199 Callhome .....................................................................................200 Set up the email server................................................................ 201 Add Auto Support........................................................................202 Add a log bundle.......................................................................... 203 Monitor system state and system health..................................... 203 Configure PowerProtect Central reporting..................................206

Upgrade PowerProtect Data Manager .................................................... 206 Managing certificates after upgrading from versions earlier than PowerProtect Data Manager 19.1............................................................. 208 Modifying the PowerProtect Data Manager virtual machine disk settings209

Modify the virtual machine memory configuration.......................209 Modify the data disk size.............................................................209 Modify the system disk size.......................................................... 211

Configure the Data Domain system............................................................211

Chapter 14

Contents

PowerProtect Data Manager Administration and User Guide 7

Contents

8 PowerProtect Data Manager Administration and User Guide

Preface

As part of an effort to improve product lines, periodic revisions of software and hardware are released. Therefore, all versions of the software or hardware currently in use might not support some functions that are described in this document. The product release notes provide the most up-to-date information on product features.

If a product does not function correctly or does not function as described in this document, contact a technical support professional.

Note: This document was accurate at publication time. To ensure that you are using the latest version of this document, go to the Support website https:// www.dell.com/support.

Purpose

This document describes how to install, configure, and administer PowerProtect Data Manager software.

Audience

This document is intended for the host system administrator who is involved in managing, protecting, and reusing data across the enterprise by deploying PowerProtect Data Manager.

Revision history

The following table presents the revision history of this document.

Table 1 Revision history

Revision Date Description

02 July 30, 2019 Added section "Modifying the PowerProtect Data Manager virtual machine disk settings." Updates to the topic "License types" with information on Socket-based licensing, upgrades from release 3.0.0-18, and perpetual versus term-based licenses.

Updates to the tables for "Monitor system component health."

01 July 25, 2019 Initial release of this document for PowerProtect Data Manager 19.1.

Related documentation

The following publications provide additional information:

l PowerProtect Data Manager Administration and User Guide Describes how to configure the software.

l PowerProtect Data Manager Release Notes Contains information on new features, known limitations, environment, and system requirements for the software.

l PowerProtect Data Manager Security Configuration Guide Contains security information.

PowerProtect Data Manager Administration and User Guide 9

You can use the following resources to find more information about this product, obtain support, and provide feedback.

Special notice conventions that are used in this document

The following conventions are used for special notices:

NOTICE Identifies content that warns of potential business or data loss.

Note: Contains information that is incidental, but not essential, to the topic.

Typographical conventions

The following type style conventions are used in this document:

Table 2 Style conventions

Bold Used for interface elements that a user specifically selects or clicks, for example, names of buttons, fields, tab names, and menu paths. Also used for the name of a dialog box, page, pane, screen area with title, table label, and window.

Italic Used for full titles of publications that are referenced in text.

Monospace Used for:

l System code

l System output, such as an error message or script

l Pathnames, file names, file name extensions, prompts, and syntax

l Commands and options

Monospace italic Used for variables.

Monospace bold Used for user input.

[ ] Square brackets enclose optional values.

| Vertical line indicates alternate selections. The vertical line means or for the alternate selections.

{ } Braces enclose content that the user must specify, such as x, y, or z.

... Ellipses indicate non-essential information that is omitted from the example.

You can use the following resources to find more information about this product, obtain support, and provide feedback.

Where to find product documentation

l https://www.dell.com/support

l https://community.emc.com

Where to get support

The Support website https://www.dell.com/support provides access to product licensing, documentation, advisories, downloads, and how-to and troubleshooting information. The information can enable you to resolve a product issue before you contact Support.

To access a product-specific page:

Preface

10 PowerProtect Data Manager Administration and User Guide

1. Go to https://www.dell.com/support.

2. In the search box, type a product name, and then from the list that appears, select the product.

Knowledgebase

The Knowledgebase contains applicable solutions that you can search for either by solution number (for example, KB000xxxxxx) or by keyword.

To search the Knowledgebase:

1. Go to https://www.dell.com/support.

2. On the Support tab, click Knowledge Base.

3. In the search box, type either the solution number or keywords. Optionally, you can limit the search to specific products by typing a product name in the search box, and then selecting the product from the list that appears.

Live chat

To participate in a live interactive chat with a support agent:

1. Go to https://www.dell.com/support.

2. On the Support tab, click Contact Support.

3. On the Contact Information page, click the relevant support, and then proceed.

Service requests

To obtain in-depth help from Licensing, submit a service request. To submit a service request:

1. Go to https://www.dell.com/support.

2. On the Support tab, click Service Requests.

Note: To create a service request, you must have a valid support agreement. For details about either an account or obtaining a valid support agreement, contact a sales representative. To get the details of a service request, in the Service Request Number field, type the service request number, and then click the right arrow.

To review an open service request:

1. Go to https://www.dell.com/support.

2. On the Support tab, click Service Requests.

3. On the Service Requests page, under Manage Your Service Requests, click View All Dell Service Requests.

Online communities

For peer contacts, conversations, and content on product support and solutions, go to the Community Network https://community.emc.com. Interactively engage with customers, partners, and certified professionals online.

How to provide feedback

Feedback helps to improve the accuracy, organization, and overall quality of publications. You can send feedback to DPAD.Doc.Feedback@emc.com.

Preface

PowerProtect Data Manager Administration and User Guide 11

Preface

12 PowerProtect Data Manager Administration and User Guide

CHAPTER 1

Getting Started

This section includes the following topics:

l PowerProtect Data Manager software............................................................... 14 l Access the PowerProtect Data Manager UI....................................................... 15

PowerProtect Data Manager Administration and User Guide 13

PowerProtect Data Manager software PowerProtect Data Manager software is an enterprise solution that provides software-defined data protection, deduplication, operational agility, self-service, and IT governance.

PowerProtect Data Manager enables the transformation from traditional centralized protection to an IT-as-a-service model, based on a self-service design. This design ensures that you can enforce compliance and other business rules, even when backup responsibilities are decentralized to individual database administrators and application administrators.

PowerProtect Data Manager key features include:

l Software-defined data protection with integrated deduplication, replication, and reuse

l Data backup and recovery self-service operations from native applications that are combined with central IT governance

l Multi-cloud optimization with integrated cloud tiering

l SaaS-based management, compliance, and predictive analytics

l Modern services-based architecture for ease of deployment, scaling, and upgrading

PowerProtect Data Manager integrates multiple data protection products within the Dell EMC Data Protection portfolio to enable data protection as a service, providing the following benefits:

l The data protection team can create new data paths with provisioning, automation, and scheduling to embed protection engines into the infrastructure for high-performance backup and recovery.

l For large-scale environments, backup administrators can schedule Microsoft SQL and Oracle backups from a central location on the PowerProtect Data Manager server.

l PowerProtect Data Manager uses an agent-based approach to discover the protected and unprotected databases on an application server.

l PowerProtect Data Manager enables governed self-service and centralized protection by providing the ability to monitor and enforce Service Level Objectives (SLOs), identify violations of Recovery Point Objectives (RPO), and apply retention locks on backups created using the Microsoft application agent and the Oracle RMAN agent.

l PowerProtect Data Manager supports deploying an external VM Proxy appliance, also known as the vProxy appliance, for data movement with the VM Direct Protection engine. The PowerProtect Data Manager software comes pre-bundled with an embedded VM proxy, which is automatically used as a fallback proxy for performing backup and restore operations when the added external proxies fail or are disabled. Dell EMC recommends that you always deploy external proxies because the embedded proxy has limited capacity for performing parallel backups.

Getting Started

14 PowerProtect Data Manager Administration and User Guide

Access the PowerProtect Data Manager UI PowerProtect Data Manager provides a stand-alone UI that you can use to manage and monitor system behavior.

Procedure

1. From a host that has network access to the virtual appliance, use Google Chrome to connect to the appliance:

https://appliance_hostname Note: You can specify the hostname or the IP address of the appliance.

2. Log in with your user name and password.

If you receive an unsigned certificate warning, see Replace the default PowerProtect Data Manager certificate to a self-signed certificate on page 15 for instructions.

The Getting Started page appears.

l The left pane provides links to the available menu items. Expand a menu item for more options.

l The icons in the PowerProtect Data Manager banner provide additional options.

Replace the default PowerProtect Data Manager certificate to a self-signed certificate

Use this procedure to replace the PowerProtect Data Manager UI and public API facing certificates with a new self signed or CA signed certificate.

Before you begin

You must have the following keys and certificates in place:

l /etc/ssl/certificates/customer/customerkey.pem l /etc/ssl/certificates/customer/customer.pem l /etc/ssl/certificates/customer/customer.keystore l /etc/ssl/certificates/customca/customca.truststore Procedure

1. Log in to the PowerProtect Data Manager system as the root user.

Note: PowerProtect Data Manager does not support using the ssh command with the root account. To use ssh to connect to the system and change the password for the root account, log in to ssh with the admin account, and then use the su command to change to the root account.

2. Run the following Unix commands:

cd /usr/local/brs/lib/ecdm-ui/app

ln -s /etc/ssl/certificates/customer/customer.pem cert.pem

ln -s /etc/ssl/certificates/customer/customerkey.pem private- key.pem

Getting Started

PowerProtect Data Manager Administration and User Guide 15

sudo systemctl restart nginx

3. Update the /usr/local/brs/lib/zuul/conf/application.yml file with following parameters:

key-store: Specify the file path where your key-store certificate is kept. For example: /etc/ssl/certificates/customer/customer.keystore key-store-password: Specify a key-store password.

key-password: Specify a key password.

key-alias: Specify a key alias.

trust-store: Specify the file path where your trust-store certificate is kept. For example: /etc/ssl/certificates/customca/customca.truststore trust-store-password: Specify a trust-store password.

4. Carry out the command: zuul restart 5. Log in to the https://ecdm.customer.com instance.

6. When prompted, accept the certificate.

7. Login to https://ecdm.customer.com:8443.

All external requests are now using your installed certificates.

Getting Started The Getting Started page provides configuration options that are required when the system is first deployed.

The Getting Started page appears upon first deployment of PowerProtect Data Manager and opens to this page by default until you click Skip This.

You can access the Getting Started page at any time by selecting System Settings > Getting Started.

Table 3 PowerProtect Data Manager Getting Started menu items

Options Description

Support View and configure Secure Remote Services (SRS), Email Setup, Auto Support, Logs, System Health.

Disaster Recovery Backup

Configure and manage backups for disaster recovery.

VMware vCenter Opens the Infrastructure > Asset Sources page where you can add a vCenter instance as an asset source so that it can be added to a protection policy.

Protect Assets Opens the Protection Policies page where you can manage Protection Life Cycle workflows for all asset types.

Getting Started

16 PowerProtect Data Manager Administration and User Guide

UI tools and options Learn about the available tools in the UI.

PowerProtect Data Manager UI tools

Table 4 PowerProtect Data Manager tools

Menu item Description

Dashboard

Provides a high-level view of the overall state the PowerProtect Data Manager system and includes the following information:

l AlertsSystem alerts

l ProtectionDetails about protection policies

l JobsJob status, including the number of jobs scheduled, currently running, failed, completed successfully, partially completed, and failed. You can click the number next to a status in the Jobs pane to open the Jobs window, where you can drill down to view more details.

l PolicyDetails include number of successes, failures, and excluded assets for each asset type

l Protection StorageProtection storage usage statistics

l RecoveryRecovery statistics

l HealthDetails about the health of the system, including services, licenses, support, protection engines, server backups, and uptime.

PowerProtect Data Manager refreshes the data hourly unless you run an ad-hoc discovery.

Infrastructure

Click Infrastructure to perform the following tasks:

l View and manage Virtual Machine, SQL Database, Oracle Database, and File System assets

l Add vCenter and Application and File System Host asset sources

l View and manage Integrated Storage

l Add a VM Proxy with the VM Proxy protection engine for virtual machine data protection

l Manage registration of RMAN Agent, Microsoft Application Agent, and File System Agent

Protection

Click Protection to perform the following tasks:

l Add protection policy groups to SQL and Oracle databases, File Systems, and Virtual Machines

l Manage SLA

l Add, edit, and delete Dynamic Groups to SQL and Oracle databases, File Systems, and Virtual Machines

Click Recovery to perform the following tasks:

l View asset copy location details and initiate a Restore operation

Getting Started

PowerProtect Data Manager Administration and User Guide 17

Table 4 PowerProtect Data Manager tools (continued)

Menu item Description

Recovery l Manage Instant Access Sessions

Alerts

Click Alerts to perform the following tasks:

l View and acknowledge alerts and events.

l View and drill down to Audit Logs.

l Export audit logs to CSV files.

l Set audit log boundaries.

Administration

Click Administration to perform the following tasks:

l Configure users and roles

l Set password credentials and manage key chains

l Configure alert notifications

l Add LDAP Identity Sources

Jobs

Click Jobs to monitor the status of jobs in progress and drill down to view detailed information.

Reporting

Click Reporting to log in to PowerProtect Central.

Additional UI options

The following table describes the icons located in the PowerProtect Data Manager banner.

Table 5 Additional options

Option Description

Click to see recent alerts.

Click to configure and manage PowerProtect Data Manager system network, time zone and NTP settings, DR backups, security, licenses, upgrades, authentication, agent downloads, and support, and to access the Getting Started page.

Click to log out and log in as a different user.

Click to see PowerProtect Data Manager version information.

Click to obtain more information about PowerProtect Data Manager and how it can help you manage your backup copies.

Getting Started

18 PowerProtect Data Manager Administration and User Guide

CHAPTER 2

Managing Users

This section includes the following topics:

l User roles and privileges ................................................................................... 20 l Reset system generated VM proxy credentials.................................................. 30 l Managing LDAP or AD groups.............................................................................31 l Managing keychains........................................................................................... 31 l LDAP or AD authentication................................................................................. 31

PowerProtect Data Manager Administration and User Guide 19

User roles and privileges Users can be defined as either local or LDAP/Active Directory. Users and LDAP groups can access all protection policies and assets within the PowerProtect Data Manager environment.

The role that is assigned to a user defines the privileges that are are associated with the user and determines the tasks that the user can perform.

Note: User authorization grants or denies access to resources that are managed by PowerProtect Data Manager. User authorization is identical, regardless of whether the user is authenticated locally or by a Microsoft Windows Active Directory/LDAP server.

Managing users Only the Admin role can manage users.

The following roles can view users, roles, identity sources, and user groups:

l Admin

l User

l Export and Recovery Admin

Users can see only their own role within their own account.

Note: User authorization grants or denies users access to PowerProtect Data Manager resources. User authorization is identical, regardless of whether the user was authenticated locally or by a Microsoft Windows Active Directory LDAP server.

You can create local users to perform management tasks. When you create a local user account, you must assign a role to the user.

Add a user You must have administrator credentials to add a user.

Procedure

1. Select Administration > Users.

The Users window appears.

2. Click Add.

3. In the New User window, provide the following information:

l User first name

l User last name

l Username

l Email Address

l Password

l Retype to confirm password

l Force Password ChangeEnabled by default. Requires the user to update the password at first login.

Managing Users

20 PowerProtect Data Manager Administration and User Guide

l Role

4. Click Save.

Results

The newly added user appears in the Users window.

Edit or delete a user You must have administrator credentials to edit or delete a user.

Procedure

1. Select Administration > Users.

The Users window displays the following information:

l Username

l User first name

l User last name

l User email address

l User role

l Date the user was created

2. Select the user you want to edit or delete.

3. Do one of the following:

l To delete the user, click Delete.

l To edit the user, click Edit, modify the user fields, and then click Save.

Results

The changes appear in the Users window.

Reset a password Local users can reset a forgotten password using this procedure.

Before you begin

l The user must be a a local user.

l A reset password mail server must be configured.

l LDAP and Windows Active Directory users cannot reset their password using this procedure. Contact the system administrator to reset your password.

About this task

Local users can receive an email with a link to reset their password. The reset password link in the email expires in 20 minutes, after which time they must request another link.

Procedure

1. In the PowerProtect Data Manager login page, click Forgot Password.

2. In the Forgot Password dialog box, type your user name, click Send Link, and click OK to dismiss the informational dialog box.

The system sends a message to the email address associated with your user name.

Managing Users

PowerProtect Data Manager Administration and User Guide 21

3. Open the email and click the link.

4. In the Reset Password dialog box, type a new password in the New Password and Confirm New Password fields, and click Save.

The PowerProtect Data Manager login page appears.

5. Log in with your user name and new password.

Default admin user The default admin user is preassigned the Admin role during PowerProtect Data Manager installation.

The default admin user has super user control over PowerProtect Data Manager and cannot be deleted. However, you can modify the attributes of the default admin user.

Roles A role defines the privileges and permissions that a user has to perform a group of tasks. When a user is assigned a role, you grant the user all of the privileges that are defined by the role. Only one role can be associated to a user account.

Admin role

Admin

The Admin role is responsible for setup, configuration, and all PowerProtect Data Manager management functions. The Admin role provides systemwide access to all functionality across all organizations. One default Admin role is assigned at PowerProtect Data Manager deployment and installation. You can add and assign additional Admin roles to users in your organization who require full access to the system.

This table outlines the privileges and tasks that are associated with the Admin role.

Table 6 Admin role privileges and tasks

Privileges Tasks

Activity Management l Manage Discovery Jobs

l Manage Tasks

l Workflow Execution

Asset Management l View Data Source Assets

l Manage Data Source Assets

l View Protection Storage Targets

l Manage Protection Storage Targets

Monitoring l Monitor Events

l Manage Events

l View Historical Data

l View Tasks and Activities

Recovery and Reuse Management

l View Host

Managing Users

22 PowerProtect Data Manager Administration and User Guide

Table 6 Admin role privileges and tasks (continued)

Privileges Tasks

l Manage Host

l Rollback to Production

l Recovery to New Location

l Export for Reuse

Service Plan Management

l View Plans

l Manage Plans

l Assign Data Source to Plan

Security and System Audit

l Monitor Security/System Audit

l Manage Security/System Audit

Storage Management l View Storage Array

l Manage Storage Array

l View Inventory Sources

l Manage Inventory Sources

Support Assistance and Log Management

l View Diagnostic Logs

l Manage Diagnostic Logs

System Management l View System Settings

l Manage System Settings

User/Security Management

l Manage User Security

l View User Security

User role

User

The User role is responsible for monitoring the PowerProtect Data Manager Dashboard, Activity Monitor, and Notifications. The User role provides read-only access to monitor activities and operations. Assign the User role to users in your organization who monitor Dashboard activities, Activity Monitor, and Notifications but do not require the ability to configure the system.

This table outlines the privileges and tasks that are associated with the User role.

Table 7 User role privileges and tasks

Privileges Tasks

Activity Management l Workflow Execution

Asset Management l View Data Source Assets

Managing Users

PowerProtect Data Manager Administration and User Guide 23

Table 7 User role privileges and tasks (continued)

Privileges Tasks

l View Protection Storage Targets

Monitoring l Monitor Events

l View Historical Data

l View Tasks and Activities

Recovery and Reuse Management

l View Host

Service Plan Management

l View Plans

Security and System Audit

l Monitor Security/System Audit

Storage Management l View Storage Array

l View Inventory Sources

Support Assistance and Log Management

l View Diagnostic Logs

System Management l View System Settings

User/Security Management

l View User Security

Export and Recovery Admin role

Export and Recovery Admin

The Export and Recovery Admin role is defined for a dedicated set of users who are solely responsible for PowerProtect Data Manager setup, configuration, and execution of data management tasks such as copy export and recovery operations. The Export and Recovery Admin role provides access only to those functions required for data export and recovery operations. This role and its operations are intended for a limited set of users whose actions are solely focused on data management, export, and recovery; and whose actions are audited routinely for security purposes. Assign the Export and Recovery Admin role to a user in your organization that requires access to data only to make it available to others in the organization to maintain a chain of custody record.

This table outlines the privileges and tasks that are associated with the Export and Recovery Admin role.

Table 8 Export and Recovery Admin role privileges and tasks

Privileges Tasks

Activity Management None

Asset Management l View Data Source Assets

l View Protection Storage Targets

Managing Users

24 PowerProtect Data Manager Administration and User Guide

Table 8 Export and Recovery Admin role privileges and tasks (continued)

Privileges Tasks

Monitoring l Monitor Events

l View Historical Data

l View Tasks and Activities

Recovery and Reuse Management

l View Host

l Manage Host

l Rollback to Production

l Recovery to New Location

l Export for Reuse

Service Plan Management

None

Security and System Audit

None

Storage Management l View Storage Array

Support Assistance and Log Management

l View Diagnostic Logs

System Management l View System Settings

User/Security Management

l View User Security

Privileges PowerProtect Data Manager privileges define the tasks that a user can perform and these privileges are assigned to roles.

Activity Management Privileges

This table defines the Activity Management Privileges.

Table 9 Activity Management Privileges

Privilege Task

Manage Discovery Jobs

l Create discovery jobs.

l View discovery jobs.

l Edit discovery jobs.

l Delete discovery jobs.

Manage Task l Create task resources.

l View task resources.

l Edit task resources.

Managing Users

PowerProtect Data Manager Administration and User Guide 25

Table 9 Activity Management Privileges (continued)

Privilege Task

Workflow Execution l Start workflow execution.

l Cancel workflow execution.

l View the status of workflow execution.

Asset Management Privileges

This table defines the Asset Management Privileges.

Table 10 Asset Management Privileges

Privilege Task

Manage Data Source Assets

l Create, read, edit, and delete a data source.

l Create, view, edit, and delete the policy in the protection group resource.

l Create, view, edit, and delete asset group resources.

l Create, view, edit, patch, and delete tag category resources.

Manage Protection Storage Targets

l Create, view, edit, and delete a data target.

l Create, view, edit, and delete asset group resources of protection storage targets.

View Data Source Assets l View a data source.

l View asset group resources.

l View the policy of the protection group resource.

l View tag category resources.

View Protection Storage Targets

l View a data target.

Monitoring Privileges

This table defines the Monitoring Privileges.

Table 11 Monitoring Privileges

Privilege Task

View Tasks or Activities l View task resources.

View Historical Data l View historical data that relates to plans, arrays, data targets, data sources, and capacity data.

Monitor Events l View alerts.

l View external notifications.

Managing Users

26 PowerProtect Data Manager Administration and User Guide

Table 11 Monitoring Privileges (continued)

Privilege Task

Manage Events l Acknowledge alerts and add notes.

l Create, modify, and delete external notifications.

Service Policy Management Privileges

This table defines the Policy Management Privileges.

Table 12 Policy Management Privileges

Privilege Task

Assign Data Source to Policy

l Assign a data source to a protection policy resource.

Manage Policies l Create, view, edit, and delete the policy for a protection policy resource.

l Create, view, edit, and delete a policy definition resource.

l Create, view, edit, and delete schedule resources.

l Create, view, edit, and delete an objective definition resource.

l Create, read, edit, and delete an action definition.

View Policies l View the policy for a protection policy resource.

l View schedule.

l View a protection policy definition.

l View objective definition.

l View services.

l View service resources.

l View assets that are assigned to a protection policy.

l View action definitions.

l View asset group resources.

Recovery and Reuse Management Privileges

This table defines the Recovery and Reuse Management Privileges.

Table 13 Recovery and Reuse Management Privileges

Privilege Task

Export for Reuse l Create, view, edit, and start export and reuse operations.

Roll back to Production

l Create, view, edit, and start rollback to production operations.

Managing Users

PowerProtect Data Manager Administration and User Guide 27

Table 13 Recovery and Reuse Management Privileges (continued)

Privilege Task

Recovery to Alternate Location

l Create, view, edit, and start recovery to alternate location operations.

Manage Host l Create, view, edit and delete a host.

View Host l View a host.

Storage Management Privileges

This table defines the Storage Management Privileges.

Table 14 Storage Management Privileges

Privilege Task

View Inventory Sources

l View a management interface.

l Read storage manager resources such as exported, deleted, and restored copies.

View Storage Array l View a storage array.

Manage Storage Array

l Create, view, edit, and delete a storage array.

Manage Inventory Sources

l Create storage manager resources and run creation-related storage array operations.

l Create exported and restored copies and run restore-related storage array operations.

l Create expunged copies and run deletion-related storage array operations.

l Create, view, edit, and delete a management interface.

Security Management Privileges

This table defines the Security Management Privileges.

Table 15 Security Management Privileges

Privilege Task

Manage User Security l Create, view, edit, and delete users

l View roles

l Create, view, edit, and delete identity sources

l Create, view, edit, and delete user groups

l Create, view, edit, and delete whitelists

Managing Users

28 PowerProtect Data Manager Administration and User Guide

Table 15 Security Management Privileges (continued)

Privilege Task

View User Security l View users and roles

l View identity sources and user groups

l View whitelists

System Management Privileges

This table defines the System Management Privileges.

Table 16 System Management Privileges

Privilege Task

View System Settings l View SRS information.

l View Server Disaster Recovery artifacts.

l View Maintenance Mode.

l View License information.

l View Server Disaster Recovery Status.

l View node, Configuration EULA, OS User, Upgrade Package, Component, Configuration Status, Configuration Logs, Time Zone, and State resources

Manage System Settings

l Manage Server Disaster Recovery activities.

l Manage SRS Gateway connection and other Telemetry communications.

l View and edit Node State resource.

l Update the license for the appliance.

l View Component, Configuration Status, Configuration Logs, Time Zone, and State resources

l View and edit node, Configuration EULA, OS User, and Lockbox resouces.

l Create, view, edit, and delete the Upgrade Package resource

Support Assistance and Log Management Privileges

This table defines the Support Assistance and Log Management Privileges.

Table 17 Support Assistance and Log Management Privileges

Privilege Task

View Diagnostic Logs l View Log bundle resources.

l View Log information resources.

Managing Users

PowerProtect Data Manager Administration and User Guide 29

Table 17 Support Assistance and Log Management Privileges (continued)

Privilege Task

l View the LogSource resource.

l View logs.

Manage Diagnostic Logs

l Manage Log bundle resources.

l Retrieve Log information resources.

l Retrieve or edit the LogSource resource.

l Export logs.

Security and System Audit Privileges

This table defines the Security and System Audit Privileges.

Table 18 Security and System Audit Privileges

Privilege Task

Monitor Security/ System Audit

l View Security Auditrelated events and activities.

Manage Security/ System Audit

l Acknowledge Security Auditrelated events and activities.

l Export Audit/Change Log of events and activities.

Reset system generated VM proxy credentials You must have PowerProtect Data Manager Admin role privileges to edit or delete a user.

About this task

PowerProtect Data Manager deploys the VM proxy during installation with a unique admin and root credentials.

Procedure

1. Select Administration > Credentials.

The Credentials Management window appears and displays the type, name, and username.

2. Select a VM proxy user and click Edit.

3. Modify the password in the Edit Credentials window and click Save.

4. Select Infrastructure > Protection Engines > VM Proxies.

5. Select a VM proxy.

6. Select redeploy from the ellipsis list.

Managing Users

30 PowerProtect Data Manager Administration and User Guide

Managing LDAP or AD groups Only the Admin role can create users or LDAP and AD groups.

Users

You can create local users to perform management tasks. When you create a local user account, you must assign a role to the user.

LDAP or AD groups

When you configure LDAP or AD authentication in the Authentication Service, use the User Group resources to assign roles to the LDAP groups. The User Group resource defines the role assignments for an LDAP or AD user group.

Managing keychains You can create, edit, delete, and view keychain credentials.

Add credentials

About this task

Procedure

1. Select Administration > Credentials > Add.

The Add Credentials window appears.

2. Enter the following information, and then click Save.

l TypeThe type of credential you would like to add

l UsernameThe username associated with the credential you are adding

l PasswordThe password associated with the username

LDAP or AD authentication When you authenticate users through an external authentication authority, users can log in with their authority username and password. The authority username and password are managed by Lightweight Directory Access Protocol (LDAP), Lightweight Directory Access Protocol over SSL (LDAPS), Microsoft Active Directory server (AD), or a Microsoft Active Directory server over SSL.

When the user's credentials are validated, the Authentication Service issues a token for the user. The PowerProtect Data Manager GUI uses the token information to authorize the user's activities.

Note: You can configure only one authority.

Managing Users

PowerProtect Data Manager Administration and User Guide 31

Configuring LDAP or AD authorities and assigning roles Only the Admin role can configure an external LDAP, LDAPS, or AD authentication authority. You can configure LDAP or AD roles in Administration > Identity Sources.

Configure LDAP or Active Directory authentication Only the Admin role can configure an external LDAP, LDAPS, or Active Directory authentication authority.

Procedure

1. Select Administration > Identity Sources.

The Identity Sources window appears.

2. Click New.

The Identity Source Server window appears.

3. In the Required tab, configure the following attributes:

Attribu te

Description

Server Type

Select one:

l Active Directory

l LDAP

Server Address

Type the protocol and hostname or IP address of the LDAP or Active Directory server, in the following format:

protocol://hostname_or_ip_address

where:

l protocol is ldap for LDAP or Active Directory authorities, and ldaps for

LDAPS or Active Directory over SSL. For example, to configure an Active Directory server that is named idd- ad.iddlab.com, type ldap://idd-ad.iddlab.com

l hostname_or_ip_address is the FQDN or IP address of the external authentication authority. For example, ldap://[2620:0:170:5a9::1:2] Note: When you specify the LDAPS protocol, PowerProtect Data Manager automatically downloads the certificates required to connect to the authentication authority. Once downloaded, the Certificate field appears. Click Verify to compare the displayed certificate information with the expected authentication authority's certificate information. If the certificates match, click Accept to continue with the setup. Otherwise, click Cancel to cancel the setup.

Domain Type the base distinguished name (DN) of the LDAP or Active Directory authority. For example, dc=pp_lab, dc=ldap.example.com

Port Type the port number that the external authentication authority uses.

l For LDAP and Active Directory, the default port number is 389.

l For LDAPS and Active Directory over SSL, the default port number is 636.

Managing Users

32 PowerProtect Data Manager Administration and User Guide

Attribu te

Description

User Search

a. Type the objectClass that the authentication service uses when searching for users in the LDAP or AD hierarchy.

b. Ensure that you specify a search path that is relative to the base DN that you specified in the Domain option.

For example:

l For an Active Directory configuration, specify the value in the objectClass property for an AD user. For example, type user.

l For an LDAP configuration, specify the value in the objectClass property. For example, type account.

Group Search

a. Type the objectClass of the search path that you want the authentication service to use when searching for groups in the LDAP or AD hierarchy.

b. Ensure that you specify a search path that is relative to the base DN that you specified in the Domain attribute.

For example:

l For an Active Directory configuration, specify the value in the objectClass property for an AD group. For example, type group.

l For an LDAP configuration, specify the value in the objectClass property for an LDAP group. This value should be a structural objectClass. For example, type group.

Query User

Type a user account that has full read access to the LDAP or AD directory, in the following formats:

l For Active Directory, the format is user@domain, or the DN of the query user.

For example, administrator@ldap.example.com or

cn=administrator,dc=example,dc=com.

l For LDAP, the format is user@domain. For example,

administrator@ldap.example.com.

Query Passwor d

Type the password of the user account that you specified in the Query User attribute.

4. (Optional) In the Advanced tab, configure the following attributes:

Attribu te

Description

User Search Path

Type the DN of the search path that the authentication service uses when searching for users in the LDAP or AD hierarchy. Ensure that you specify a search path that is relative to the base DN that you specified in the Domain option. For example:

l For an AD configuration, specify the value in the objectClass property for an AD user.

l For an LDAP configuration, specify the value in the account object class.

Managing Users

PowerProtect Data Manager Administration and User Guide 33

Attribu te

Description

User Group Search Path

Type the DN of the search path that the authentication service should use when searching for groups in the LDAP or AD hierarchy. Ensure that you specify a search path that is relative to the base DN that you specified in the Domain attribute. For example:

l For an AD configuration, specify the value in the objectClass property for an AD group.

l For an LDAP configuration, specify the value in the posixGroup object class.

Group Attribut e Name

Type the attribute that the authentication service should use to validate the group name in the LDAP or AD hierarchy. For example:

l For an AD configuration, specify sAMAccountName.

l For an LDAP configuration, specify cn.

Group Member Attribut e

Type the attribute that the authentication service should use to validate the group member in the LDAP or AD hierarchy. For example:

l For an AD configuration, specify member.

l For an LDAP configuration, specify memberUid.

User Attribut e ID

Type the attribute that the authentication service should use to validate the username in the LDAP or AD hierarchy. For example:

l For an AD configuration, specify sAMAccountName.

l For an LDAP configuration, specify cn.

5. Click Save.

6. Assign LDAP or AD groups to a role. The section Add LDAP group-to-role mapping on page 35 provides instructions.

This step is required before you can log in to the UI with an LDAP or AD account.

Edit an LDAP or AD authority configuration Only the Admin role can edit an LDAP or AD authority.

Procedure

1. Select Administration > Identity Sources.

2. Select the Identity Source you would like to edit, and then click Edit.

3. Edit the LDAP attributes as required.

4. Click Save.

Delete an LDAP or AD authority configuration Only the Admin role can delete an existing LDAP or AD authority configuration.

Procedure

1. Select Administration > Identity Sources.

Managing Users

34 PowerProtect Data Manager Administration and User Guide

2. Select the Identity Source you would like to delete, and then click Delete.

Add LDAP group-to-role mapping Only the Admin role can add LDAP group-to-role mapping.

Procedure

1. Select Administration > Identity Sources.

2. Select the identity source for which you would like to add group-to-role mapping, and then click New Group Map.

3. Assign the LDAP or AD groups to a role.

4. Click Add.

Modify LDAP group-to-role mapping Only the Admin role can modify LDAP group-to-role mapping.

Procedure

1. Select Administration > Identity Sources.

2. Select the indentity source for which you would like to edit group-to-role mapping, and then click New Group Map.

3. Assign the same LDAP or AD groups to a different role.

4. Click Add.

Delete LDAP group-to-role mapping Only the Admin role can delete LDAP group-to-role mapping.

Procedure

1. Select Administration > Identity Sources.

2. Select the group or group roles you would like to delete, and then click .

Example: Configuring an AD authority In this example, an AD server that is named idd-ad.iddlab.com has an AD group called Protection_admins. Protection_admins contains three users: Meghan, Patrick, and Liam. These users require access to the PowerProtect Data Manager UI with the privileges that are assigned to the User role.

View the properties of the AD configuration

To view the properties of the AD configuration, use a third-party tool such as the AD Explorer program.

The following figure provides an example of the key user attributes on the AD server, which are required to configure idd-ad.iddlab.com.

Managing Users

PowerProtect Data Manager Administration and User Guide 35

Figure 1 AD and user properties in AD Explorer

Based on this AD configuration, specify the following values for PowerProtect Data Manager LDAP configuration options:

l Domain: dc=iddlab, dc=com l Hostname: idd-ad-iddlab.com l User Search: One of the following values: top, inetOrgPerson, or user l User Attribute ID: cn

Configure the idd-ad.iddlab.com authority

The following figure provides an example of the group attributes that are required to configure the idd-ad.iddlab.com authority.

Figure 2 AD group properties in AD Explorer

Based on the properties of Protection_admins, specify the following values for the LDAP configuration options:

l Group Search: top or group l Group Attribute Name: sAMAccountName

Example: Configuring an LDAP authority In this example, an LDAP server that is named alberta.lss.emc.com has a group that is named AlbertaAllGroups. AlbertaAllGroups contains three LDAP users: alberta_user1,

Managing Users

36 PowerProtect Data Manager Administration and User Guide

alberta_user2, and alberta_user3. These users require access to the PowerProtect Data Manager UI with the privileges that are assigned to the User role.

View the LDAP configuration properties

To view the properties of the LDAP configuration, use a third party tool such as the LDAP Admin program.

The following figure provides an example of the key user attributes to use when configuring an LDAP authority.

Figure 3 LDAP Admin server and group attributes

Based on this configuration, specify the following values for the LDAP configuration options:

l Domain: dc=alberta,dc=emc,dc=com l Hostname: alberta.lss.emc.com l Group Search: groupOfUniqueNames.

Note: Only structural object classes may be values for the group search. So, in the example, although top is an object class, only groupOfUniqueNames can be used as a group search value.

l Group Attribute Name: cn

Specify values in the user search attribute

The following figure provides an example of the value to specify in the user search attribute.

Figure 4 LDAP Admin user search attribute

Based on this configuration, specify the following values for the LDAP configuration options:

l User Search: One of the following objectClass values: top, person, organizationalPerson, or inetOrgPerson

Managing Users

PowerProtect Data Manager Administration and User Guide 37

l User Attribute ID: cn

Troubleshooting LDAP configuration issues This section provides information about error messages that might appear when you configure an external authority for authentication.

For more information about LDAP configuration errors, refer to http://wiki.servicenow.com/index.php?title=LDAP_Error_Codes#gsc.tab=0.

User credentials are incorrect

The following message appears when the user credentials that you specified are not correct:

org.springframework.ldaps.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, commentL AcceptSecurityContext error, data 52e, v1db1]

To resolve this issue, ensure that the values in the Query User and Query Password fields are correct.

Base DN is not correct

The following message appears when Base DN is not correct:

org.springframework.ldap.InvalidNameException: Invalid name: domain_name

To resolve this issue, ensure that the value in the Domain field is correct.

Format of the Server Address field is not correct

The following message appears when the format of the Server Address field is not correct:

org.springframework.ldap.UncategorizedLdapException: Uncategorized Exception occurred during LDAP processing; nested exception is javax.naming.NamingException: Cannot parse url: url

To resolve this issue, ensure that you specify the Server Address field in the following format:

l For an LDAP or Active Directory authority: ldap://hostname_ip_address l For an LDAPS or Active Directory over SSL authority: ldaps://

hostname_ip_address

Managing Users

38 PowerProtect Data Manager Administration and User Guide

CHAPTER 3

Managing Storage

This section includes the following topics:

l Add protection storage ..................................................................................... 40 l Overview of PowerProtect Data Manager cloud tier...........................................41

PowerProtect Data Manager Administration and User Guide 39

Add protection storage About this task

The PowerProtect Data Manager UI allows users with administrator credentials to add the following storage types:

l Data Domain Management Center

l External Data Domain system

Procedure

1. Select Infrastructure > Storage.

The Storage window appears.

2. In the Protection Storage tab, click Add.

3. In the Add Storage dialog box, select a storage system (Data Domain System, Data Domain Management Center).

4. Specify the storage system attributes:

a. In the Name field, specify a storage name.

b. In the Address field, specify the hostname, fully qualified domain name (FQDN), or the IP address.

If you specify a virtual machine for the storage name, use the FQDN.

c. In the Port field, specify the port for SSL communication.

5. Under Add Credentials, if you have already configured Data Domain credentials that are common across Data Domain systems, select an existing keychain from the Select Keychain list. Alternatively, you can add new credentials, and then click Save .

Discovery time is based on networking bandwidth. The resources that are discovered and those that are doing the discovery take a performance hit each time that you go through a discovery process. It might appear that PowerProtect Data Manager is not updating the storage data.

6. If a trusted certificate does not exist on the storage system, a dialog box appears requesting certificate approval. Review the certificate and then click Verify.

7. Click Save to exit the Add Storage dialog and initiate the discovery of the storage system.

A dialog box appears to indicate that the request to add storage has been initiated.

Note: Discovery time is based on networking bandwidth. The resources that are discovered and those that are doing the discovery take a performance hit each time that you go through a discovery process. It might appear that PowerProtect Data Manager is not updating the storage data while the discovery is in progress.

PowerProtect Data Manager can add up to three assets of the same type simultaneously and up to 10 assets simultaneously.

8. In the Storage window, click Discover to refresh the window with any newly discovered storage systems.

Managing Storage

40 PowerProtect Data Manager Administration and User Guide

9. To modify a storage system location:

a. In the Storage window, select the storage system from the table.

b. Click Set Location.

The Set Location window appears.

c. Click Location > Add.

The Add Location window appears.

d. In the Name field, type a location name for the asset, and click Save.

10. To manage MTrees in the Storage window, select the storage system from the table and click Manage MTrees.

Results

PowerProtect Data Manager displays External Data Domain systems only in the Storage window Name column. PowerProtect Data Manager displays Data Domain Management Center storage types in the Managed By column.

Overview of PowerProtect Data Manager cloud tier The PowerProtect Data Manager cloud tier feature works in tandem with the Data Domain Cloud Tier feature to move PowerProtect Data Manager backups from Data Domain systems to the cloud. This provides long-term storage of PowerProtect Data Manager backups by seamlessly and securely tiering data to the cloud.

From the PowerProtect Data Manager UI, you configure cloud tier to move PowerProtect Data Manager backups from Data Domain to the cloud, and you can perform seamless recovery of these backups.

Data Domain cloud storage units must be pre-configured on the Data Domain system before they are configured for cloud tier in the PowerProtect Data Manager UI. The Data Domain Operating System Administration Guide provides further information.

Add Data Domain cloud protection storage You can add cloud tier storage by accessing either the physical or virtual Data Domain system.

Procedure

l The "DD cloud tier" chapter of the Data Domain Operating System Version 6.2 Administration Guide, available on Dell EMC Online Support, provides instructions.

Note: If a protection policy has both replication and tiering objectives defined, ensure that replication from any system occurs before tiering. For example, create backups to DD A, replicate from DD A to DD B, and then tier from DD A to Cloud.

Managing Storage

PowerProtect Data Manager Administration and User Guide 41

Managing Storage

42 PowerProtect Data Manager Administration and User Guide

CHAPTER 4

Enabling the Microsoft Application Agent for SQL

This section includes the following topics:

l About the Microsoft application agent for SQL..................................................44 l Install and configure the Microsoft application agent for SQL Server................ 44 l Microsoft SQL Server data protection and replication requirements..................49 l Manage the Microsoft application agent for SQL...............................................50 l Protecting a stand-alone SQL Server................................................................. 51 l Protecting SQL Server clustered environments..................................................51 l Support for existing SQL agent backups with PowerProtect Data Manager...... 52

PowerProtect Data Manager Administration and User Guide 43

About the Microsoft application agent for SQL The Microsoft application agent allows an application administrator to protect and recover the SQL application data on the application host. PowerProtect Data Manager integrates with the Microsoft application agent to check and monitor backup compliance against protection policies. PowerProtect Data Manager also allows central scheduling for backups.

You can install the Microsoft application agent on a Windows SQL Server host by using the install wizard. Install and configure the Microsoft application agent for SQL Server on page 44 provides instructions.

Note: PowerProtect Data Manager supports the co-existence of the Microsoft SQL agent and the File System agent on Windows.

Software compatibility information for the PowerProtect Data Manager software and application agents is provided in the eLab Navigator, available at https:// elabnavigator.emc.com/eln/modernHomeDataProtection.

Install and configure the Microsoft application agent for SQL Server

Learn how to install and configure the Microsoft application agent for SQL Server.

Prerequisites Ensure that a SQL Server environment meets the following prerequisites before you install the Microsoft application agent:

l Install the following applications on the Windows host:

n Microsoft SQL Server

n The SQL Server Management Studio (SSMS)

n .NET Framework 4.0 If you are installing ItemPoint for table-level recovery, install .NET Framework 4.5.

l In the PowerProtect Data Manager UI, select Agent Downloads from the System Settings menu, select the Microsoft application agent download package, msappagent191_win_x64.zip, and then download the package to the Windows SQL Server host.

l Log in to the SQL Server host as an Administrator to install the Microsoft application agent.

l To deploy the Common Language Runtime (CLR) assembly, ensure that you have Administrator access to the SQL Server host and the master database. If the SQL Server host is running in a domain, ensure that you have access as a Domain administrator.

Enabling the Microsoft Application Agent for SQL

44 PowerProtect Data Manager Administration and User Guide

Install the Microsoft application agent Learn how to install the Microsoft application agent.

About this task

Note: In Always On availability group or cluster environments, you must install the Microsoft application agent on each node in the cluster.

Procedure

1. In the PowerProtect Data Manager UI:

a. Select Agent Downloads from the System Settings menu.

b. Select the Microsoft application agent download package, msappagent191_win_x64.zip.

c. Download the package to the host where you want to install the Microsoft application agent.

2. Open msappagent191_win_x64.zip with WinZip.

When you are prompted for a password, type the password that you received with the software license.

3. Use WinZip to unzip the msappagent191_win_x64.zip file.

4. In the unzipped folder, launch emcmsappagent-19.1.0.0.exe.

The installation wizard appears.

5. On the Welcome Wizard page, select I agree to the license term and agreements, and then click Next.

6. On the Change Install Location page, perform one of the following tasks:

l To install the Microsoft application agent in the default folder, leave the installation location as-is.

The default installation folder is C:\Program Files\DPSAPPS \MSAPPAGENT.

l To specify a different installation location, perform the following steps: .

a. Click Change.

b. In the dialog box that appears, specify the installation location.

c. Click OK.

7. Click Next.

8. On the Configure Installation Options page, specify any of the following installation options, as required:

l To integrate the Microsoft application agent with PowerProtect for centralized or self-service protection of SQL Server data, select the following options, as required:

n To install the Microsoft application agent software, select Application Direct.

n To install the SQL Server Management Studio plug-in user interface, select SSMS Plug-in. You can use the SSMS plug-in to perform self-service SQL Server backup and restore operations.

Enabling the Microsoft Application Agent for SQL

PowerProtect Data Manager Administration and User Guide 45

n To enable table-level restores, select ItemPoint. This option installs ItemPoint for Microsoft SQL Server, which you can use to perform table-level restores.

n You must specify the PowerProtect appliance details by performing the following steps:

a. Select PowerProtect Data Manager Integration.

b. In the Appliance Hostname or IP address field, type the hostname or IP address of the PowerProtect server.

Note: Installation of the PowerProtect agent requires port 7000 to be open bidirectionally. This port is required to enable communication between the Microsoft application agent and the PowerProtect appliance.

l To install the VM Proxy Engine to recover application-aware SQL virtual machine backups, select the following options, as required:

Note: By default, when a SQL Server virtual machine is added to a virtual machine application-aware protection policy in PowerProtect Data Manager, the Microsoft application agent and ItemPoint silently install on the protected virtual machine. When you are restoring a VM Proxy Engine backup to an alternate virtual machine that is not part of a protection policy, you must install the Microsoft application agent on the target virtual machine.

n Select VM Proxy Engine. Note: The PowerProtect appliance details are disabled when you select the VM Proxy Engine option.

n To install the SQL Server Management Studio plug-in user interface, select SSMS Plug-in.

n To enable table-level restores, select ItemPoint. This option installs ItemPoint for Microsoft SQL Server, which you can use to perform table-level restores.

9. Click Install >.

10. On the CLR assembly deployment wizard page, perform the following steps:

a. Select or clear the SQL Server instances on which you want to deploy the CLR Assembly. By default, all the SQL Server instances are selected.

b. To deploy CLR Assembly, select one of the following authentication options:

l Current Windows User

l Use Windows Authentication

l Use Database Authentication

c. In the User name and Password fields respectively, type the username and the password of the user who has the privileges to deploy the CLR Assembly.

d. Click Deploy.

e. Click Install.

f. After the deployment completes, click Next.

11. On the Complete the Setup page, click Finish.

Enabling the Microsoft Application Agent for SQL

46 PowerProtect Data Manager Administration and User Guide

Upgrade the Microsoft application agent The Microsoft application agent 19.1 does not support a direct upgrade from an earlier version if you are using an earlier version of PowerProtect Data Manager.

To upgrade to version 19.1, you must uninstall and then reinstall the Microsoft application agent.

The following sections provide instructions:

l Uninstall the Microsoft application agent with the setup file on page 47

l Install the Microsoft application agent on page 45

Uninstall the Microsoft application agent with the setup file About this task

To uninstall the Microsoft application agent for SQL Server with the setup file, perform the following steps.

Procedure

1. Launch emcmsappagent-19.1.0.0.exe.

2. On the Install Modification page, select Remove, and then click Remove.

3. On the Removing the CLR assembly page:

a. Select the required SQL Server instances to remove the CLR Assembly.

By default, all the SQL Server instances are selected.

b. Select one of the following options to remove the CLR assembly:

l Use Windows Authentication

l Use Database Authentication

c. In the User name and Password fields, type the credentials for the user who has the privileges to remove CLR assembly.

d. Click Remove.

e. After the removal completes, click Next.

4. On the Complete the Setup page, click Finish.

Results

The Microsoft application agent is uninstalled.

Required privileges for backup and recovery of a stand-alone server Learn about the user requirements for stand-alone backup and recovery.

Required SQL Server roles

Assign the user the following SQL Server roles:

l sysadmin

l public

Required Windows user permissions

Create a local or domain Windows user account and assign the following roles:

Enabling the Microsoft Application Agent for SQL

PowerProtect Data Manager Administration and User Guide 47

l For table-level backup and recovery, assign administrative privileges.

l For database-level backup and recovery, assign the following permissions:

n Add the user to the "Create global objects" Windows policy

n Assign the following permissions to the data and log folder of the database:

Read

Write

List folder contents

The default data and log folder is the SQL Server installation path. For example, for SQL Server 2012 the default path is C:\Program Files\Microsoft SQL Server\MSSQL12.MSSQLSERVER\MSSQL\

Required privileges for backup and recovery of an Always On availability group

Learn about the user requirements for stand-alone backup and recovery.

Required SQL Server roles

Assign the user the following SQL Server roles:

l sysadmin

l public

Required Windows user permissions

Create a Windows user account with one of the following configurations:

l The built-in Windows Administrator

l A domain user added to the Administrators user group

l A local user account added to the Administrators user group on each node in the cluster. The username and password must be the same on each node.

Note: If you are using an account that you created (an account that is not the built-in Windows Administrator), you must launch the tool where you will perform the backup or recovery with elevated permissions (run as administrator).

Required privileges for backup and recovery of a Failover or Always On Failover Cluster Instance

Learn about the user requirements for Failover Cluster Instance or Always On Failover Cluster Instance backup and recovery.

Required SQL Server roles

Assign the user the following SQL Server roles:

l sysadmin

l public

Required Windows user permissions

Create a Windows user account with one of the following configurations:

l The built-in Windows Administrator

l A domain user added to the Administrators user group

Enabling the Microsoft Application Agent for SQL

48 PowerProtect Data Manager Administration and User Guide

Note: If you are using an account that you created (an account that is not the built-in Windows Administrator), you must launch the tool where you will perform the backup or recovery with elevated permissions (run as administrator).

Stagger SQL discovery jobs in host scale-out environments In the host scale-out environment, where there are large number of SQL hosts to register to PowerProtect Data Manager, consider the following methods for staggering the SQL discovery jobs.

Kick off the installer in smaller group of hosts

If you are installing MS appAgent by script, kick off the installer in smaller groups of hosts. The discovery jobs will kick off after the agent installation; therefore, distributing the installer in smaller groups will help stagger the incoming discovery results to PowerProtect Data Manager.

Stagger the Schedule Discovery in Inventory Sources

When you create an Inventory Sources custom group for SQL, PowerProtect Data Manager sets the default schedule to be disabled. If you choose to enable daily discovery, consider staggering this schedule at different times among different Inventory Sources.

Microsoft SQL Server data protection and replication requirements

PowerProtect Data Manager can manage and monitor data protection and replication for Microsoft SQL Server assets through integration with the Microsoft application agent.

After installing the Microsoft application agent, review the following information for additional requirements before adding the Microsoft application agent as an asset source in PowerProtect Data Manager and discovering the SQL Server assets.

Verify that the environment meets the following requirements:

l Ensure that you do not mix 32-bit and 64-bit instances on the same SQL Server host. PowerProtect Data Manager operations do not support hosts with a mix of 32-bit and 64-bit SQL Server instances.

l Ensure that all clocks on the SQL Server host, domain controller, and PowerProtect Data Manager are time-synced to the local NTP server to ensure discovery of the backups.

l Ensure that the SQL Server and the PowerProtect Data Manager system network can see and resolve each other.

l Ensure that port 7000 is open on the SQL Server host and is bi-directional.

l Ensure that DNS is configured correctly on the Application Agent Host for SQL Server.

Enabling the Microsoft Application Agent for SQL

PowerProtect Data Manager Administration and User Guide 49

Manage the Microsoft application agent for SQL You can add a new Microsoft application agent for SQL data protection, approve and reject pending agent requests, and edit and delete existing agents.

Procedure

1. Go to Infrastructure > Application Agents.

The Application Agents window appears.

2. Click Add.

The Add Application/FS Agent window appears.

3. Select one of the following options:

l Add IP Address or CSV Filename. This process is also called Whitelisting.

n If you select Add IP Address, perform the following steps:

a. Type the IP Address for the application agent.

b. Specify the date until which the application agent is pre-approved.

c. Click Save.

n If you select CSV Filename, perform the following steps:

a. Click the Choose File icon. Note: The contents of the .CSV file must be in the following format, for example:

"10.25.115.113" "10.25.115.112" "10.25.115.145"

The Explorer window appears.

b. Select the .csv file, and then click Open. The file displays in the Application/FS Agents window.

c. Select the date until which the application or File System agent is preapproved.

d. Click Save.

l If you have disabled Auto whitelist, perform the following steps: The Auto whitelist option enabled by default. When Auto whitelist is enabled, all pre-approved Application Agents are automatically approved.

a. Select the wanted application agent.

b. Click one of the following options:

n Approve

n Reject

n Edit, then make the wanted changes.

n Remove

c. Click Save.

Enabling the Microsoft Application Agent for SQL

50 PowerProtect Data Manager Administration and User Guide

After you finish

For application agents, the section Discover an application host describes how to set the host credentials before you schedule a backup.

Protecting a stand-alone SQL Server Learn how to configure protection of a stand-alone SQL Server.

Procedure

1. Add storage for Data Domain Management Console or the External Data Domain.

Add protection storage on page 40 provides information.

2. Install the Microsoft application agent on the SQL Server host.

Install the Microsoft application agent on page 45 provides information.

3. Add or approve the Microsoft application agent in PowerProtect Data Manager.

Manage the Microsoft application agent for SQL on page 50 provides information.

4. Discover and add the credentials for the SQL application host.

Discover an application host on page 95 provides information.

5. Create a protection policy to protect the SQL host.

Add a protection policy for SQL database protection on page 105 provides information.

Note: You cannot perform a backup to a secondary Data Domain device. You can only restore from a secondary Data Domain device

Protecting SQL Server clustered environments Learn how to configure protection of SQL Server clustered environments, including Always On availability groups and Failover Cluster Instances.

About this task

On each node in the cluster. repeat the steps to install the Microsoft application agent, and then add and discover the application host in PowerProtect Data Manager.

NOTICE Protection of Failover Cluster Instances (FCI) requires that all nodes in the cluster be registered to the PowerProtect Data Manager server. Prior to registration, the node must be the active node and own all the disks in the cluster. The recommended method is to failover all nodes to the registering node. Repeat this step for all nodes in the cluster and any nodes added to the cluster. Failure to perform this step results in unpredictable results during protection policy.

Procedure

1. Add a storage system.

Add protection storage on page 40 provides information.

2. Install the Microsoft application agent on each node in the cluster.

Install the Microsoft application agent on page 45 provides information.

Enabling the Microsoft Application Agent for SQL

PowerProtect Data Manager Administration and User Guide 51

3. Configure the required user privileges on each node in the cluster.

Required privileges for backup and recovery of a Failover or Always On Failover Cluster Instance on page 48 provides information.

4. Add or approve the Microsoft application agent on each node in the cluster.

Manage the Microsoft application agent for SQL on page 50 provides information.

5. Discover and add the credentials for each SQL application host.

Discover an application host on page 95 provides information.

6. Create a protection policy to protect the cluster.

Add a protection policy for SQL database protection on page 105 provides information.

Note: You cannot perform a backup to a secondary Data Domain device. You can only restore from a secondary Data Domain device

Support for existing SQL agent backups with PowerProtect Data Manager

The Microsoft application agent 19.1 introduced the capability to onboard existing stand-alone deployments, including their existing backups, to PowerProtect Data Manager. Existing backups are Microsoft application agent backups that you performed before integrating the Microsoft application agent with the PowerProtect Data Manager software and before adding an asset to a PowerProtect Data Manager protection policy.

Note: You can onboard up to three previous months of existing backups.

Retention lock is not supported for discovered existing backups in PowerProtect Data Manager.

Onboarding of DD Boost-over-FC backups is not supported.

With the onboarding capability, PowerProtect provides the following centralized features:

l Visibility of both existing backups and any new self-service or PowerProtect Data Manager policy-driven backups of onboarded assets.

l Automatic configuration of target protection storage based on the PowerProtect Data Manager protection policies that are used for your database.

l All the other functionality that is provided for PowerProtect Data Manager protection policies.

When you create a protection policy, the PowerProtect Data Manager software creates a storage unit on the specified Data Domain backup host that is managed by PowerProtect Data Manager. All subsequent backups will go to this new storage unit. This implementation overrides the backup host and storage unit information that is provided in the script with the backup host and storage unit information that is provided by PowerProtect Data Manager.

Enabling the Microsoft Application Agent for SQL

52 PowerProtect Data Manager Administration and User Guide

Supporting existing SQL agent backups with PowerProtect Learn how to support existing SQL agent backups.

Procedure

1. Upgrade the Microsoft application agent on the SQL Server host.

Upgrade the Microsoft application agent on page 47 provides information.

2. Run the backup discovery tool, AgentBackupDiscovery.exe, to enable management of existing SQL agent backups with PowerProtect.

Use the backup discovery tool for PowerProtect Data Manager management of existing backups on page 53 provides information.

3. Register and approve the Microsoft application agent in PowerProtect Data Manager.

Manage the File System agent on page 83 provides information.

After a few minutes of approving the SQL host, all the old backup copies start to be discovered. Depending on the number of backups, the discovery and subsequent visibility of the backups in PowerProtect Data Manager can take some time. The retention time of the discovered existing backup copies will be equal to the retention time set in the protection policy plus 14 days rounded off to the next day.

4. Discover and add the credentials for the SQL application host.

Discover an application host on page 95 provides information.

5. Create a protection policy to protect the SQL host. For onboarding assets, only a subset of databases can be onboarded. It is not mandatory for all the databases on the host to be onboarded.

Add a protection policy for SQL database protection on page 105 provides information.

The first backup after onboarding must be a full backup:

l The first centralized backup is automatically promoted to a full backup.

l The first self-service backup is automatically performed as a full backup.

Note: You cannot perform a backup to a secondary Data Domain device. You can only restore from a secondary Data Domain device.

6. Perform a self-service backup of the Microsoft SQL databases. Onboarded assets can be part of either a centralized or self-service protection policy.

Performing self-service backups of Microsoft SQL databases on page 144 provides information.

Use the backup discovery tool for PowerProtect Data Manager management of existing backups

To enable the PowerProtect Data Manager management of existing backups after you have upgraded from a previous version of Microsoft application agent, you must run the backup discovery tool, AgentBackupDiscovery.exe. Existing backups are Microsoft application agent backups that you performed before integrating the Microsoft application agent with the PowerProtect Data Manager software.

Enabling the Microsoft Application Agent for SQL

PowerProtect Data Manager Administration and User Guide 53

NOTICE After you run the backup discovery tool, you can continue to use the existing backup scripts to perform the Microsoft application agent backups. Ensure that all the databases backed up with a particular script are added to a single protection policy. By default, the PowerProtect Data Manager overrides the Data Domain details by using the storage unit from the protection policy. If you do not want the Data Domain details to be overridden, use the -a "SKIP_DD_OVERRIDE=TRUE" option in the backup scripts.

To discover the existing backups by using the backup discovery tool, perform the following steps.

1. In the Microsoft application agent installation directory, C:\Program Files \DPSAPPS\MSAPPAGENT\bin, run AgentBackupDiscovery.exe as the administrator.

The Discovery of existing backups dialog box appears.

Note: If the program does not start but displays the following message, an ongoing backup discovery process is running, as invoked by the PowerProtect Data Manager:

Backup discovery is in progress. Please wait for it to complete.

When the discovery process is complete, you can run the backup discovery tool.

2. In the Data Domain system list in the dialog box, select the appropriate Data Domain IP address or hostname, storage unit, and username for the existing backups that you want the PowerProtect Data Manager software to discover.

Note: Select only one storage unit at a time. After discovery is complete for the storage unit, you can run the backup discovery tool again to discover the backups of another storage unit.

3. In the Client hostname field, you can change the client hostname from the default local hostname as needed.

To enable the backup discovery for an AAG or FCI, you must specify the appropriate client hostname:

l If the host is part of an AAG, specify the Windows cluster name.

l If the host is part of a SQL virtual server or FCI, specify the virtual server name.

4. In the Backup discovery time period field, select the number of months for the time period, as the time in the past when the backups were performed. You can select 1 month, 2 months, or 3 months for the time period.

5. After you have specified the required field values, click Generate.

When the PowerProtect Data Manager software completes the generation of the backup metadata or breadcrumbs, the following message appears in the dialog box. Depending on the number of old backups, the generation of breadcrumbs can take some time:

Breadcrumbs generated successfully. The retention time for the discovered backup is calculated as follows:

(Retention time set for the previously performed backup) + (PowerProtect Data Manager retention value) + (padding to midnight), where the PowerProtect Data Manager retention value for older backups is 14 days by default.

Enabling the Microsoft Application Agent for SQL

54 PowerProtect Data Manager Administration and User Guide

CHAPTER 5

Enabling the Oracle RMAN Agent

This section includes the following topics:

l About the Oracle RMAN agent...........................................................................56 l Install and configure the Oracle RMAN agent.................................................... 56 l Review Oracle data protection and replication requirements..............................74 l Add or manage the Oracle application agent...................................................... 75 l Protecting a stand-alone Oracle server.............................................................. 76 l Protecting Oracle RAC environments.................................................................76 l Supporting existing Oracle RMAN agent backups with PowerProtect Data

Manager............................................................................................................. 77

PowerProtect Data Manager Administration and User Guide 55

About the Oracle RMAN agent The Oracle RMAN agent allows an application administrator to protect and recover the Oracle data on the application host. PowerProtect Data Manager integrates with the Oracle RMAN agent to check and monitor backup compliance against protection policies. PowerProtect Data Manager also enables central scheduling for backups.

The Oracle RMAN agent installation is a command-line process whereby the user installs the required Oracle RMAN agent and PowerProtect Data Manager software. PowerProtect Data Manager then sets the Data Domain host, storage unit, user, and password. Install and configure the Oracle RMAN agent on page 56 provides instructions.

Note: PowerProtect Data Manager supports the coexistence of the Oracle RMAN agent and the File System agent on Linux.

Software compatibility information for the PowerProtect Data Manager software and application agents is provided in the eLab Navigator, available at https:// elabnavigator.emc.com/eln/modernHomeDataProtection.

Install and configure the Oracle RMAN agent Learn how to install and configure the Oracle RMAN agent.

Install the Oracle RMAN agent Learn how to install the Oracle RMAN agent on all the Linux database servers that must access the Data Domain system.

About this task

NOTICE You must use the Oracle RMAN agent version 19.1 with PowerProtect Data Manager version 19.1. If a previous version of Oracle RMAN agent is installed, you must upgrade to version 19.1.

Run the install.sh script to install the Oracle RMAN agent 19.1 or to upgrade from an earlier version of the Oracle RMAN agent. The script installs the Oracle RMAN agent in a user-specified directory or in the default installation directory, $HOME/opt/dpsapps/rmanagent.

Run the install.sh -h or install.sh --help command to obtain more information about the script operation.

Complete the following steps to download the Oracle RMAN agent and perform a new installation of the software on Linux.

Note: In a RAC system, you must install the Oracle RMAN agent and PowerProtect Data Manager agent on each node.

Procedure

1. In the PowerProtect Data Manager UI:

a. Select Agent Downloads from Dashboard > System Settings.

b. Select the Oracle RMAN agent download package, ddrman191_linux_x86_64.tar.

c. Download the package to the Oracle server host on Linux.

Enabling the Oracle RMAN Agent

56 PowerProtect Data Manager Administration and User Guide

Note: As an alternative, you can download the Oracle RMAN agent package from the Support website at https://support.emc.com.

2. Change the ownership of the tar file to the oracle user by running the following command:

# chown -R oracle:oinstall ddrman191_linux_x86_64.tar

Uncompress the downloaded tar file using the oracle user by running the following command:

# tar -vxf ddrman191_linux_x86_64.tar

3. Ensure that no backups are running. Stop the RMAN processes before you install the Oracle RMAN agent.

4. As one of the system's Oracle users (recommended), run the install.sh script:

$ install.sh

5. The install.sh script displays the following prompt:

Do you want to install under the default installation directory /home/oracle/opt/dpsapps/rmanagent? (y or n)

Type the appropriate value:

l To install in the default directory, type y.

l To install in a non-default directory that already exists, type n.

The script then prompts you to enter the installation directory pathname:

Enter the full pathname of the installation destination:

Type the pathname of an already created installation directory.

Note: The user-specified installation directory must be a directory that is created specifically for the Oracle RMAN agent 19.1 installation, and must not be the ORACLE_HOME directory. The complete directory pathname must be specified, without a slash (/) at the end.

The install.sh script displays the following output:

The lib directory /home/oracle/opt/dpsapps/rmanagent/lib is created. The config directory /home/oracle/opt/dpsapps/rmanagent/config is created. The bin directory /home/oracle/opt/dpsapps/rmanagent/bin is created. The breadcrumbs directory /home/oracle/opt/dpsapps/rmanagent/ breadcrumbs is created. Installing the Oracle RMAN agent. Copying the lockbox libraries to /home/oracle/opt/dpsapps/ rmanagent/lib/. Copying libddobk.so to /home/oracle/opt/dpsapps/rmanagent/lib/. Copying libDDBoost.so to /home/oracle/opt/dpsapps/rmanagent/

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 57

lib/. Copying ddutil to /home/oracle/opt/dpsapps/rmanagent/bin/. Copying the dependency libraries to /home/oracle/opt/dpsapps/ rmanagent/lib/. Copying the configuration file to /home/oracle/opt/dpsapps/ rmanagent/config/. Copying the ddbmcon program to /home/oracle/opt/dpsapps/ rmanagent/bin/. Creating the lockbox. Successfully installed the Oracle RMAN agent.

6. If ORACLE_HOME is set in the environment, the install.sh script displays the following type of prompt. Type n, as required for a new installation:

The Oracle RMAN agent library, libddobk.so, does not exist in /space/oracle/app/oracle/product/12.1.0/dbhome_1/lib. Do you want to update settings in /space/oracle/app/oracle/ product/12.1.0/dbhome_1 directory so that RMAN scripts from previous installation can be reused? (y or n) n

The installation script exits.

7. To verify the installed version of Oracle RMAN agent, run the following command:

$ /home/oracle/opt/dpsapps/rmanagent/bin/ddutil -i

Upgrade the Oracle RMAN agent An upgrade of the Oracle RMAN agent to version 19.1 requires additional steps when the pre-19.1 Oracle RMAN agent is integrated with Enterprise Copy Data Management (eCDM). In that case, you must also upgrade the eCDM integration to a PowerProtect Data Manager integration.

About this task

Note: If Oracle RMAN agent versions earlier than version 4.0 are installed, refer to the latest PowerProtect Oracle RMAN Agent Administration Guide for information about how to upgrade the pre-4.0 versions.

Procedure

1. To obtain details about the Data Domain hosts and storage units that eCDM or PowerProtect has registered with the Oracle RMAN agent, run the ddutil -s command on the Oracle RMAN agent client host. For example:

ddutil -s

Data Domain Hostname: 10.36.52.98

FC Service Name: None FC Service Enabled: false

Storage Unit: PLC-PROTECTION-1557475568457

User: PLC-PROTECTION-1557475568457 Type: PRIMARY

Enabling the Oracle RMAN Agent

58 PowerProtect Data Manager Administration and User Guide

2. If the pre-19.1 Oracle RMAN agent is integrated with eCDM, perform the following steps to upgrade the eCDM software to PowerProtect Data Manager software:

a. In the eCDM UI menu, select Upgrade under System Settings.

b. To upload the upgrade package, click Upload Package.

The following message appears when the package has been uploaded:

Package uploaded successfully.

c. To run the upgrade process, click Perform Upgrade.

d. When prompted to verify the certificate details and confirm the upgrade, click Yes.

The following message appears when each package component has been upgraded:

State: UPGRADED

3. To stop the eCDM agent on the Oracle RMAN agent client host, run the following command:

/usr/local/ecdm/ecdm-agent/bin/ecdm-agent.bin stop

The following message appears when the eCDM agent is stopped:

eCDM Agent daemon control 'stop' is successful

4. Upgrade the Oracle RMAN agent according to the instructions in Install the Oracle RMAN agent on page 56.

For example, when you run the install.sh script to perform the upgrade, the following type of output appears:

install.sh Do you want to install under the default installation directory /home/oracle/opt/dpsapps/rmanagent? (y or n) y An Oracle RMAN agent already exists. Do you want to continue the installation? (y or n) y Installing the Oracle RMAN agent. Copying the lockbox libraries to /home/oracle/opt/dpsapps/ rmanagent/lib/. Copying libddobk.so to /home/oracle/opt/dpsapps/rmanagent/ lib/. Copying libDDBoost.so to /home/oracle/opt/dpsapps/rmanagent/ lib/. Copying ddutil to /home/oracle/opt/dpsapps/rmanagent/bin/. Copying the dependency libraries to /home/oracle/opt/dpsapps/ rmanagent/lib/. Copying the ddbmcon program to /home/oracle/opt/dpsapps/ rmanagent/bin/. Upgrading the lockbox. Import operation is not needed because the lockbox version is already updated. As a PowerProtect Data Manager user, update the existing Data Domain details? (y or n) y Data Domain server name: 10.36.52.98 Data Domain Storage Unit name: PLC-PROTECTION-1557475568457

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 59

Successfully updated the DD Boost credentials in the lockbox. As a PowerProtect Data Manager user, update the existing Data Domain details? (y or n) n Updated the lockbox. Successfully installed the Oracle RMAN agent. Do you want to uninstall the previous Oracle RMAN agent in /u01/app/oracle/product/12.1.0/dbhome_1 directory? (y or n) y The Oracle RMAN agent is uninstalled. Do you want to update settings in /u01/app/oracle/product/ 12.1.0/dbhome_1 directory so that RMAN scripts from previous installation can be reused? (y or n) y Updating settings in the /u01/app/oracle/product/12.1.0/ dbhome_1 directory. Settings are updated. Installation is completed.

5. If you upgraded the eCDM software to PowerProtect Data Manager software in step 2, perform the following steps to uninstall the eCDM agent and install the PowerProtect agent:

a. To uninstall the eCDM agent, run the rpm -e ecdm- agent-3.0.0-15_1.x86_64 command. For example:

rpm -e ecdm-agent-3.0.0-15_1.x86_64 Uninstalling ecdm-agent... ecdmagent.service - eCDM Agent Service Loaded: loaded (/etc/systemd/system/ecdmagent.service; enabled) :

b. To install the PowerProtect agent, run the rpm -ivh adm- agent-19.1.0.rpm command. For example:

rpm -ivh adm-agent-19.1.0.rpm warning: adm-agent-19.1.0.rpm: Header V3 RSA/SHA1 Signature, key ID 5301dfb7: NOKEY Preparing... ################################# [100%] Updating / installing... 1:adm- agent-19.1.0-1_SNAPSHOT201904############################### ## [100%] Installing adm-agent... 2019/05/10 14:48:56 Adding current path for configurations: /usr/local/ecdm/ecdm-agent/bin 2019/05/10 14:48:56 nameLogfile logfile 2019/05/10 14:48:56 Flags &{ControlAction:install Unregister:false Upgrade:false LogFile:/usr/local/ecdm/ecdm- agent/logs/admagent.log Port:7000 AgentID: ECDMHost: ECDMPort:8443 ECDMScheme:https AppAgentPaths:[]} 2019/05/10 14:48:57 ADM Agent daemon control 'install' is successful

Please run /usr/local/ecdm/ecdm-agent/bin/register.sh to register this system to a Dell EMC PPDM Server. If OS authentication is disabled for one or more Oracle databases on the client, refer to Oracle RMAN agent Administration Guide to use another authentication option for discovery.

Enabling the Oracle RMAN Agent

60 PowerProtect Data Manager Administration and User Guide

6. To register the Oracle RMAN agent to the PowerProtect server, run the register.sh script. For example:

/usr/local/ecdm/ecdm-agent/bin/register.sh 2019/05/10 14:49:25 Adding current path for configurations: /usr/local/ecdm/ecdm-agent/bin 2019/05/10 14:49:25 nameLogfile logfile 2019/05/10 14:49:25 Flags &{ControlAction:stop Unregister:false Upgrade:false LogFile:/usr/local/ecdm/ecdm- agent/logs/admagent.log Port:7000 AgentID: ECDMHost: ECDMPort:8443 ECDMScheme:https AppAgentPaths:[]} 2019/05/10 14:49:25 ADM Agent daemon control 'stop' is successful Enter PowerProtect Data Manager IP/Hostname: blrv136h018.lss.emc.com Enter App Agent Home (press enter for default home /home/ oracle/opt/dpsapps/rmanagent): unregister host 2019/05/10 14:49:35 Adding current path for configurations: /usr/local/ecdm/ecdm-agent/bin : Do you want to set the default retention time for automatic retention management by PowerProtect of existing backups? (y or n) y Provide default retention time in number of days: 2 Allow SYSDBA access for RMAN agent? (y or n) y 2019/05/10 14:49:45 Adding current path for configurations: /usr/local/ecdm/ecdm-agent/bin 2019/05/10 14:49:45 nameLogfile logfile 2019/05/10 14:49:45 Flags &{ControlAction:start Unregister:false Upgrade:false LogFile:/usr/local/ecdm/ecdm- agent/logs/admagent.log Port:7000 AgentID: ECDMHost:blrv136h018.lss.emc.com ECDMPort:8443 ECDMScheme:https AppAgentPaths:[/home/oracle/opt/dpsapps/ rmanagent]} 2019/05/10 14:49:45 ADM Agent daemon control 'start' is successful

7. To complete the upgrade, manually approve the Oracle RMAN agent from the PowerProtect Data Manager server. Manage the File System agent on page 83 provides information.

Uninstall the Oracle RMAN agent Run the uninstall.sh script to uninstall the Oracle RMAN agent 19.1. You can also run the script to uninstall a previous version of the Oracle RMAN agent.

About this task

Run the uninstall.sh -h or uninstall.sh --help command to obtain more information about the script operation.

You can run the uninstall.sh script manually or automatically. To enable the automatic operation, you must set the appropriate environment variables as listed in Table 19 on page 62:

l When the variables are not set, the script runs manually and prompts for the required values.

l When the variables are set, the script runs automatically and performs the uninstallation according to the environment variable settings.

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 61

Table 19 Environment variables for uninstallation of Oracle RMAN agent

Environment variable Description Default and valid values

RMAN_AGENT_HOME Specifies the installation directory for the Oracle RMAN agent.

l /home/oracle1/opt/dpsapps/ rmanagent (default).

l Valid complete pathname of the directory for installation of Oracle RMAN agent.

Note: The directory pathname must not end with a slash (/).

RMAN_AGENT_UNINSTALL_OPTIONS Specifies the software components to uninstall.

l Undefined (default).

l NONE or noneSpecifies to keep the Oracle RMAN agent software, and not perform the uninstallation.

l BINARY or binarySpecifies to uninstall the software, but not the lockbox or the configuration file.

l FULL or fullSpecifies to uninstall the software, lockbox, and configuration file.

Note: It is not necessary to uninstall the Oracle RMAN agent for an upgrade. An existing Oracle RMAN agent is overwritten during an upgrade.

Perform the following steps to uninstall the Oracle RMAN agent.

Procedure

1. Ensure that backup and restore operations are not in progress when you uninstall the Oracle RMAN agent.

2. If you want the uninstallation script to run automatically, ensure that RMAN_AGENT_HOME and RMAN_AGENT_UNINSTALL_OPTIONS are set as described in Table 19 on page 62.

To verify the value of an environment variable, run the echo command. For example:

# echo $RMAN_AGENT_HOME

/home/oracle/opt/dpsapps/rmanagent

To set an environment variable, run the export command. For example:

# export RMAN_AGENT_HOME=/opt/dpsapps/rmanagent

3. As an Oracle user, run the uninstall.sh script:

Note: It is recommended that you set the RMAN_AGENT_HOME environment variable before you run the uninstall.sh script.

# ./uninstall.sh

Enabling the Oracle RMAN Agent

62 PowerProtect Data Manager Administration and User Guide

4. If the script does not run automatically, type the appropriate values at the prompts:

a. When prompted, specify whether you want to enter the directory pathname of the Oracle RMAN agent installation:

An installation directory pathname is not specified. Do you want to enter the installation pathname? (y or n)

If you type y, then the script prompts for the installation location. Type the complete pathname of the installation location, without a slash (/) at the end.

b. When prompted, specify whether you want the lockbox and configuration file to be removed:

Do you want to remove the lockbox and the configuration file? (y or n)

c. If the script detects an additional installation of Oracle RMAN agent, the script prompts whether to uninstall that version. You can specify to keep or uninstall the software.

The script removes the Oracle RMAN agent software and prints the following message:

The Oracle RMAN agent is uninstalled from the /home/ oracle/opt/dpsapps/rmanagent directory. Uninstallation is completed.

Integration with PowerProtect Data Manager software This procedure enables the integration of Oracle RMAN agent with PowerProtect Data Manager, which enables PowerProtect Data Manager to monitor, manage, and analyze the Oracle RMAN agent backups on Linux.

NOTICE PowerProtect Data Manager can create and manage replication copies based on the protection policies.

PowerProtect Data Manager performs these operations whether the backup is created by the DBA or by the PowerProtect Data Manager centralized backup scheduler.

Because PowerProtect Data Manager controls the replication, when the Oracle RMAN agent is deployed with PowerProtect Data Manager, the following self- service replication operations are disabled:

l Creation of multiple backup copies with the RMAN BACKUP COPIES command.

l MTree replication to create backup copies on a secondary Data Domain system.

You can restore from replicated copies of backups that were performed with a previous version of Oracle RMAN agent.

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 63

When you perform a self-service backup managed by PowerProtect Data Manager, the PowerProtect Data Manager protection policy settings for the given database will override the target protection storage settings specified in the RMAN backup script, including the Data Domain server hostname and storage unit name.

1. Install and register the required PowerProtect Data Manager application data management (ADM) agent on the Oracle RMAN agent host as described in Install the PowerProtect Data Manager agent on page 64.

2. Enable the ddbmcon program to connect to the local Oracle databases during PowerProtect Data Manager operations. How the Oracle RMAN agent communicates with PowerProtect Data Manager on page 66 provides details.

3. Verify the connectivity from the ddbmcon program to the Oracle database by using the ddutil program with the required options. Verify the connectivity from ddbmcon on page 71 provides details.

4. Ensure that the /etc/oratab file contains a complete list of all the Oracle SIDs on the host. The Oracle RMAN agent uses the information in the file to discover the database resources on the system, which enables the PowerProtect Data Manager operations.

In an Oracle RAC environment, ensure that the /etc/oratab file contains an entry for each database instance. Manually add any database instance entries that do not yet exist in the file. Each entry must have the following format:

: :

Note: Only with Oracle RAC 12.2 or later, each entry can have the following format:

: :

As recommended by Oracle, ensure that all the archived redo logs in the Oracle RAC environment reside on shared storage or a shared cluster file system that is accessible from all the RAC nodes. Select one node to be the backup node and set the IS_RAC_BACKUP_NODE parameter accordingly, as described in Configuration file requirements for connection to local databases on page 67.

Install the PowerProtect Data Manager agent You must install the PowerProtect Data Manager agent as the root user on the Oracle RMAN host so that the Oracle RMAN agent can communicate with the PowerProtect Data Manager server.

About this task

Note: In a RAC system, you must install the Oracle RMAN agent and PowerProtect Data Manager agent on each node.

Procedure

1. Log in as the root user on the Oracle RMAN host.

Enabling the Oracle RMAN Agent

64 PowerProtect Data Manager Administration and User Guide

2. To install the PowerProtect Data Manager agent, run the following command:

rpm -ivh adm-agent-19.1.0.rpm

warning: adm-agent-19.1.0.rpm: Header V3 RSA/SHA1 Signature, key ID 5301dfb7: NOKEY Preparing... ################################# [100%] Updating / installing... 1:admagent-19.1.0-1_SNAPSHOT201904############################## ### [100%] Installing adm-agent... 2019/05/10 14:48:56 Adding current path for configurations: /usr/local/ecdm/ecdm-agent/bin 2019/05/10 14:48:56 nameLogfile logfile 2019/05/10 14:48:56 Flags &{ControlAction:install Unregister:false Upgrade:false LogFile:/usr/local/ecdm/ ecdmagent/logs/admagent.log Port:7000 AgentID: ECDMHost:ECDMPort:8443 ECDMScheme:https AppAgentPaths:[]} 2019/05/10 14:48:57 ADM Agent daemon control 'install' is successful Please run /usr/local/ecdm/ecdm-agent/bin/register.sh to register this system to a Dell EMC PPDM Server. If OS authentication is disabled for one or more Oracle databases on the client, refer to Oracle RMAN Agent Administration Guide to use another authentication option for discovery.

The adm-agent-19.1.0.rpm file is installed in the /usr/local/ecdm/ ecdm-agent directory.

3. To register the Oracle RMAN agent with the PowerProtect Data Manager server, run the register.sh script:

/usr/local/ecdm/ecdm-agent/bin/register.sh

2019/05/10 14:49:25 Adding current path for configurations: /usr/local/ecdm/ecdm-agent/bin 2019/05/10 14:49:25 nameLogfile logfile 2019/05/10 14:49:25 Flags &{ControlAction:stop Unregister:false Upgrade:false LogFile:/usr/local/ecdm/ ecdmagent/ logs/admagent.log Port:7000 AgentID: ECDMHost: ECDMPort:8443 ECDMScheme:https AppAgentPaths:[]} 2019/05/10 14:49:25 ADM Agent daemon control 'stop' is successful

a. When prompted by the register.sh script, type the hostname or IP address of the PowerProtect Data Manager home:

Enter PowerProtect Data Manager IP/Hostname:

Enabling the Oracle RMAN application agent blrv136h018.lss.emc.com

b. When prompted, type the location of the Oracle RMAN agent installation:

Enter App Agent Home (press enter for default home /home/ oracle/opt/dpsapps/rmanagent):

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 65

c. When prompted, you can set the retention time as the number of days that the PowerProtect Data Manager will retain any backups that already exist on the system:

Do you want to set the default retention time for automatic retention management by PowerProtect of existing backups? (y or n) y Provide default retention time in number of days: 1

d. When prompted, specify whether Oracle OS authentication will use the SYDBDA role when connecting to Oracle. If you type n, then OS authentication will use the SYSBACKUP role:

Allow SYSDBA access for RMAN agent? (y or n) y

The script completes by starting the daemon that connects to PowerProtect Data Manager:

2019/05/10 14:49:45 ADM Agent daemon control 'start' is successful

Uninstall the PowerProtect Data Manager agent You must uninstall the PowerProtect Data Manager agent as the root user on the Oracle RMAN host.

Procedure

1. Log in as the root user on the Oracle RMAN host.

2. Query the Oracle client for an installed adm agent by running the following command:

# rpm -qa | grep adm*

adm-agent-19.1.0-1_SNAPSHOT20190530071531.x86_64

3. If the adm agent exists on the Oracle client, uninstall the adm agent by running the following command:

# rpm -e adm-agent-19.1.0-1_SNAPSHOT20190530071531.x86_64

How the Oracle RMAN agent communicates with PowerProtect Data Manager

The Oracle RMAN agent program ddbmcon handles all communication between the Oracle RMAN agent and PowerProtect Data Manager.

Note: You cannot run the ddbmcon program manually. The program is only run by the PowerProtect Data Manager agent.

When the ddbmcon program performs discovery, backup, or deletion operations, it connects to the Oracle database. The following authentication methods are supported:

Enabling the Oracle RMAN Agent

66 PowerProtect Data Manager Administration and User Guide

1. Database authenticationThe ddbmcon program first tries to connect to the Oracle database instance by using database authentication. The program tries to use the database administrator username and password to connect to the database instance.

2. Oracle wallet authenticationIf database authentication fails or is not enabled, the ddbmcon program tries to connect by using Oracle wallet authentication. The program tries to use the parameter settings from the configuration file to connect to the database instance.

3. Operating system authenticationIf Oracle wallet authentication also fails or is not enabled, the ddbmcon program tries to connect by using operating system authentication. The program tries to change the real process user ID to the Oracle installation user ID, to connect to the database instance.

The ddbmcon program tries all these authentication methods for each Oracle database instance. The program reports a connection error if it cannot connect to the database instance by using any of these methods. If one of these methods succeeds, the ddbmcon program ignores the other authentication methods and proceeds to retrieve the information as used by the PowerProtect Data Manager.

Ensure that you enable one of these three authentication methods for the ddbmcon program. For maximum ease of use, it is recommended that you enable the operating system authentication method. Both the database and Oracle wallet authentication methods require additional configuration steps on the Oracle host and parameter settings in the configuration file rman_agent.cfg.

Configuration file requirements for connection to local databases As required for certain ddbmcon program operations, you must complete the required configuration settings to enable the authentication method that you want the program to use. Each authentication method has its own requirements for parameter settings in the configuration file.

During the Oracle RMAN agent installation, the configuration file template, rman_agent.cfg, is installed in the $RMAN_AGENT_HOME/config directory. To enable a particular authentication method, you must set the required parameters in the rman_agent.cfg configuration file.

The configuration file template includes the following information.

# ############################################################################# # # rman_agent.cfg # # All rights reserved. # # Oracle RMAN agent 19.1 # # This template is designed to help users to configure the authentication of # RMAN agent. Check the product administration guide for a complete list of # all the supported parameters and rules for editing the configuration file. # # Make a copy of this file before making any modifications. # To enable a parameter, uncomment or add the parameter in the file and # specify its value. # # ############################################################################# # # ############################################################################# # Oracle parameters. # There can be repetitive sections of Oracle parameters. The Oracle database # the parameters belong to is described in the section name: SID_name. The

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 67

# name here must be replaced by the SID of the database. # ############################################################################# [SID_name] # ORACLE_SERVICE = # ORACLE_USER = # ORACLE_OS_USER = # TNS_ADMIN = # RMAN_CATALOG_SERVICE = # RMAN_CATALOG_USER = # IS_RAC_BACKUP_NODE =

To set a particular parameter in the configuration file, such as ORACLE_SERVICE, remove the # symbol at the start of the parameter line and add the parameter value after the equal sign (=).

You can complete the following settings in the configuration file:

l SID_name is mandatory for each authentication method when you set any parameters in the file for a particular system ID (SID). [SID_name] (for example, [SID_orcl]) must appear on a separate line before all the parameter settings for the SID:

n For Oracle 10g, 11g, and non-RAC systems, SID_name must match the SID in the /etc/oratab file.

n For Oracle 12c RAC systems, SID_name must match the SID that runs on the local host.

Note: Each Oracle SID on the same system requires its own entries in the configuration file. You must use the same configuration file for all the Oracle SIDs.

l ORACLE_SERVICE is mandatory for database authentication and Oracle wallet authentication. Specifies the TNS or Net service name of the Oracle database.

l ORACLE_USER is mandatory for database authentication only. Specifies the database username as saved in the lockbox.

l ORACLE_OS_USER is mandatory for operating system authentication when the username for connection is different than the ORACLE_OSDBA_USER username. Specifies the operating system user that will connect to the Oracle database for operating system authentication. When this parameter is set, ORACLE_OSDBA_USER is ignored.

l TNS_ADMIN is mandatory for database authentication and Oracle wallet authentication when the Oracle Net configuration files including tnsnames.ora reside in a non-default directory. Specifies the pathname of the non-default directory. When this parameter is not set, the system default directory $ORACLE_HOME/network is used.

l RMAN_CATALOG_SERVICE is mandatory when an RMAN catalog is used for backup or recovery of the database. Specifies the TNS name of the RMAN catalog.

l RMAN_CATALOG_USER is mandatory for each authentication method when an RMAN catalog is used. Specifies the catalog database username as saved in the lockbox.

l IS_RAC_BACKUP_NODE is highly recommended in an Oracle RAC environment only. In the Oracle RAC environment, select a single node to be the backup node and set this parameter to TRUE to specify that the SID_name node is the backup node. Set this parameter to FALSE when the SID_name node is not the backup node.

Enabling the Oracle RMAN Agent

68 PowerProtect Data Manager Administration and User Guide

The following topics provide more details about the configuration requirements of each particular authentication method.

Authentication requirements The following subtopics provide details about the three authentication methods that the ddbmcon program supports.

Database authentication requirements

Before the ddbmcon program can use database authentication to connect to an Oracle database, you must complete the required configuration to enable the database authentication method. Database authentication can be used to connect to a target database or catalog database.

To enable the database authentication method, run the ddutil command with the appropriate options to store the database administrator credentials in the lockbox:

ddutil -C -a USER_TYPE=DATABASE_ADMIN [-a DATABASE_SIDS= ] [-a USERNAME= ]

Note: If the lockbox does not exist when you run the ddutil command, the command creates the lockbox in the default directory.

The options -C and -a USER_TYPE=DATABASE_ADMIN are mandatory. If you do not specify the other -a options, -a DATABASE_SIDS= and -a USERNAME= , the command prompts for the database SIDs and administrator username. The command always prompts for the administrator password.

If multiple databases exist on the system and all use the same administrator username and password, you can add the credentials for all the databases to the lockbox with the same ddutil command. You must specify the database SIDs as a comma- separated list. For example:

ddutil -C -a USER_TYPE=DATABASE_ADMIN

'RMAN_AGENT_HOME' is retrieved from ddutil runtime location as '/ home/oracle/opt/dpsapps/rmanagent' Database SIDs (to a maximum of 19 SIDs): orcl1,orcl2,orcl3,orcl4,orcl5,db1,db2 Database administrator name: SYS Password: xxxxx Re-enter password: xxxxx Successfully set the Oracle database administrator credentials in the lockbox. Enabling the Oracle RMAN application agent.

The following example command includes all the supported -a options:

ddutil -C -a USER_TYPE=DATABASE_ADMIN -a DATABASE_SIDS=orcl1,orcl2,orcl3,orcl4,orcl5,db1,db2 -a USERNAME=SYS

'RMAN_AGENT_HOME' is retrieved from ddutil runtime location as '/ home/oracle/opt/dpsapps/rmanagent' Password: xxxxx

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 69

Re-enter password: xxxxx Successfully set the Oracle database administrator credentials in the lockbox.

To enable the database authentication method, you must also set the following parameters for each required SID in the rman_agent.cfg configuration file:

l Set ORACLE_SERVICE and ORACLE_USER. ORACLE_USER must match the username that is saved in the lockbox.

l If the Oracle Net configuration files reside in a non-default directory, set TNS_ADMIN to the directory pathname.

l If an RMAN catalog is used, set RMAN_CATALOG_SERVICE and RMAN_CATALOG_USER.

For example, the rman_agent.cfg configuration file includes the following settings to enable the database authentication for the database SID orcl:

[SID_orcl] ORACLE_SERVICE = DBFS ORACLE_USER = ORACLE1 TNS_ADMIN = /home/oracle/wallet

To confirm that database authentication is enabled, you can log in as the root user and run the ddutil commands as described in Verify the connectivity from ddbmcon on page 71.

Oracle wallet authentication requirements

Before the ddbmcon program can use Oracle wallet authentication to connect to an Oracle database, you must complete the required configuration to enable the Oracle wallet authentication method. Oracle wallet authentication can be used to connect to a target database or catalog database.

To enable the Oracle wallet authentication method, you must set the following parameters for each required SID in the rman_agent.cfg configuration file:

l Set ORACLE_SERVICE to the TNS or Net service name. For example, set the parameter to the value DBFS.

l If the Oracle Net configuration files reside in a non-default directory, set TNS_ADMIN to the directory pathname.

l If an RMAN catalog is used, set RMAN_CATALOG_SERVICE and RMAN_CATALOG_USER.

For example, the rman_agent.cfg configuration file includes the following settings to enable the Oracle wallet authentication for the database SID orcl:

[SID_orcl] ORACLE_SERVICE = DBFS TNS_ADMIN = /home/oracle/

To confirm that Oracle wallet authentication is enabled, you can log in as the root user and run the ddutil commands as described in Verify the connectivity from ddbmcon on page 71.

Operating system authentication requirements

The operating system authentication method can only be used on systems with a single Oracle home or with multiple Oracle homes that were all installed by the same user. During authentication, the ddbmcon program either obtains the Oracle

Enabling the Oracle RMAN Agent

70 PowerProtect Data Manager Administration and User Guide

installation user ID or reads the operating system username from the rman_agent.cfg configuration file. Then the program changes the real user of the process to the Oracle installation user or the operating system user, to connect to the database instance.

Note: The operating system user specified in the configuration file takes precedence over the Oracle installation user.

When the ddbmcon program uses the authentication method on a system with multiple Oracle homes that were installed by different users, the program returns information for only one Oracle home. The program returns a connection error for the other Oracle homes.

During the backup discovery, the ddbmcon program tries to use the operating system authentication method only after the database authentication and Oracle wallet authentication methods have both failed to connect to the Oracle database.

To enable the operating system authentication method, you must set the following parameters for each required SID in the rman_agent.cfg configuration file:

l If the username to be used for the connection is different than ORACLE_OSDBA_USER, set ORACLE_OS_USER.

l If an RMAN catalog is used, set RMAN_CATALOG_SERVICE and RMAN_CATALOG_USER.

For example, the rman_agent.cfg configuration file includes the following settings to enable the operating system authentication for the database SID orcl:

[SID_orcl] ORACLE_OS_USER = ORACLE1

To confirm that operating system authentication is enabled, you can log in as the root user and run the ddutil commands as described in Verify the connectivity from ddbmcon on page 71.

Verify the connectivity from ddbmcon You can run the ddutil command as the root user with the appropriate -v option to verify the connectivity from the ddbmcon program to the Oracle database.

The following subtopics describe the three supported levels of verification with the ddutil -v command:

l Host verification

l Instance verification

l RMAN verification

Host verification

To perform the host verification, run the ddutil -v host command as the root user.

The ddutil -v host command output includes the Oracle instances found on the system and basic information about each Oracle instance.

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 71

For example, the following ddutil -v host command lists one Oracle instance and the authentication method as database authentication:

ddutil -v host

'RMAN_AGENT_HOME' is retrieved from ddutil runtime location as '/opt/dpsapps/rmanagent'. The ORACLE_HOME environment variable could not be retrieved. Reported application instance: Version: 11.2.0.1.0 Install location: /home/oracer/app/oracer/oracle/product/11.2.0/ db_1 Database identifier: 1040017416 Oracle SID: CER Authentication type: Oracle database user

Instance verification

To perform the instance verification, run the ddutil -v inst command as the root user. The command tests the OCI connection to the database, and provides similar output to the host verification command. In addition, the output lists the database objects that are discovered. You can use the command to determine if the ddbmcon program has the required read access for the database objects.

For example, the following ddutil -v inst command lists one Oracle instance and the database objects. The authentication method is listed as database authentication:

ddutil -v inst

'RMAN_AGENT_HOME' is retrieved from ddutil runtime location as '/opt/dpsapps/rmanagent'. The ORACLE_HOME environment variable could not be retrieved. Reported application instance: Version: 11.2.0.1.0 Install location: /home/oracer/app/oracer/oracle/product/11.2.0/ db_1 Database identifier: 1040017416 Oracle SID: CER Authentication type authentication: Oracle database user

Application instance detailed information: Database name : CER Database object : SYSTEM Database object : SYSAUX Database object : PSAPUNDO Database object : PSAPCER Database object : CATTBS

RMAN verification

To perform the RMAN verification, run the ddutil -v rman command as the root user. This verification is required only if you use an RMAN catalog. Database authentication or Oracle wallet authentication can be used to connect to an RMAN catalog. (Operating system authentication cannot be used with the RMAN catalog.)

The ddutil -v rman command tests whether the ddbmcon program can connect to the target database and catalog database through an RMAN script, as required to perform an active deletion of Oracle backups.

Enabling the Oracle RMAN Agent

72 PowerProtect Data Manager Administration and User Guide

Note: To enable an active deletion through RMAN, the Data Domain credential must be stored in the lockbox.

The ddutil -v rman command displays the following three sections of output for the RMAN verification:

1. Target database connection information:

l Authentication type, listed as operating system user, Oracle database user, or Oracle wallet user.

l For operating system authentication, only the operating system user is listed.

l For database authentication, the operating system user, Oracle service, and database user are listed.

l For Oracle wallet authentication, the Oracle service and TNS_ADMIN value are listed.

2. Catalog database connection information:

l Authentication method, listed as Oracle database user or Oracle wallet user.

l For database authentication, the database service and database user are listed.

l For Oracle wallet authentication, the Oracle service and TNS_ADMIN value are listed.

3. Output of the RMAN script, which shows the connection information and any error messages.

For example, the following ddutil -v rman command displays the three sections of output, showing that the database authentication method is used for both the target database and catalog database:

ddutil -v rman

'RMAN_AGENT_HOME' is retrieved from ddutil runtime location as '/opt/dpsapps/rmanagent'. The ORACLE_HOME environment variable could not be retrieved. Reported RMAN instance connection: Oracle SID: CER

Target database authentication: Oracle database user Oracle OS dba user: oracer Oracle service: CER Oracle database user: system

RMAN catalog authentication: Oracle database user Catalog database service: SAP.world Catalog database user: catowner

RMAN output:

Recovery Manager: Release 11.2.0.1.0 - Production on Fri Dec 15 14:30:15 2017 Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved. RMAN> connect ******** 2> 3> connect ********* 4> 5> connected to target database: CER (DBID=1040017416)

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 73

connected to recovery catalog database Recovery Manager complete

Discover the storage units When a PowerProtect Data Manager protection policy is created, the PowerProtect Data Manager server assigns its storage unit to the Oracle databases that are protected by the protection policy. Both the manual backups and scheduled backups of these Oracle databases are sent to this storage unit.

To display the storage units and their assigned databases on the Oracle RMAN agent host, run the ddutil -s command.

Note: The ddutil -s command might display a storage unit type of "secondary." However, you cannot perform a backup to a secondary device. You can only restore from a secondary device.

For example:

ddutil -s

Data Domain Hostname: 10.36.52.98

FC Service Name: None FC Service Enabled: false

Storage Unit: RMAN87-SS-CT-blrv35a029-a7bc3

User: RMAN87-SS-CT-blrv35a029-a7bc3 Type: PRIMARY

Storage Unit: RMAN87-SS-CT-blrv35b179-c9de5

User: RMAN87-SS-CT-blrv35b179-c9de5 Type: PRIMARY

Review Oracle data protection and replication requirements PowerProtect Data Manager can manage and monitor data protection and replication for Oracle assets through integration with the Oracle RMAN agent.

After installing the Oracle RMAN agent, review the following information for additional requirements before adding the Oracle RMAN agent as an asset source in PowerProtect Data Manager and discovering the agent assets.

Prerequisites Ensure that you meet the required prerequisites before you add an Oracle asset.

Verify that the environment meets the following requirements:

l Ensure that all clocks on both the Oracle host and PowerProtect Data Manager are time-synced to the local NTP server to ensure discovery of the backups.

l Ensure that the Oracle host and the PowerProtect Data Manager network can see and resolve each other.

l Ensure that port 7000 is open on the Oracle host and is bi-directional.

Enabling the Oracle RMAN Agent

74 PowerProtect Data Manager Administration and User Guide

l If you are going to register Oracle RAC nodes to PowerProtect Data Manager, set the db_domain parameter on every RAC node in the RAC database instance:

1. Use sqlplus to log in to your database.

2. Run the command: sqlplus / as sysdba 3. Run the command: show parameters db_domain

The following output is displayed:

NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ db_domain string SQL> alter system set db_domain='admdb' scope=spfile sid='*'; System altered. 1. shutdown immediate; 2. startup;

Add or manage the Oracle application agent You can add a new Oracle application agent, approve and reject pending agent requests, and edit and delete existing agents.

Procedure

1. Go to Infrastructure > Application Agents.

The Application Agents window appears.

2. Click Add.

The Add Application/FS Agent window appears.

3. Select one of the following options:

l Add IP Address or CSV Filename. This process is also called Whitelisting.

n If you select Add IP Address, perform the following steps:

a. Type the IP Address for the application agent.

b. Specify the date until which the application agent is pre-approved.

c. Click Save.

n If you select CSV Filename, perform the following steps:

a. Click the Choose File icon. Note: The contents of the .CSV file must be in the following format, for example:

"10.25.115.113" "10.25.115.112" "10.25.115.145"

The Explorer window appears.

b. Select the .csv file, and then click Open. The file displays in the Application/FS Agents window.

c. Select the date until which the application or File System agent is preapproved.

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 75

d. Click Save.

l If you have disabled Auto whitelist, perform the following steps: The Auto whitelist option enabled by default. When Auto whitelist is enabled, all pre-approved Application Agents are automatically approved.

a. Select the wanted application agent.

b. Click one of the following options:

n Approve

n Reject

n Edit, then make the wanted changes.

n Remove

c. Click Save.

After you finish

For application agents, the section Discover an application host describes how to set the host credentials before you schedule a backup.

Protecting a stand-alone Oracle server Learn how to configure protection of a stand-alone Oracle server.

Procedure

1. Add a storage system.

Add protection storage on page 40 provides information.

2. Install the Oracle RMAN agent on the Oracle server host.

Install the Oracle RMAN agent on page 56 provides information.

3. Add or approve the Oracle RMAN agent in PowerProtect Data Manager.

Add or manage the Oracle application agent on page 75 provides information.

4. Discover and add the credentials for the Oracle application host.

Discover an application host on page 95 provides information.

5. Create a protection policy to protect the Oracle server host.

Add a protection policy for Oracle database protection on page 109 provides information.

Protecting Oracle RAC environments Learn how to configure protection of Oracle RAC environments.

About this task

You must repeat the steps to install the Oracle RMAN agent, and then add and discover the application host in PowerProtect Data Manager on each node in the Oracle RAC environment.

Procedure

1. Add a storage system.

Add protection storage on page 40 provides information.

Enabling the Oracle RMAN Agent

76 PowerProtect Data Manager Administration and User Guide

2. Install the Oracle RMAN agent on each Oracle RAC node.

Install the Oracle RMAN agent on page 56 provides information.

3. Add or approve the Oracle RMAN agent on each Oracle RAC node.

Add or manage the Oracle application agent on page 75 provides information.

4. Discover and add the credentials for each Oracle application host.

Discover an Application Host provides information.

5. Create a protection policy group to protect the Oracle RAC nodes.

Add a protection policy for Oracle database protection on page 109 provides information.

Supporting existing Oracle RMAN agent backups with PowerProtect Data Manager

The Oracle RMAN agent 19.1 introduced the capability to onboard existing stand-alone deployments, including their existing backups, to PowerProtect Data Manager. Existing backups are Oracle RMAN agent backups that you performed before you have integrated the Oracle RMAN agent with the PowerProtect Data Manager software and added an asset to a PowerProtect Data Manager protection policy.

Note: Retention lock is not supported for discovered existing backups in PowerProtect Data Manager.

Onboarding of DD Boost-over-FC backups is not supported.

With the onboarding capability, PowerProtect Data Manager provides the following centralized features:

l Visibility of both existing backups and any new self-service or PowerProtect Data Manager policy-driven backups of onboarded assets.

l Retention management of all backups. The retention time of existing backups can be set during the PowerProtect Data Manager registration.

l Automatic configuration of target protection storage based on the PowerProtect Data Manager protection policies that are used for your database.

l All the other functionality that is provided for PowerProtect Data Manager protection policies.

Self-service operations use the Data Domain backup host and storage unit managed by PowerProtect Data Manager

With Oracle RMAN agent 19.1, you can provide the Data Domain backup host and storage unit in the RMAN scripts. After you use PowerProtect Data Manager to add an asset to the protection policy, you might want to keep using the existing RMAN scripts instead of or along with scheduling backups through PowerProtect Data Manager.

When you create a protection policy, the PowerProtect Data Manager software creates a storage unit on the specified Data Domain backup host that is managed by PowerProtect Data Manager. All subsequent backups will go to this new storage unit. This implementation overrides the backup host and storage unit information that is provided in the script with the backup host and storage unit information that is provided by PowerProtect Data Manager.

Enabling the Oracle RMAN Agent

PowerProtect Data Manager Administration and User Guide 77

Setting and reporting the retention time for existing backups

With Oracle RMAN Agent 19.1, any backups that are performed before you add an asset to a PowerProtect Data Manager protection policy are considered existing backups. You can set the retention time for existing backups during registration with the PowerProtect Data Manager server by using the register.sh script. This retention time is reported to PowerProtect Data Manager during backup discovery.

Note: If a retention time is not specified for existing backups, the backup copies in PowerProtect Data Manager will never expire.

Support existing Oracle RMAN agent backups with PowerProtect Data Manager

Learn how to support existing Oracle RMAN agent backups.

Procedure

1. Upgrade the Oracle RMAN agent on the Oracle server host.

Upgrade the Oracle RMAN agent on page 58 provides information.

2. Register and approve the Oracle RMAN agent in PowerProtect Data Manager.

Manage the File System agent on page 83 provides information.

After a few minutes of approving the Oracle agent, all the old backup copies start to be discovered. Depending on the number of backups, the discovery and subsequent visibility of the backups in PowerProtect Data Manager can take some time. The retention time of the discovered existing backup copies will be equal to the retention time set in the protection policy plus 14 days and 1 day.

3. Discover and add the credentials for the Oracle RMAN agent host.

Discover an application host on page 95 provides information.

4. Create a protection policy to protect the Oracle RMAN agent host.

Add a protection policy for Oracle database protection on page 109 provides information.

The first backup after onboarding must be a full backup:

l The first centralized backup is automatically promoted to a full backup.

l For the first self-service backup after onboarding, the Oracle DBA must run a full backup script.

Note: You cannot perform a backup to a secondary Data Domain device. You can only restore from a secondary Data Domain device.

5. Perform a self-service Application Direct backup of Oracle databases. Onboarded assets can be part of either a centralized or self-service protection policy.

Performing self-service backups of Oracle databases on page 144 provides information.

Enabling the Oracle RMAN Agent

78 PowerProtect Data Manager Administration and User Guide

CHAPTER 6

Enabling the File System Agent

This section includes the following topics:

l About the File System agent.............................................................................. 80 l Installing and configuring File System agent...................................................... 80 l File System data protection and replication requirements..................................82 l Manage the File System agent........................................................................... 83 l Protecting a File System.................................................................................... 84

PowerProtect Data Manager Administration and User Guide 79

About the File System agent The File System agent allows an application administrator to protect and recover data on the file system host. PowerProtect Data Manager integrates with the File System agent to check and monitor backup compliance against protection policies. PowerProtect Data Manager also allows central scheduling for backups.

You can install the File System agent on the host that you plan to protect by using the installation wizard. Installing and configuring File System agent on page 80 provides instructions.

Note: PowerProtect Data Manager supports the co-existence of agents on the same Windows or Linux host for the following:

l Microsoft SQL agent and the File System agent on Windows.

l Oracle/RMAN agent and the File System agent on Linux.

Software compatibility information for the PowerProtect Data Manager software and the File System agent is provided in the eLab Navigator, available at https:// elabnavigator.emc.com/eln/modernHomeDataProtection.

Installing and configuring File System agent Learn how to install and configure the File System agent for Linux and Windows.

Install the File System agent on Linux Learn how to install the File System agent on supported Linux systems.

Before you begin

l Ensure that you carry out the prerequisites provided in File System agent prerequisites on page 82.

l Download the File System agent software package to the Linux host.

Procedure

1. In the PowerProtect Data Manager UI:

a. Select Agent Downloads from the System Settings menu.

b. Select the File System agent download package for Linux, fsagent191_linux_x86_64.tar.gz.

c. Download the package in the location that you want to install the File System agent.

2. Untar the installer by running - gunzip * followed by tar -xvf .

3. Run the installation script: install.sh Three installation rpms are installed as part of the installation script.

4. Enter the PowerProtect Data Manager server IP address.

After you finish

If the host is not already whitelisted or approved, add the File System host to the PowerProtect Data Manager server. Add or manage Application/File System Agents provides more information.

Enabling the File System Agent

80 PowerProtect Data Manager Administration and User Guide

Discover File System assets. Discover a File System Host provides more information.

Install the File System agent on Windows Learn how to install the File System agent on supported Windows systems.

Before you begin

l Ensure that you carry out the prerequisites provided in File System agent prerequisites on page 82.

l Download the File System agent software package.

Procedure

1. In the PowerProtect Data Manager UI:

a. Select Agent Downloads from the System Settings menu.

b. Select the File System agent download package for Windows, fsagent191_win_x64.zip.

c. Download the package in the location that you want to install the File System agent.

2. Open the fsagent-19.1.0.0.exe installation file.

3. Follow the wizard installation steps to provide the installation location and the PowerProtect Data Manager server IP address.

4. Click Install.

5. Click Finish.

After you finish

If the host is not already whitelisted or approved, add the File System host to the PowerProtect Data Manager server. Add or manage Application/File System Agents provides more information.

Discover File System assets. Discover a File System Host provides more information.

Silent installation of File System agent You can perform a silent installation or uninstallation of the File System agent.

Silent installation commands

To perform the silent installation to the default path, run:

fsagent-19.1.0.0.exe /s PPDMHostName=< >

To perform the silent installation to a different path, run:

fsagent-19.1.0.0.exe /s PPDMHostName=< > ProductInstallPath="D:\alternate-path"

Note: PPDMHostName is a mandatory option in the command line. If a value is not provided, the product gets installed without PowerProtect registration, and no backups can be initiated from the UI. Specifying ProductInstallPath is optional, but if used, the value cannot be empty.

Enabling the File System Agent

PowerProtect Data Manager Administration and User Guide 81

Silent uninstallation commands

To perform a silent uninstall without uninstalling common components (such ADM or BBB), run:

fsagent-19.1.0.0.exe /s /uninstall

To perform a silent uninstall while also uninstalling common components, run:

fsagent-19.1.0.0.exe /s /uninstall UnInstallPPDMAgent="1" UnInstallBBBWT="1"

Uninstalling the File System agent You can uninstall the File System agent for SQL Server with the setup file.

Procedure

1. Launch DPSFSAgent-19.1.0.0.exe.

2. On the Install Modification page, select Remove, and then click Next.

3. On the Complete the Setup page, click Finish.

4. After the uninstall completes you must remove the working directory from C:\Program Files\DPSFSSGENT.

File System data protection and replication requirements PowerProtect Data Manager can manage and monitor data protection and replication for File System assets through integration with the File System agent.

After installing the File System agent, review the following information for additional requirements before adding the File System agent as an asset source in PowerProtect Data Manager and discovering the agent assets.

File System agent prerequisites Ensure that you satisfy the following prerequisites before installing and configuring the File System Agent and adding the File System Agent.

Windows and Linux prerequisites

l Ensure that your host is a 64-bit system. PowerProtect Data Manager supports only 64-bit hosts.

l Ensure that your host is a supported OS version. Software compatibility information for the PowerProtect Data Manager software is provided in the eLab Navigator, available at https://elabnavigator.emc.com/eln/ modernHomeDataProtection.

l Ensure that all clocks on both the host and PowerProtect Data Manager are time- synced to the local NTP server to ensure discovery of the backups.

l Ensure that the host and the PowerProtect Data Manager network can see and resolve each other.

l Note that LVM/VxVM partitions/volumes are supported, but not physical partitions.

l Each volume group on LVM2 or VxVM must have at least 10% free space for a block based backup to succeed.

Enabling the File System Agent

82 PowerProtect Data Manager Administration and User Guide

l Review the limitations in the section File System agent limitations on page 191.

Linux File System asset prerequisites

l Ensure that the File System has the /etc/fstab entry. Without the /etc/ fstab entry, discovery fails.

l Install the lsb_release package:

1. Mount the ISO:

[root@RHEL73-224-16 ~]# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT sda 8:0 0 30G 0 disk sda1 8:1 0 1G 0 part /boot sda2 8:2 0 14G 0 part rhel-root 253:0 0 12.5G 0 lvm / rhel-swap 253:1 0 1.5G 0 lvm [SWAP] sdb 8:16 0 30G 0 disk VG1-LV1 253:2 0 2G 0 lvm /volume1_ext3 sr0 11:0 1 3.5G 0 rom /run/media/root/RHEL-7.3 Server.x86_64 [root@RHEL73-224-16 ~]#

2. Add the Local REPO:

[root@RHEL75-224-18 ~]# cat /etc/yum.repos.d/local.repo [local] name=local baseurl=file:///run/media/root/RHEL-7.3\ Server.x86_64 enabled=1 gpgcheck=1 gpgkey=file:///run/media/root/RHEL-7.3\ Server.x86_64/RPM- GPG-KEY-redhat-release *

3. Execute the YUM command:

yum install redhat-lsb

As a result, all the dependency packages are installed.

Manage the File System agent You can add a File System agent, approve and reject pending agent requests, and edit and delete existing agents.

About this task

Note: PowerProtect Data Manager supports the coexistence of the following agents on the same Windows or Linux host:

l SQL agent and File System agent on Windows.

l Oracle/RMAN agent and File System agent on Linux.

Procedure

1. Select Infrastructure > Application Agents.

2. In the Application Agents window, click Add.

3. In the Add Application/FS Agent window, select one of the following options:

Enabling the File System Agent

PowerProtect Data Manager Administration and User Guide 83

Note: The Auto Whitelist option is enabled by default. When Auto whitelist is enabled, all pre-approved Application Agents are automatically approved.

l Add IP Address Perform the following steps:

a. Type the IP Address for the application agent.

b. Specify the date until which the application agent is pre-approved.

c. Click Save.

l CSV Filename Perform the following steps:

a. Click the Choose File icon. Note: The contents of the .CSV file must be in the following format, for example:

"10.25.115.113" "10.25.115.112" "10.25.115.145"

The Explorer window appears.

b. Select the .csv file, and then click Open. The file displays in the Application/FS Agents window.

c. Select the date until which the application or File System agent is preapproved.

d. Click Save.

4. If you have disabled Auto whitelist, select an application agent, and then select one of the following options:

l Approve

l Reject

l Edit Make the required changes.

l Remove

Protecting a File System Learn how to configure protection of a File System.

Procedure

1. Add a storage system.

Add protection storage on page 40 provides information.

2. Install the File System agent on the File System host.

Installing and configuring File System agent on page 80 provides information.

3. Add or approve the File System agent on each File System host.

Add or manage Application/File System Agents provides information.

Enabling the File System Agent

84 PowerProtect Data Manager Administration and User Guide

4. Discover the File system asset.

Discover a File System Host provides information.

5. Create a protection policy to protect the File System.

Add a protection policy for File System protection on page 112 provides information.

Note: You cannot perform a backup to a secondary Data Domain device. You can only restore from a secondary Data Domain device

Enabling the File System Agent

PowerProtect Data Manager Administration and User Guide 85

Enabling the File System Agent

86 PowerProtect Data Manager Administration and User Guide

CHAPTER 7

Managing Assets

This section includes the following topics:

l About asset sources, assets, and storage...........................................................88 l Prerequisites for discovering asset sources....................................................... 88 l Adding a vCenter Server asset source............................................................... 88 l VM proxy protection engine overview................................................................ 91 l Discovering an application or File System host ..................................................95

PowerProtect Data Manager Administration and User Guide 87

About asset sources, assets, and storage In PowerProtect Data Manager, assets are the basic unit that PowerProtect Data Manager protects. Asset sources are the mechanism that PowerProtect Data Manager uses to communicate with and manage the storage and assets. Storage is where PowerProtect Data Manager adds and stores copies and protection.

PowerProtect Data Manager supports Data Domain Management Center (DDMC) as the storage and programmatic interface for controlling the Data Domain systems, as well as external Data Domains.

Assets can be virtual machines, SQL databases, Oracle databases, or File systems.

PowerProtect Data Manager supports backing up assets and adding the asset sources either through a PowerProtect Application Agent for DD Boost backups, or by connecting to vCenter and performing virtual machine backups.

Prerequisites for discovering asset sources Perform these tasks before you discover the asset sources.

l Ensure that the PowerProtect Data Manager is deployed and configured in the environment. The PowerProtect Data Manager Deployment Guide provides information.

l Log in with administrative rights.

l Configure all asset sources with an NTP server.

l Before you register an SQL application, ensure that the Data Domain has been discovered successfully.

l For discovery of App/File System asset sources:

n Ensure that all clocks on both the App/File System host and PowerProtect Data Manager are time-synced to the local NTP server to ensure discovery of the backups.

n Ensure that the App/File System host and the PowerProtect Data Manager network can see/resolve each other.

n Ensure that port 7000 is open on the App/File System host and is bi- directional.

Adding a vCenter Server asset source After you register a vCenter Server with PowerProtect Data Manager, you can use the Asset Sources window in the PowerProtect Data Manager UI to add a vCenter Server asset source to the PowerProtect Data Manager environment.

About this task

Adding a vCenter Server asset source is required if you want to schedule a backup through PowerProtect Data Manager.

Managing Assets

88 PowerProtect Data Manager Administration and User Guide

Add a VMware vCenter Server Perform the following steps to add a vCenter Server as an asset source in the PowerProtect Data Manager UI.

Before you begin

l You must have Administrator privileges.

l By default, PowerProtect Data Manager enforces SSL certificates during communication with vCenter Server. If a certificate appears, click Verify to accept the certificate.

Note: It is highly recommended that you do not disable certificate enforcement. If disabling the certificate is required, carefully review the instructions in the section Disable SSL certification on the vCenter Server on page 172

Procedure

1. Select Infrastructure > Asset Sources.

The Asset Sources window appears.

2. Select the vCenter tab.

3. Click Add.

The Add vCenter dialog displays.

4. Specify the source's attributes:

a. In the Name field, specify the vCenter Server name.

b. In the Address field, specify the fully qualified domain name (FQDN) or the IP address.

Note: For a vCenter Server, we recommend that you use the FQDN instead of the IP address.

c. In the Port field, specify the port for communication if you are not using the default port, 443.

5. Under Add Credentials, choose an existing keychain from the Select Keychain list to use for the vCenter user credentials. Alternatively, you can add new credentials, and then click Save.

Note: Ensure that you specify the credentials for a user whose role is defined at the vCenter level, as opposed to being restricted to a lower level container object in the vSphere object hierarchy.

6. If the vCenter's SSL certificate cannot be trusted automatically, a dialog box appears requesting certificate approval. Review the certificate and click Verify.

7. Click Save.

The vCenter Server information that you entered now appears as an entry in a table on the Asset Sources window.

Note: Although PowerProtect Data Manager automatically synchronizes with the vCenter server under most circumstances, certain conditions might require you to initiate a manual discovery.

Managing Assets

PowerProtect Data Manager Administration and User Guide 89

After a successful discovery, PowerProtect Data Manager starts an incremental discovery in the background periodically to keep updating PowerProtect Data Manager with new changes in vCenter. You can always do an ad-hoc discovery.

8. Select Infrastructure > Assets.

The Assets window appears.

9. If not already selected, click the Virtual Machines tab.

When discovery has completed successfully, the virtual machine assets discovered in the vCenter display. Note that discovery time is based on networking bandwidth. The resources that are discovered and those that are doing the discovery take a performance hit each time that you go through a discovery process. It might appear that PowerProtect Data Manager is not updating the Asset Sources data while the discovery is in progress.

After you finish

Upon successful discovery of the vCenter's virtual machine assets, you can add a VM proxy to facilitate data movement, and then create virtual machine protection policies to back up these assets. Note that the PowerProtect Data Manager software comes pre-bundled with an embedded VM proxy, which is automatically used as a fallback proxy for performing backups and restores when the added external proxies fail or are disabled. It is recommended that external proxies should always be deployed since the embedded proxy has very limited capacity for performing parallel backups. To add a VM proxy, go to Infrastructure > Protection Engines.

Virtual asset discovery After you add a vCenter Server as an asset source, an automatic discovery of VMware entity information from the vCenter Server is initiated.

After automatic discovery, the virtual assets for the vCenter Server appear in the Assets window of the PowerProtect Data Manager UI under the Virtual Machines tab, as shown in the following figure. Figure 5 Assets window after vCenter Server discovery

The initial vCenter Server discovery identifies all ESX clusters, hosts, and virtual machines within the vCenter Server. Subsequent discoveries are performed automatically, according to a fixed interval, to identify any additional or changed

Managing Assets

90 PowerProtect Data Manager Administration and User Guide

VMware entities since the last discovery operation. You can also manually initiate a discovery of VMware entities at any time from the vCenter tab of the Asset Sources window by selecting a vCenter Server and clicking Discover.

Upon vCenter Server and virtual asset discovery, the PowerProtect Data Manager VM proxy protection engine facilitates the management of virtual assets as PowerProtect Data Manager resources for the purposes of backup and recovery. We recommend that you also add an external VM proxy in the Protection Engines window. You can protect virtual machine assets by manually adding the assets to a virtual machine protection policy, or by using dynamic filters to determine which assets will be included in a protection policy according to pre-defined rules.

VM proxy protection engine overview The VM proxy protection engine is the virtual machine data protection solution within PowerProtect Data Manager. This solution enables you to deploy a VM proxy in the vSphere environment to perform virtual machine snapshot backups, moving the data to a Data Domain system.

The VM proxy protection engine is enabled after you add a vCenter Server in the Asset Sources window, which enables you to collect VMware entity information from the vCenter server and save the virtual machines as PowerProtect Data Manager resources for the purposes of backup and recovery.

To view statistics for the VM proxy engine, manage and monitor VM proxies, and add an external VM proxy to facilitate data movement, go to Infrastructure > Protection Engines. Add a VM proxy on page 92 provides more information. Figure 6 Protection Engines window for VM proxy engine

Note: In the VM Proxy Engine pane, VMs Protected refers to the number of assets protected by PowerProtect Data Manager. This count does not indicate that all of the virtual machines have been protected successfully. To determine the success or failure of asset protection, use the Jobs window.

When you add an external VM proxy, the VM Proxies pane provides the following information:

l The VM proxy IP address and name, which can be useful for troubleshooting network issues.

Managing Assets

PowerProtect Data Manager Administration and User Guide 91

l The vCenter and ESXi hostname.

l The VM proxy status (green check mark if the VM proxy is ready, red x if the VM proxy is not fully operational). The status includes a short explanation to help you determine why a VM proxy is not in a fully operational state.

l The transport mode that you selected when adding the VM proxy (Hot Add, Network Block Device, or the default setting Hot Add, Failback to Network Block Device).

Add a VM proxy In the Protection Engines window, perform the following steps to deploy a VM proxy to facilitate data movement with the VM proxy protection engine.

About this task

Note: The PowerProtect Data Manager software comes pre-bundled with an embedded VM proxy, which is automatically used as a fallback proxy for performing backups and restores when the added external proxies fail or are disabled. It is recommended that external proxies should always be deployed since the embedded proxy has very limited capacity for performing parallel backups.

Procedure

1. In the VM Proxies pane of the Protection Engines window, click Add.

2. In the Add VM Proxy dialog box, fill out the required fields (marked with an asterisk).

Note: Consider the following:

l Only IPv4 addresses are supported for the Gateway, IP Address, Netmask, and Primary DNS.

l If you have added multiple vCenter Server instances, the vCenter to Deploy list enables you to choose the vCenter where you want to deploy the VM proxy.

l The ESX Host/Cluster list enables you to choose on which cluster or ESX host you want to deploy the additional VM proxy.

l The Network list shows all the networks that are available under the selected ESX Host/Cluster.

l The Data Store list shows all datastores that are accessible to the selected ESX Host/Cluster based on ranking (whether the datastores are shared, local, or NFS), and available capacity (the datastore with the most capacity appearing at the top of the list).

l You can choose the specific datastore on which the VM proxy will reside or leave the default selection of to allow PowerProtect Data Manager to determine the best location to host the VM proxy.

l The Transport Mode list enables you to force using only Hot Add or only Network Block Device (NBD) transport modes or to default to Hot Add mode and failback to NBD only if Hot Add cannot be used.

3. Click Save.

The VM proxy is added to the VM Proxies pane. Note that it may take several minutes before the additional VM proxy is registered in PowerProtect Data

Managing Assets

92 PowerProtect Data Manager Administration and User Guide

Manager. The VM Proxy then appears in the vSphere Client window, as shown in the following figure. Figure 7 Additional VM proxy registered in PowerProtect Data Manager and the vSphere Client

Results

When an additional VM proxy is deployed and registered, this appliance is used by PowerProtect Data Manager instead of the embedded VM proxy for any data protection operations involving virtual machine protection policies, unless all added VM proxies are unavailable. If no added VM proxy is available, the embedded VM proxy is used as a fallback to perform limited scale backups and restores. If you do not want to use an added VM proxy, you can disable that proxy. Additional VM proxy actions on page 93 provides more information.

After you finish

If the VM proxy appliance deployment fails, review the network configuration of PowerProtect Data Manager in the System Settings window to correct any inconsistencies in network properties. After successfully completing the network reconfiguration, you must delete the failed VM Proxy and then re-add the VM proxy in the Protection Engines window.

Additional VM proxy actions For additional VM proxy actions, such is enabling, disabling, redeploying or deleting the VM proxy, use the Protection Engines window.

Disable a VM proxy

You can disable an added VM proxy that you do not currently require for virtual machine backup and recovery. To disable a VM proxy:

1. On the Protection Engines window, select the VM proxy that you want to disable from the table in the VM Proxies pane.

Managing Assets

PowerProtect Data Manager Administration and User Guide 93

2. In the far right of the VM Proxies pane, click the three vertical dots.

3. From the menu, select Disable.

Note: A disabled VM proxy will not be used for any new protection activities, and will not be automatically upgraded during an PowerProtect Data Manager upgrade.

Delete a VM proxy

When you disable a VM proxy, the Delete button which was previously greyed out is enabled. If you will no longer require the VM proxy, perform the following steps to delete the VM proxy:

1. Select the VM proxy that you want to remove from the table in the VM Proxies pane.

2. In the far right of the VM Proxies pane, click the three vertical dots.

3. From the menu, select Disable. The Delete button is now enabled.

4. Click Delete.

Enable a disabled VM proxy

When you want to make a disabled VM proxy available again for running new protection activities, perform the following steps to re-enable the VM proxy.

1. Select the VM proxy that you want to re-enable from the table in the vProxies pane.

2. In the far right of the vProxies pane, click the three vertical dots.

3. From the menu, select Enable.

Note: If a PowerProtect Data Manager version upgrade occurred while the VM proxy was disabled, after re-enabling a manual redeployment of the VM proxy is also required.

Redeploy a VM proxy

If a PowerProtect Data Manager software update occurred while a VM proxy was disabled, or an automatic upgrade of the VM proxy did not occur due to network inaccessibility or an environment error, the Redploy option allows you to manually update the VM proxy to the current version in use with the PowerProtect Data Manager software. Perform the following steps to manually redeploy the VM proxy.

1. Select the VM proxy that you want to redeploy from the table in the VM Proxies pane.

2. In the far right of the VM Proxies pane, click the three vertical dots.

3. If the VM proxy is not yet enabled, select Enable from the menu.

4. When the VM proxy is enabled, select Redploy from the menu.

The VM proxy will be redeployed with its previous configuration details.

Managing Assets

94 PowerProtect Data Manager Administration and User Guide

Discovering an application or File System host After you register an application host with PowerProtect Data Manager, you can use the Asset Sources window to discover an application or file system host, and modify the application host credentials.

About this task

For application hosts, discovery is required if you want to schedule a backup. You must add credentials to the SQL or Oracle database so that PowerProtect Data Manager can access the database to create backups.

Discover an application host Perform the following steps to discover an application host as an asset source in the PowerProtect Data Manager UI.

Procedure

1. Select Infrastructure > Asset Sources.

The Asset Sources window appears.

2. Select the App/File System Host tab.

3. If you are adding an Oracle or SQL database, click Edit Credentials.

The Edit Credentials dialog appears.

4. If you are adding credentials for:

l An Oracle database:

Ensure that you specify CredentialType: tnsName or FileName for DBUSER, RMAN, and WALLET users. If you do not specify tnsName or FileName Credential Type for DBUSER, RMAN, and WALLET, backups fail. OS user does not require tnsName or FileName CredentialType.

Authentication requirements on page 69 provides details about the authentication requirements for an Oracle database.

Note: Credentials that you set at the host level supersede the credentials that you set at the protection policy level.

l A SQL database:

Ensure that you specify the OS credentials for the SQL host. Ensure that these credentials have the rights to perform the Microsoft SQL Server backup and restore operations.

5. Click Save.

An entry for the Application Host with the specified information displays as an entry in a table on the Asset Sources window.

Discovery time is based on networking bandwidth. The resources that are discovered and those that are doing the discovery take a performance hit each time that you go through a discovery process. It might appear that PowerProtect Data Manager is not updating the Asset Sources data.

Note: Click Discover at any time if any additions or other changes to your Asset Sources have taken place outside of the PowerProtect Data Manager environment.

Managing Assets

PowerProtect Data Manager Administration and User Guide 95

Results

If the database is properly configured, these application hosts can now be added to a PowerProtect Data Manager protection policy.

Discover a File System Host Perform the following steps to discover a File System Host as an asset source in the PowerProtect Data Manager UI.

Procedure

1. Select Infrastructure > Asset Sources.

The Asset Sources window appears.

2. Select the App/File System Host tab.

3. Select the file system host and click Discover.

The Discover dialog appears with an option to set the discovery schedule.

4. From the Discovery Schedule list, select the time of day to initiate the discovery, or select Manual to disable scheduled discovery. You can also select the Discover Now checkbox to perform the discovery upon completion of this procedure.

Note: From the App/File System Host tab, you can click Discover at any time if any additions or other changes to your Asset Sources have taken place outside of the PowerProtect Data Manager environment. Asset discovery also gets initiated by default after registration of the host to PowerProtect Data Manager, and at hourly intervals. Discovery time is based on networking bandwidth. Note that the resources that are discovered and those that are handling the discovery impact system performance each time that you initiate a discovery process.

5. Click Save.

Results

If the File System is properly configured, these File Systems can now be added to a PowerProtect Data Manager protection policy.

Managing Assets

96 PowerProtect Data Manager Administration and User Guide

CHAPTER 8

Managing Protection Policies

This section includes the following topics:

l Protection policies............................................................................................. 98 l Before you a create protection policy............................................................... 100 l Add a protection policy for virtual machine protection..................................... 100 l Add a protection policy for SQL database protection....................................... 105 l Add a protection policy for Oracle database protection.................................... 109 l Add a protection policy for File System protection............................................112 l Add a Cloud Tier protection policy.....................................................................116 l Edit a protection policy..................................................................................... 116 l Add or remove assets in a protection policy...................................................... 117 l Removing expired backup copies.......................................................................118 l Export protection ............................................................................................. 118 l Delete a protection policy..................................................................................119 l Add a Service Level Agreement.........................................................................119 l Export Asset Compliance..................................................................................122 l Dynamic filters .................................................................................................123

PowerProtect Data Manager Administration and User Guide 97

Protection policies Protection policies define sets of objectives that apply to specific periods of time. These objectives drive configuration, active protection, and copy-data-management operations that satisfy the business requirements for the specified data. Each plan type has its own set of user objectives.

Users with the System Admin role can create protection policies.

You can create the following types of protection policies:

l VMware Virtual Machines

l SQL Databases

l Oracle Databases

l File Systems

Policy retention time considerations The retention time of the protection copy set is different from the time that was configured in PowerProtect Data Manager.

PowerProtect Data Manager applies an algorithm to determine the duration for which regular and self-service copies must be retained. The retention time for backups is calculated as follows:

l Centralized backups: (start time of current FULL backup) + (schedule period configured in PowerProtect Data Manager) + (retention value from PowerProtect Data Manager configuration) + (padding to midnight)

l Self-service backups: (start time of current FULL backup) + (retention value from PowerProtect Data Manager configuration) + (PowerProtect Data Manager self- service schedule period value) + (padding to midnight), where PowerProtect Data Manager self-service schedule period value = 14 days (default).

Maximum retention period for protection policy backups

According to the schedule type specified for a protection policy, the following maximum retention periods apply:

l Hourly backups 31 days

l Daily backups 31 days

l Weekly backups 52 weeks

l Monthly backups 12 months

Data Domain protection considerations Read about the following considerations around Data Domain protection policies and PowerProtect Data Manager.

l PowerProtect Data Manager created Storage Units must not be changed by the Data Domain administrator to set up Storage Units replication.

l PowerProtect Data Manager-created Storage Units must not be configured for cloud tiering.

l When you create a protection policy, PowerProtect Data Manager creates a Data Domain Boost storage unit and assigns a DD Boost user to it. The following limitations apply to the number of supported PowerProtect Data Manager

Managing Protection Policies

98 PowerProtect Data Manager Administration and User Guide

protection policies on the supported Data Domain model to the number of active Data Domain Storage Units.

Table 20 Supported PowerProtect Data Manager protection policies and Storage Units by Data Domain version

Data Domain System DD OS Version Storage Units Supported Supported configurable concurrently active Storage Units / supported number of PowerProtect Data Manager protection policies

DD9800 6.0 and later 256 256

DD9500 5.7 and later 256 256

DD6800, DD9300 6.0 and later 128 128

DD6300 6.0 and later 100 32

DD990, DD4200, DD4500, DD7200

5.7 and later 128 128

All other DD systems 5.7 and later 100 Up to 32 based on the model

DD9500 5.6 100 64

DD990, DD890 5.3 and later 100 Up to 32 based on the model

DD7200, DD4500, DD4200 5.4 and later 100 Up to 32 based on the model

All other DD systems 5.2 and later 100 Up to 14 based on the model

Table 21 Supported Storage Units in DDVE by TB

Number TBs in DDVE Maximum Number of Storage Units

Supported configurable concurrently active Storage Units /supported number of PowerProtect Data Manager protection policies

4 6

8

100 6

32 48

100 14

64 96

100 32

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 99

Before you a create protection policy Consider the following points before creating a protection policy.

l An asset can only be protected by one policy at a time. If you move assets between different protection policies at some point, ensure that you unconfigure the assets from the current policy before moving them to the new policy.

Note: If an SQL server is also a virtual machine, you can still protect the SQL database with a crash-consistent backup without interfering with the SQL agent-based backup.

l Before adding replication to a protection policy, ensure that you add a remote Data Domain system as the replication location. Add Protection Storage provides detailed instructions about adding a remote Data Domain system.

Managing backup frequency

To avoid high CPU usage that can lead to failure issues, do not schedule backups more often than recommended in the following table:

Backup type Minimum frequency recommendation

Archive Log 30 minutes

Differential 6 hours

Incremental Cumulative 12 hours

Full Daily

Add a protection policy for virtual machine protection A protection policy enables you to select a specific group of assets that you want to back up. Use the PowerProtect Data Manager UI to create a virtual machine protection policy.

Before you begin

It is recommended to distribute the virtual machine asset protection workload over multiple ESXi hosts so that you do not exceed the ESXi NBD session limit. Note that if the limit is reached, you can manage the workload by deploying an external VM proxy on the host/cluster using Hot Add transport mode.

To create Application Aware protection policies for virtual machines, ensure that:

l You manually update the vmx configuration parameter disk.EnableUUID to false by using the vSphere Web Client.

l The vSphere version that you are running uses a supported version of VMware Tools. Software compatibility information for the PowerProtect Data Manager software is provided in the eLab Navigator, available at https:// elabnavigator.emc.com/eln/modernHomeDataProtection.

l The virtual machine has direct access to the Data Domain client.

l The virtual machine uses SCSI disks only, and the number of available SCSI slots matches at least the number of disks.

l The Windows account that is used for the protection policy has both Microsoft Windows administrative rights and Microsoft SQL Server login and sysadmin rights.

Managing Protection Policies

100 PowerProtect Data Manager Administration and User Guide

l The SQL configuration support is limited to Microsoft SQL Server stand-alone instances and a Microsoft SQL Server Always On availability group (AAG) configured with file share witness. Unsupported configurations include Microsoft SQL Server failover cluster instances that are configured with shared drives, and Microsoft SQL Server cluster-less AAG configurations.

l For Microsoft SQL Server AAG configurations, the database administrator specifies the AAG backup preferences for backup in the Microsoft SQL Server Management Studio (SSMS). These preferences control which AAG node is selected as the preferred node when you perform a transaction log backup of AAG databases.

Procedure

1. Select Protection > Protection Policies.

The Protection Policies window appears.

2. Click Add.

The Add Policy wizard appears.

3. On the Type page, specify the following fields:

a. NameType a name that identifies what kind of a protection policy you plan to create. For example, "vCenter1 Protection."

b. DescriptionType a description of the contents of this group. For example, "contains virtual machine assets for vCenter1."

c. TypeSelect Virtual Machine, which includes protection for SQL application-aware virtual machines.

d. Click Next.

The Purpose page appears.

4. On the Purpose page, specify the following fields to indicate the purpose of the new protection policy group:

a. The type of protection policy group.

For a virtual machine, you can select from three types:

l Crash ConsistentSelect this type for point-in-time backup of virtual machines.

l Application Aware For virtual machines with a SQL application installed, select this type to quiesce the application to perform the SQL database and transaction log backup. When you select this type, you also need to provide Windows account credentials for the virtual machine. You can provide the credentials at the protection lifecycle (PLC) level and/or the virtual machine asset level. When you provide the credentials at both the PLC level and the virtual machine asset level, the virtual machine asset credentials override the PLC credentials for that virtual machine. These credentials are required because PowerProtect Data Manager interacts with the guest virtual machines to install the Microsoft application agent and quiesce the application for performing application- consistent backups. The agent also enables the application administrator to perform self-service restores by using the native Microsoft SQL Studio Management interface.

l ExclusionSelect this type if there are virtual machine assets within the protection policy that you plan to exclude from data protection operations.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 101

b. If applicable, specify the Credentials. You can specify new credentials or select existing credentials from the list.

c. Click Next.

The Assets page appears.

5. In the Assets page, select the unprotected assets that you want to back up as part of this protection policy, or click Find More Assets to perform an updated asset discovery of the vCenter if you do not see the virtual machines that you want to protect. The window enables you to filter by asset name to locate the required assets.

Note: When you configure a virtual machine application-aware protection policy to protect a Microsoft SQL Server Always On availability group (AAG), you must add all the virtual machines for that AAG to the same PLC, to ensure proper protection. Failure to do so might result in missed transaction log backups.

Additionally, you can change the assets view to display all the virtual machines discovered by PowerProtect Data Manager, or a hierarchical view to display the assets in a tree structure underneath the vCenter, as shown in the following figure. A hierarchical view might be helpful, for example, if you have added multiple vCenter servers, so that you can more easily identify which assets belong to which vCenter.

For the virtual machine application-aware case, the Assets page displays a warning about the AAG PLC configuration requirement.

Figure 8 Hierarchical view of assets

Note: When selecting assets, ensure that you do not switch between views. For example, if you select assets in vCenter Hierarchy view and then change to the All Virtual Machines view, the selections will not be saved.

6. Click Next.

The Protection Policy Schedule page appears. No default schedule is provided, and if you have not yet performed a backup, no schedule displays in the table.

7. Click + Backup to create the schedule.

The Add Primary Backup dialog box appears.

Managing Protection Policies

102 PowerProtect Data Manager Administration and User Guide

8. Specify the backup schedule fields:

a. Recurrence

The Recurrence options allow you to determine how often backups will occur. Choose from Hourly, Daily, Weekly and Monthly. Note that Recurrence also depends on the Start Time and End Time fields if you select the Hourly option. For example, if the Start Time is 8 pm and the End Time is 6 am, and you select Hourly, backups are performed hourly during that 10-hour window.

When you select Weekly and Monthly recurrence, you are selecting the interval at which the backup job runs within the window that you specify.

b. Create Full determines how often a full backup occurs during the backup window, depending on the Recurrence option you selected. For example, if you selected an Hourly recurrence, typing 12 in this field schedules a full backup every 12 hours, to be initiated at the Start Time specified.

c. *Create Cumulative determines how often an incremental backup occurs during the backup window.

d. Transaction Log Every (for application-aware protection policies)

Note: For Microsoft SQL Server Always On availability group (AAG) configurations, the database administrator may specify the AAG backup preferences for a transaction log backup in the Microsoft SQL Server Management Studio (SSMS).

e. Keep For determines the retention period of the backup.

f. Start Time and End Time determine the backup window.

End Time means that no new backup will be initiated in this policy after this time. It does not mean that any policy that is running is stopped.

g. Click OK.

The Schedule page updates with the added backup schedule.

After completing a backup schedule, you can change any schedule details by selecting the check box next to the added schedule and clicking Edit.

9. To run another backup of this protection policy with a different schedule:

a. Select the checkbox next to the added schedule and click + Backup.

b. Complete the schedule details in the Add Promotion Backup dialog box, and then click OK.

10. To replicate these backups to a remote Data Domain system:

a. Select the checkbox next to the added schedule and click Replicate.

b. Complete the schedule details in the Add Primary Replication dialog box, and then click OK.

Note: To enable replication, ensure that you add a remote Data Domain system as the replication location. Add Protection Storage provides detailed instructions about adding a remote Data Domain system.

11. Select the check box next to the added schedule.

When you select the check box, the service level agreement (SLA), Storage Name, and Network interface lists are enabled for selection.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 103

12. From the SLA list, select an existing service level agreement that you want to apply to this schedule, or select Add to create a SLA within the Add Backup Service Level Agreement window.

Add a new SLA provides instructions.

13. From the Storage Name list:

l Select the backup destination from the list of existing Data Domain systems.

l To add a system, select Add, and complete the details in the Storage Target window. Add Protection Storage provides instructions.

When you select the destination storage, the Space field updates with the available capacity on the system.

14. Click Set Storage Quotas to set storage space restrictions for a Data Domain MTree or Storage Unit to prevent the consumption of excess space. There are two kinds of quota limitshard limits and soft limits. You can set either a soft or hard limit or both a soft and hard limit. Both values must be integers, and the soft value must be less than the hard value.

Note: When you set a soft limit and the limit is reached, an alert is generated but data can still be written to the Data Domain. When you set a hard limit and the limit is reached, data cannot be written to the MTree. Therefore, all data protection operations fail until data is deleted from the MTree. The Data Domain Operating System Administration Guide provides more information about MTree quota configuration.

a. Capacity Quota Controls the total size of pre-compression data written to the Data Domain.

b. Stream Quota The number of concurrent streams allowed on the system during data protection operations. Setting a Stream Quota limit can help ensure that system performance is not impacted negatively if a data protection operation is consuming too many system resources.

15. Select the Retention Lock check box to enable retention locking for these backups on the selected system.

Note: Primary backups are assigned a default retention lock period of 14 days. Replicated backups, however, do not get assigned a default retention lock period. If you select this check box for a replicated backup, ensure that you set the Keep For field in the Add Primary Replicate backup schedule dialog to a minimum number of 14 days so that the replicated backup does not expire before the primary backup.

16. From the Network interface list, select a network interface card (NIC), if applicable.

17. Click Next.

The Summary page appears.

18. Review the protection policy group configuration details. Except for the protection policy type, you can click Edit next to any completed details to change the protection policy information. When completed, click Finish.

An informational message appears to confirm that PowerProtect Data Manager has saved the protection policy. When the new protection policy group is created, PowerProtect Data Manager automatically performs a full backup. For virtual machines, if you have not yet added a VM Proxy, the backup is

Managing Protection Policies

104 PowerProtect Data Manager Administration and User Guide

performed using the embedded VM Proxy. Subsequent backups are performed according to the schedule specified.

19. Click OK to exit the window, or click Go to Jobs to open the Jobs window to monitor the backup of the new protection policy group.

On-demand backups of virtual machines Once virtual assets have been added to a virtual machine protection policy, you can perform on-demand backups of individual virtual machines by using the Backup Now functionality in the PowerProtect Data Manager UI.

When a virtual machine is part of an application-aware protection policy, the ad-hoc backup is a full application-aware backup.

To perform an on-demand backup:

1. Select Infrastructure > Assets.

2. Select the Virtual Machines tab. A list of virtual assets for the discovered vCenter display.

3. Select a virtual machine from the table that has an associated protection policy. Note: You can only select one virtual machine at a time for on-demand backup, and the protection policy associated with this virtual machine cannot be an exclusion policy.

4. Click Backup Now. A notification appears indicating whether the request was processed successfully.

Additional options for managing virtual machine backups After a virtual machine protection policy backup is complete, additional options such as editing the retention period become available for virtual machine assets backed up as part of the policy.

Select Infrastructure > Assets. Select the Virtual Machines tab. The table lists the virtual machine assets that were discovered in the vCenter. Select an asset from the table and click View Copies. The Copy Locations pane identifies where the backups are stored.

In the left pane, click the storage icon to the right of the VM icon, for example, DD. The table in the right pane lists the backup copies. Depending on whether the asset is retention locked, you can perform the following functions from this window:

l Edit the retention period for a backup copy Select a backup copy from the table and click Edit Retention.

l Delete a backup copy If you no longer require one of the backup copies and the retention lock is not enabled for this copy, select the backup copy from the table and click Delete.

Add a protection policy for SQL database protection Use the PowerProtect Data Manager UI to add a protection policy group for the purposes of SQL database protection.

About this task

Note: If a database is protected in an Always On availability group, you cannot configure stand-alone backups of that database in a protection policy group.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 105

Procedure

1. Select Protection > Protection Policy.

The Protection Policy window appears.

2. Click Add.

The Add Policy wizard appears.

3. In the Type page, specify the new protection policies group fields. For example, if you are creating a protection policy for daily backups in the SQL production environment:

a. In the Name field, specify the name of the protection policy. For example, SQL Prod Databases

Note: The name that you specify here becomes part of the Data Domain MTree entry.

b. In the Description field, specify a short description of the protection policy. For example, For example, SQL Prod Daily Backups

c. In theType field, select Microsoft SQL database.

d. Click Next.

The Purpose page appears.

4. In the Purpose page, specify the following fields to indicate the purpose of the new protection policy group:

a. The type of protection policies group.

For a SQL database, you can select from three types:

l To use PowerProtect Data Manager to manage all protection centrally, click Centralized Protection.

l To use SQL to create local backup protection, click Self-Service Protection. PowerProtect Data Manager creates a protection policy and manages extra stages.

l If there are SQL assets within the protection policy that you plan to exclude from data protection operations, click Exclusion.

b. To specify the credentials, click Set Credentials. You can specify new credentials or select existing credentials from the list.

c. Click Save.

d. Click Next.

The Assets page appears.

5. Select the unprotected assets that you want to add to the backup of this protection policy group. The window enables you to filter by asset name to locate the required assets.

6. Click Next.

If you selected Exclusion in the Purpose page, the Summary page appears. Proceed to the final two steps.

If you selected Centralized Protection or Self-Service Protection, the Schedule page appears.

Managing Protection Policies

106 PowerProtect Data Manager Administration and User Guide

7. Click + Backup.

The Add Primary Backup dialog box appears.

8. Specify the backup schedule fields:

l For Centralized Protection:

a. In the Recurrence field, select the interval at which the backup job runs within the window that you specify. Recurrence relates to Start Time and End Time fields.

When you select Hourly, Daily,Weekly, and Monthly recurrence, you are selecting the interval at which the backup job runs within the window that you specify.

b. In the Create Full field, specify the interval in hours to create a full backup. The interval should be between 1 hour to 12 hours.

c. To create an incremental differential backup, click Differential, and then specify the interval in minutes.

d. To create a log, click Log, and then specify the interval in minutes.

e. In the Keep For field, specify the retention time.

f. In the Start Time field, specify the time when new backups are initiated in this policy.

g. In the End Time field, specify the time after which no new backups are initiated in this policy. It does not mean that any policy that is running is stopped.

h. Click OK. The Schedule page updates with the newly added backup schedule.

l For Self-Service Protection:

a. In the Keep For field, specify the retention time.

b. Click OK.

After completing a backup schedule, you can change any schedule details by selecting the checkbox next to the added schedule and clicking Edit.

9. To run another backup of this protection policy with a different schedule:

a. Select the checkbox next to the added schedule and click + Backup.

b. Complete the schedule details in the Add Promotion Backup dialog box, and then click OK.

10. To replicate these backups to a remote Data Domain system:

a. Select the checkbox next to the added schedule and click Replicate.

b. Complete the schedule details in the Add Primary Replication dialog box, and then click OK.

Note: To enable replication, ensure that you add a remote Data Domain system as the replication location. Add Protection Storage provides detailed instructions about adding a remote Data Domain system.

11. Select the check box next to the added schedule.

When you select the check box, the SLA, Storage Name, and Network interface lists are enabled for selection.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 107

12. From the SLA list, select an existing service level agreement that you want to apply to this schedule, or select Add to create a SLA within the Add Backup Service Level Agreement window. Add a Service Level Agreement provides instructions.

13. From the Storage Name list:

l Select the backup destination from the list of existing Data Domain systems.

l To add a system, select Add, and complete the details in the Storage Target window. Add Protection Storage provides instructions.

When you select the destination storage, the Space field updates with the available capacity on the system.

14. From the Network interface list, select a network interface card (NIC), if applicable.

15. Click Set Storage Quotas to set storage space restrictions for a Data Domain MTree or Storage Unit to prevent the consumption of excess space. There are two kinds of quota limitshard limits and soft limits. You can set either a soft or hard limit or both a soft and hard limit. Both values must be integers, and the soft value must be less than the hard value.

Note: When you set a soft limit and the limit is reached, an alert is generated but data can still be written to the Data Domain. When you set a hard limit and the limit is reached, data cannot be written to the MTree. Therefore, all data protection operations fail until data is deleted from the MTree. The Data Domain Operating System Administration Guide provides more information about MTree quota configuration.

a. Capacity Quota Controls the total size of pre-compression data written to the Data Domain.

b. Stream Quota The number of concurrent streams allowed on the system during data protection operations. Setting a Stream Quota limit can help ensure that system performance is not impacted negatively if a data protection operation is consuming too many system resources.

16. Select the Retention Lock check box to enable retention locking for these backups on the selected system.

Note: Primary backups are assigned a default retention lock period of 14 days. Replicated backups, however, do not get assigned a default retention lock period. If you select this check box for a replicated backup, ensure that you set the Keep For field in the Add Primary Replicate backup schedule dialog box to a minimum number of 14 days so that the replicated backup does not expire before the primary backup.

17. Click Next.

The Summary page appears.

18. Review the protection policy group configuration details. You can click Edit next to any completed window's details to change any information. When completed, click Finish.

An informational message appears to confirm that PowerProtect Data Manager has saved the protection policy. When a new protection policy is created, PowerProtect Data Manager performs the first full backup and subsequent backups according to the schedule specified.

Managing Protection Policies

108 PowerProtect Data Manager Administration and User Guide

19. Click OK to exit the window, or click Go to Jobs to open the Jobs window to monitor the backup of the new protection policy group.

Add a protection policy for Oracle database protection Use the PowerProtect Data Manager UI to add a protection policy group for the purposes of Oracle database protection.

Before you begin

l If you are creating protection policies for RAC databases, ensure that all nodes in the RAC environment are powered on and registered at the time of PLC creation. Otherwise protection may fail.

l You cannot add assets from a single Oracle host in two or more protection policies with the same Data Domain. You must add additional protection policies to a different DD. This is pertaining to issue ECDM-39456.

l For Oracle Instance Group assets, ensure that the maximum length of the hostname plus storage unit is 59. There are no special character limitations. For example, oracle_database_department_123_accounts.

Procedure

1. Select Protection > Protection Policy.

The Protection Policy window appears.

2. Click Add.

The Add Policy wizard appears.

3. In the Type page, specify the new protection policies group fields. For example, if you are creating a protection policy for daily backups in the Oracle production environment:

a. In the Name field, specify the name of the protection policy. For example, Oracle Prod Databases

Note: The name that you specify here becomes part of the Data Domain MTree entry.

b. In the Description field, specify a short description of the protection policy. For example, Oracle Prod Daily Backups

c. In theType field, select Oracle database.

d. Click Next.

The Purpose page appears.

4. In the Purpose page, specify the following fields to indicate the purpose of the new protection policy group:

a. The type of protection policies group.

For an Oracle database, you can select from three types:

l To use PowerProtect Data Manager to manage all protection centrally, click Centralized Protection

l To use Oracle to create local backup protection, click Self-Service Protection. PowerProtect Data Manager creates a protection policy and manages extra stages.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 109

l If there are Oracle assets within the protection policy that you plan to exclude from data protection operations, click Exclusion.

b. To specify the credentials, click Set Credentials. You can specify new credentials or select existing credentials from the list.

Authentication requirements on page 69 provides details about the authentication requirements for an Oracle database.

Note: Credentials that you set at the host level supersede the credentials that you set at the protection policy level.

c. Click Next.

The Assets page appears.

5. Select the unprotected assets that you want to add to the backup of this protection policy group. The window enables you to filter by asset name to locate the required assets.

Additionally, you can change the assets view to display all assets discovered by PowerProtect Data Manager, or a hierarchical view to display the assets in a tree structure underneath the application host. A hierarchical view might be helpful, for example, if you have added multiple Oracle or SQL databases, so that you can more easily identify which assets belong to which database.

6. Click Next.

If you selected Exclusion in the Purpose page, the Summary window appears. Proceed to the final two steps.

If you selected Centralized Protection or Self-Service Protection, the Schedule page appears.

7. Click + Backup.

The Add Primary Backup dialog box appears.

8. Specify the backup schedule fields:

l For Centralized Protection:

a. In the Recurrence field, select the interval at which the backup job runs within the window that you specify. Recurrence relates to Start Time and End Time fields.

When you select Hourly, Daily,Weekly, and Monthly recurrence, you are selecting the interval at which the backup job runs within the window that you specify.

b. In the Create Full (Level 0) field, specify the interval in hours to create a full backup. The interval should be between 1 hour to 12 hours.

c. To create an incremental cumulative backup, click Incremental Cumulative, and then specify the interval in minutes.

d. To create an incremental differential backup, click Incremental Differential, and then specify the interval in minutes.

e. To create a log, click Log, and then specify the interval in minutes.

f. In the Keep For field, specify the retention time.

g. In the Start Time field, specify the time when new backups are initiated in this policy.

Managing Protection Policies

110 PowerProtect Data Manager Administration and User Guide

h. In the End Time field, specify the time after which no new backups are initiated in this policy. It does not mean that any policy that is running is stopped.

i. Click OK. The Schedule page updates with the newly added backup schedule.

l For Self-Service Protection:

a. In the Keep For field, specify the retention time.

b. Click OK.

After completing a backup schedule, you can change any schedule details by selecting the checkbox next to the added schedule and clicking Edit.

9. To run another backup of this protection policy with a different schedule:

a. Select the check box next to the added schedule and click + Backup.

b. Complete the schedule details in the Add Promotion Backup dialog box, and then click OK.

10. To replicate these backups to a remote Data Domain system:

a. Select the checkbox next to the added schedule and click Replicate.

b. Complete the schedule details in the Add Primary Replication dialog box, and then click OK.

Note: To enable replication, ensure that you add a remote Data Domain system as the replication location. Add Protection Storage provides detailed instructions about adding a remote Data Domain system.

11. Select the check box next to the added schedule.

When you select the check box, the SLA, Storage Name, and Network interface lists are enabled for selection.

12. From the SLA list, select an existing service level agreement that you want to apply to this schedule, or click Add to create a SLA within the Add Backup Service Level Agreement window. Add a Service Level Agreement provides instructions.

13. From the Storage Name list:

l Select the backup destination from the list of existing Data Domain systems.

l To add a system, select Add, and complete the details in the Storage Target window. Add Protection Storage provides instructions.

When you select the destination storage, the Space field updates with the available capacity on the system.

14. From the Network interface list, select a network interface card (NIC), if applicable.

15. Click Set Storage Quotas to set storage space restrictions for a Data Domain MTree or Storage Unit to prevent the consumption of excess space. There are two kinds of quota limitshard limits and soft limits. You can set either a soft or hard limit or both a soft and hard limit. Both values must be integers, and the soft value must be less than the hard value.

Note: When you set a soft limit and the limit is reached, an alert is generated but data can still be written to the Data Domain. When you set a hard limit and the limit is reached, data cannot be written to the MTree.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 111

Therefore, all data protection operations fail until data is deleted from the MTree. The Data Domain Operating System Administration Guide provides more information about MTree quota configuration.

a. Capacity Quota Controls the total size of pre-compression data written to the Data Domain.

b. Stream Quota The number of concurrent streams allowed on the system during data protection operations. Setting a Stream Quota limit can help ensure that system performance is not impacted negatively if a data protection operation is consuming too many system resources.

16. Select the Retention Lock check box to enable retention locking for these backups on the selected system.

Note: Primary backups are assigned a default retention lock period of 14 days. Replicated backups, however, do not get assigned a default retention lock period. If you select this check box for a replicated backup, ensure that you set the Keep For field in the Add Primary Replicate backup schedule dialog box to a minimum number of 14 days so that the replicated backup does not expire before the primary backup.

17. Click Next.

The Summary page appears.

18. Review the protection policy group configuration details. You can click Edit next to any completed window's details to change any information. When completed, click Finish.

An informational message appears to confirm that PowerProtect Data Manager has saved the protection policy. When the new protection policy group is created, PowerProtect Data Manager automatically performs a full backup. Subsequent backups are performed according to the schedule specified.

19. Click OK to exit the window, or click Go to Jobs to open the Jobs window to monitor the backup of the new protection policy group.

Add a protection policy for File System protection Use the PowerProtect Data Manager UI to add a protection policy for the purposes of File System data protection.

Before you begin

Review the prerequisites in the section File System agent prerequisites on page 82 Procedure

1. Select Protection > Protection Policies.

The Protection Policy window appears.

2. Click Add.

The Add Policy window appears.

3. In the Type page, specify the new protection policies group fields. For example, if you are creating a protection policy for daily backups in the Windows 2012 Server:

a. In the Name field, specify the name of the protection policy. For example, File System Prod

Managing Protection Policies

112 PowerProtect Data Manager Administration and User Guide

Note: The name that you specify here becomes part of the Data Domain MTree entry.

b. In the Description field, specify a short description of the protection policy. For example, File System Prod Daily Backups

c. In theType field, select File System.

d. Click Next.

The Purpose page appears.

4. In the Purpose page, specify the following fields to indicate the purpose of the new protection policy:

a. The type of protection policies group.

For File System, you can select from three types:

l To use PowerProtect Data Manager to manage all protection centrally, click Centralized Protection

l To use the File System to create local backup protection, click Self- Service Protection. PowerProtect Data Manager creates a protection policy and manages extra stages.

l If there are assets within the protection policy that you plan to exclude from data protection operations, click Exclusion.

b. Click Next.

The Assets page appears.

5. Select the unprotected assets that you want to add to the backup of this protection policy group. The window enables you to filter by asset name to locate the required assets.

Additionally, you can change the assets view to display all assets discovered by PowerProtect Data Manager, or a hierarchical view to display the assets in a tree structure underneath the application host. A hierarchical view might be helpful, for example, if you have added multiple File Systems, so that you can more easily identify which assets belong to which host.

Note: PowerProtect Data Manager does not support including CSV and non-CSV volumes in the same protection policy.

6. Click Next.

If you selected Exclusion in the Purpose page, the Summary page appears. Proceed to the final two steps.

If you selected Centralized Protection or Self-Service Protection, the Schedule page appears.

7. Click + Backup.

The Add Primary Backup dialog box appears.

8. Specify the backup schedule fields:

l For Centralized Protection:

a. In the Recurrence field, select the interval at which the backup job runs within the window that you specify. Recurrence relates to Start Time and End Time fields.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 113

When you select Hourly, Daily,Weekly, and Monthly recurrence, you are selecting the interval at which the backup job runs within the window that you specify.

b. In the Create Full (Level 0) field, specify the interval in hours to create a full backup. The interval should be between 1 hour to 12 hours.

c. To create an incremental cumulative backup, click Incremental Cumulative, and then specify the interval in minutes.

d. To create an incremental differential backup, click Incremental Differential, and then specify the interval in minutes.

e. To create a log, click Log, and then specify the interval in minutes.

f. In the Keep For field, specify the retention time.

g. In the Start Time field, specify the time when new backups will be initiated in this policy.

h. In the End Time field, specify the time after which no new backup will be initiated in this policy. It does not mean that any policy that is running is stopped at this time.

i. Click OK. The Schedule page updates with the newly added backup schedule.

l For Self-Service Protection:

a. In the Keep For field, specify the retention time.

b. Click OK.

After completing a backup schedule, you can change any schedule details by selecting the checkbox next to the added schedule and clicking Edit.

9. To run another backup of this protection policy with a different schedule:

a. Select the check box next to the added schedule and click + Backup.

b. Complete the schedule details in the Add Promotion Backup dialog box, and then click OK.

10. To replicate these backups to a remote Data Domain system:

a. Select the checkbox next to the added schedule and click Replicate.

b. Complete the schedule details in the Add Primary Replication dialog box, and then click OK.

Note: To enable replication, ensure that you add a remote Data Domain system as the replication location. Add Protection Storage provides detailed instructions about adding a remote Data Domain system.

11. Select the check box next to the added schedule.

When you select the check box, the SLA, Storage Name, and Network interface lists are enabled for selection.

12. From the SLA list, select an existing service level agreement that you want to apply to this schedule, or select Add to create a SLA within the Add Backup Service Level Agreement window. Add a Service Level Agreement provides instructions.

13. From the Storage Name list:

l Select the backup destination from the list of existing Data Domain systems.

Managing Protection Policies

114 PowerProtect Data Manager Administration and User Guide

l To add a system, select Add, and complete the details in the Storage Target window. Add Protection Storage provides instructions.

When you select the destination storage, the Space field updates with the available capacity on the system.

14. From the Network interface list, select a network interface card (NIC), if applicable.

15. Click Set Storage Quotas to set storage space restrictions for a Data Domain MTree or Storage Unit to prevent the consumption of excess space. There are two kinds of quota limitshard limits and soft limits. You can set either a soft or hard limit or both a soft and hard limit. Both values must be integers, and the soft value must be less than the hard value.

Note: When you set a soft limit and the limit is reached, an alert is generated but data can still be written to the Data Domain. When you set a hard limit and the limit is reached, data cannot be written to the MTree. Therefore, all data protection operations fail until data is deleted from the MTree. The Data Domain Operating System Administration Guide provides more information about MTree quota configuration.

a. Capacity Quota Controls the total size of pre-compression data written to the Data Domain.

b. Stream Quota The number of concurrent streams allowed on the system during data protection operations. Setting a Stream Quota limit can help ensure that system performance is not impacted negatively if a data protection operation is consuming too many system resources.

16. Select the Retention Lock check box to enable retention locking for these backups on the selected system.

Note: Primary backups are assigned a default retention lock period of 14 days. Replicated backups, however, do not get assigned a default retention lock period. If you select this check box for a replicated backup, ensure that you set the Keep For field in the Add Primary Replicate backup schedule dialog box to a minimum number of 14 days so that the replicated backup does not expire before the primary backup.

17. Click Next.

The Summary page appears.

18. Review the protection policy group configuration details. You can click Edit next to any completed window's details to change any information. When completed, click Finish.

An informational message appears to confirm that PowerProtect Data Manager has saved the protection policy. When the new protection policy is created, PowerProtect Data Manager automatically performs a full backup.

19. Click OK to exit the window, or click Go to Jobs to open the Jobs window to monitor the backup of the new protection policy group.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 115

Add a Cloud Tier protection policy Add a protection policy for backups to cloud tier.

Before you begin

Ensure that a Data Domain system is set up for cloud tiering. See Add Data Domain cloud protection storage on page 41.

Procedure

1. Log in to PowerProtect Data Manager with administrator credentials.

2. Select Protection > Protection Policies > Add.

3. On the Type page, enter a name and description, select the type of system to back up, and click Next.

4. On the Purpose page, select the purpose (Crash Consistent, Application Aware, or Exclusion).

5. On the Assets page, select the assets to be protected with this policy and click Next.

6. On the Schedule page, select Backup.

7. On the Add Primary page, set the following parameters, and then click OK:

l RecurrenceCloud Tier backup requires a minimum of 2 weeks.

l Keep forCloud Tier backup requires a minimum of 2 weeks.

l Optionally, change the Start Time and/or End Time.

8. Select the protection policy that you created and select Cloud Tier.

9. In the Add Cloud Tier dialog box, set the following parameters and then click OK:

l Select the appropriate target from the Cloud Target list.

l For Tier After, set a time of at least 2 weeks.

The Cloud Tier protection policy is created.

10. Click Next, verify the information, and then click Finish.

A new job is created, which you can view under the Jobs tab after the job completes.

Edit a protection policy Use the PowerProtect Data Manager UI to edit a protection policy's name, description, or schedule.

About this task

You can also edit a protection policy to add or remove assets. Add or remove assets in a protection policy on page 117 provides instructions.

Note: You cannot modify a protection policy type or purpose.

Procedure

1. Select Protection > Protection Policy.

The Protection Policy window appears.

Managing Protection Policies

116 PowerProtect Data Manager Administration and User Guide

2. Select the protection policy that you want to modify, and click Edit.

The Edit Policy window opens on the Summary page.

3. In the Name, Description, or Schedule rows, click Edit.

The Edit Policy window displays the appropriate page according to your selection. For example, if you click Edit next to the Name or Description rows, the Type page appears.

4. After making your changes, click Next to save the changes and proceed to the Summary page.

5. On the Summary page, click Finish

An informational dialog displays

6. Click OK to exit the dialog, or click Go to Jobs to open the Jobs window to monitor the backup of the new protection policy.

Add or remove assets in a protection policy Use the PowerProtect Data Manager UI to add or remove an asset in a protection policy.

About this task

When a protection policy is edited and new assets are added, backups for the new assets start from the next scheduled FULL backup job for the protection policy.

Procedure

1. Select Protection > Protection Policy.

The Protection Policy window appears.

2. Select the protection policy that you want to modify, and click Edit.

The Edit Policy window opens on the Summary page.

3. In the Assets row, click Edit.

The Assets page appears.

4. To add an asset to the protection policy, click + Add.

The Add Unprotected Assets dialog displays any assets that are unprotected.

5. Select the unprotected assets that you want to add to the policy, and click Add.

The added assets now appear in the table on the Assets page.

6. To remove assets, select the assets that you want to remove from the backup of this protection policy, and click Delete.

The window enables you to filter by asset name to locate the required assets. You can change the assets view to display all assets that are discovered by PowerProtect Data Manager.

7. Click Next to save the changes and go to the Summary page.

8. In the Summary page, click Finish

An informational dialog box appears.

9. Click OK to exit the dialog box, or click Go to Jobs to open the Jobs window to monitor the backup of the new protection policy.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 117

Removing expired backup copies PowerProtect Data Manager deletes the backup copies of an asset automatically when the retention period of the copy expires.

Information about retention periods for each type of policy schedule is provided in the section Policy retention time considerations on page 98.

In order for an expired copy to be deleted, the asset must be managed by PowerProtect Data Manager and in one of the following states:

l Protected The asset is currently assigned to a protection policy.

l Previously Protected The asset has been unassigned from a protection policy and has not yet been re-assigned to another policy.

The automatic deletion is performed during the Manage Copies job, which consists of a batch of tasks for all assets in the policy.

Note: For virtual machine assets, you can also manually delete a backup copy at any time from the Assets window if you no longer require the copy and the retention lock is not enabled. Additional options for managing virtual machine backups on page 105provides more information.

Export protection This allows you to export protection jobs and compliance records to a .CSV file so that you can download an Excel file of protection results data.

Procedure

1. Select Protection > Protection Policy.

The Protection Policy window appears, which displays the following information:

l Asset type

l Purpose

l Group Name

l Number of Protected Assets

l Asset Capacity

l Number of Failures

l Number of SLA Violations

2. Select the protection policy for which you would like to export the protection records.

If you do not select a protection policy, PowerProtect Data Manager exports the protection records for all the protection policies.

3. Click Export.

The Export Asset Protection window appears.

4. Specify the following fields for the export:

a. The Time Range.

The default is Last 24 hours.

Managing Protection Policies

118 PowerProtect Data Manager Administration and User Guide

This refers to the last complete midnight-to-midnight 24-hour period; that is, yesterday. So, any events that have occurred since the most recent midnight are not in the CSV export. For example, if you run the CSV export at 9am, any events that have occurred in the last 9 hours are not in the CSV export. This is to prevent the overlapping of or partial exporting when queried mid-day on a regular or irregular basis.

b. The Job Status.

c. Click Download .CSV.

If applicable, the navigation window appears for you to select the location to save the CSV file.

5. If applicable, save the .CSV file in the desired location and then click Save.

Delete a protection policy You can delete a protection policy that is not protecting any assets.

Before you begin

If the policy you want to delete is protecting assets, you must associate those assets with a different protection policy before you can delete the policy.

About this task

Use the PowerProtect Data Manager UI to delete a protection policy.

Procedure

1. Select Protection > Protection Policy.

2. Select the policy you want to delete and click Delete.

Add a Service Level Agreement The SLA Compliance window in the PowerProtect Data Manager UI allows you to add a service level agreement (SLA) that identifies your Service Level Objectives (SLOs). You use the SLOs to verify that your protected assets are meeting the Service Level Agreements (SLAs).

Procedure

1. Select Protection > SLA Compliance.

The SLA Compliance window displays with the following information:

l SLA Name

l Stage Type

l Policies At Risk

l Objectives Out of Compliance

l Impacted Assets

2. Select the type of asset for which you want to add the SLA, and click Add.

The Add Service Level Agreement Type window appears.

3. Select the type of SLA that you want to add, and then click Next.

l Policy. If you choose this type, go to step 4

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 119

l Backup. If you choose this type, go to step 5.

l Promotion. If you choose this type, go to step 6.

l Replication. If you choose this type, go to step 7.

You can select only one type of Service Level Agreement.

4. If you selected Policy, specify the following fields regarding the purpose of the new Policy SLA:

a. The SLA Name.

b. If applicable, select Minimum Copies, and specify the number of Backup and Replication.

c. If applicable, select Maximum Copies, and specify the number of Backup and Replication.

d. If applicable, select Available Location and select the applicable locations. To add a location, click Add Location.

Options are:

l InInclude locations of all copies in the SLO locations. Does not require every SLO location to have a copy.

l Must InInclude locations of all copies in the SLO locations. Requires every SLO location to have at least one copy.

l ExcludeLocations of all copies must be other than SLO locations.

e. Click Finish and go to step 9.

5. If you selected Backup, specify the following fields regarding the purpose of the new Backup SLA:

a. The SLA Name.

b. If applicable, select Recovery Point Objective (RPO), and then set the duration. The purpose of a RPO is business continuity planning, and refers to the maximum targeted period in which data (transactions) might be lost from an IT service due to a major incident.

Note: You can select only Recovery Point Objective to configure as an independent objective in the SLA, or select both Recovery Point Objective and Compliance Window. If you select both, the RPO setting must be one of the following:

l Greater than 24 hours or more than the Compliance window duration, in which case RPO validation will occur independent of the Compliance Window.

l Less than or equal to the Compliance Window duration, in which case RPO validation will occur within the Compliance Window.

c. If applicable, select Compliance Window, and then set the duration, which refers to the time it takes to create the backup copy. Ensure that the Start Time and End Time of backup copy creation falls within the Compliance Window duration specified.

These are the times in which you can expect the specified activity to take place. Any specified activity that occurs outside of this Start Time and End Time triggers an alert.

Managing Protection Policies

120 PowerProtect Data Manager Administration and User Guide

d. If applicable, select the Verify expired copies are deleted option.

Verify expired copies are deleted is a compliance check to see if PowerProtect Data Manager is deleting expired copies. This option is disabled by default.

e. If applicable, set the Retention Time Objective, and specify the number of Days, Months, Weeks or Years.

f. If applicable, select the Verify Retention Lock is enabled for all copies option. This option is disabled by default.

g. Click Finish, and go to step 9.

The SLA Compliance window appears with the newly added SLA.

6. If you selected Promotion, specify the following fields regarding the purpose of the new Promotion SLA:

a. The SLA Name.

b. If applicable, specify the Recovery Point Objective.

c. If applicable, select the Verify expired copies are deleted option.

Verify expired copies are deleted is a compliance check to see if PowerProtect Data Manager is deleting expired copies. This option is disabled by default.

d. If applicable, set the Retention Time Objective, and specify the number of Days, Months, Weeks or Years.

e. If applicable, select the Verify Retention Lock is enabled for all copies option. This option is disabled by default.

f. Click Finish, and go to step 9.

The SLA Compliance window appears with the newly added SLA.

7. If you selected Replication, specify the following fields regarding the purpose of the new Replication SLA:

a. The SLA Name.

b. If applicable, select the Compliance Window, and specify the Start Time and End Time.

These are the times which are permissible and in which you can expect the specified activity to take place. Any specified activity that occurs outside of this start time and end time triggers an alert.

c. If applicable, select the Verify expired copies are deleted option.

Verify expired copies are deleted is a compliance check to see if PowerProtect Data Manager is deleting expired copies. This option is disabled by default.

d. If applicable, set the Retention Time Objective, and specify the number of Days, Months, Weeks or Years.

e. If applicable, select the Verify Retention Lock is enabled for all copies option. This option is disabled by default.

f. Click Finish, and go to step 9.

The SLA Compliance window appears with the newly added SLA.

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 121

8. Add the newly added SLA to the protection policy. Select Protection > Protection Policy.

9. In the Schedule section of the Summary window, click Edit.

10. Do one of the following, and then click Next:

l Select the newly added Policy SLA from the Set Policy Level SLA list.

l Create and add the new SLA policy from theSet Policy Level SLA list.

The Summary window appears.

11. Click Finish.

An informational message appears to confirm that PowerProtect Data Manager has saved the protection policy.

12. Click Go to Jobs to open the Jobs window to monitor the backup and compliance results, or click OK to exit.

Note: Compliance checks occur automatically every day at 2 am Coordinated Universal Time (UTC).

13. In the Jobs window, click > next to an entry to view details on the SLA Compliance result.

Export Asset Compliance This allows you to export compliance records to a CSV file so that you can download an Excel file of compliance results data.

Procedure

1. Select Protection > SLA Compliance.

The SLA Compliance window appears. The PowerProtect Data Manager SLA Compliance window displays the following information:

l SLA Name

l Stage Type

l Policies At Risk

l Objectives Out of Compliance

l Impacted Assets

2. Select the SLA for which you would like to export the compliance records.

3. Click Export Asset Compliance.

The Export Asset Compliancewindow appears.

4. Specify the following fields for the export:

a. The Time Range.

The default is Last 24 hours.

This refers to the last complete midnight-to-midnight 24 hour period; that is, yesterday. So, any events that have occurred since the most recent midnight are not included in the CSV export. For example, if you run the CSV export at 9am, any events that have occurred in the last 9 hours are not included in the CSV export. This is to prevent the overlapping of or partial exporting when queried mid-day on a regular or irregular basis.

Managing Protection Policies

122 PowerProtect Data Manager Administration and User Guide

b. The Job Status.

c. Click Download .CSV .

If applicable, the navigation window appears for you to select the location to save the CSV file.

5. If applicable, save the CSV file in the desired location and click Save.

Dynamic filters Dynamic filters allow to automatically determine which assets get assigned to protection policies when the assets are discovered, based on the filter's rule definitions (rules for inclusion).

When you define a dynamic filter for a protection policy, note the following requirements:

l A protection policy must exist prior to creating the dynamic filter.

l An asset can only belong to one protection policy.

l Virtual machine tags created in the vSphere Client can only be applied to a dynamic filter.

l To ensure the protection of homogeneous assets, the dynamic filter must specify a storage asset type.

l A virtual machine application-aware protection policy that protects a Microsoft SQL Server Always On availability group (AAG) must include all the virtual machines of the AAG in the same protection group. Failure to meet this requirement might result in Microsoft SQL Server transaction log backups being skipped. Ensure that the dynamic filters are designed to include all the AAG virtual machines.

Creating virtual machine tags in the vSphere Client Creating virtual machine tags in the vSphere Client is supported by PowerProtect Data Manager with vSphere versions 6.5 and later. Tags enable you to attach metadata to the virtual assets in the vSphere inventory, which makes assets easier to sort and search for when creating a protection policy.

Asset inclusion in a PowerProtect Data Manager protection policy is based on the filtering criteria applied to user-defined rules that you specify when creating a dynamic filter.

When you create a tag in the vSphere Client, the tag must be assigned to a category in order to group related tags together. When defining a category, you can specify the object types to which the tags will be applied and whether more than one tag in the category can be applied to an object. Within a single rule, you can apply up to 50 rule definitions to tags and categories, as shown in the following example where Category is the category name and Bronze is the tag name:

l Category:Category1,Tag:Bronze1

l Category:Category2,Tag:Bronze2

l Category:Category3,Tag:Bronze3

l ... Category:Category50,Tag:Bronze50

In the above example, category names and tag names that exceed 9 or 7 characters respectively, reduce the limit for rule definitions in a single rule to less than 50. When rule definitions exceed the maximum limit, no virtual machines are backed up as part of the group, because no members are associated with the group. As a best practice,

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 123

keep the number of rule definitions within a single rule to 10 or fewer and, in cases where there are a large number of rule definitions within a single rule, keep the number of characters in category or tag names to 10 or fewer.

To view existing tags for vCenter in the vSphere Client, select Menu > Tags & Custom Attributes, and then select the Tags tab. Click a tag link in the table to view the objects associated with this particular tag.

For PowerProtect Data Manager to include tagged assets in a dynamic filter based on the tags created for the vCenter, you must assign at least one tag to at least one virtual machine. Note that tags associated with containers of virtual machines (for example, a virtual machine folder) are not currently supported for tag associations to assets.

Note: Once virtual machines are associated with tags, the association is not reflected in the PowerProtect Data Manager UI until the timeout period has completed. The default timeout to fetch the latest inventory from vCenter is 15 minutes. When adding a dynamic filter and using tags as the asset filter, you must select VM Tags.

Add a dynamic filter Use the PowerProtect Data Manager UI to add dynamic filters. When an asset meets the filter conditions, the asset is automatically assigned to the protection policy that you define for the dynamic filter.

Before you begin

Procedure

1. Select Protection > Dynamic Filter.

The Dynamic Filter window appears, which displays the following information:

l Dynamic Filter Name

l Priority

l Asset Filter

l Assigned Protection Policy

2. Click the Virtual Machines, SQL Databases, Oracle Databases, or File System tab to select the type of host for which you would like to add the dynamic filter, and then click Add .

The Add Dynamic Filter wizard opens on the Protection Policy page.

3. Select the target protection policy for the dynamic filter and click Next.

The Asset Filter page appears.

4. Specify the following fields to indicate the purpose of the new Dynamic Filter:

a. Name For example, SQL Rules Prod Finance b. Description For example, SQL Rules Prod Servers Finance.

Field: Using the three fields, build an asset filter that matches your purpose.

l From the list in the first field, select an asset name (such as Datacenter Name), characteristic (such as asset size), or a tag (VM Tags) that will be used as the rule criteria when searching for assets.

l From the list in the second field, select the matching criteria. For an asset name, you can select from several options including Begins with,

Managing Protection Policies

124 PowerProtect Data Manager Administration and User Guide

Ends with, Contains, or Equals. For an asset characteristic such as size, you can select Greater than or Less than. For a virtual machine tag, you can only select Includes.

l In the third field, type a search phrase to apply to the rule criteria to determine a match.

For example, a rule with the filters SQL Server Instance Name, Contains, and Finance helps you create a rule to match the assets in your finance department to the selected protection policy.

c. Click Apply.

Any asset that matches the rule and is not currently included in a PowerProtect Data Manager protection policy displays in the Unprotected Assets matching filter table

d. Verify that the asset(s) that display in the Unprotected Assets matching filter table are the assets that you want to include in the protection policy. If not, clear the filter to view all unprotected assets and build your filter again.

e. Click Next.

The Summary page appears.

5. Click Finish.

Results

The dynamic filter gets run automatically upon creation.

Manually run a dynamic filter PowerProtect Data Manager automatically runs dynamic filters upon creation and when trigger events occur. You also can run dynamic filters on-demand.

Procedure

1. Select Protection > Dynamic Filter.

The Dynamic Filter window appears, which displays the following information:

l Dynamic Filter Name

l Priority

l Asset Filter

l Assigned Protection Policy

2. Select the desired dynamic filter(s) and click Run.

PowerProtect Data Manager runs all dynamic filters of the current asset type.

Edit or delete a dynamic filter Use the PowerProtect Data Manager UI to edit a dynamic filter. You can change the filter name, description, the filter itself, and the associated protection policy.

Procedure

1. Select Protection > Dynamic Filter.

The Dynamic Filter window appears, which displays the following information:

l Dynamic Filter Name

Managing Protection Policies

PowerProtect Data Manager Administration and User Guide 125

l Priority

l Asset Filter

l Assigned Protection Policy

2. Select a dynamic filter and click Edit .

The Summary window appears.

3. To edit the name or description of the dynamic filter, modify the desired fields and click Finish.

4. To delete a dynamic filter, select the dynamic filter and click Delete.

When you click Delete, PowerProtect Data Manager will remove the assets that you added by dynamic filters. PowerProtect Data Manager will add those assets again if you do not update related dynamic filters.

Change the priority of the existing dynamic filter Use the PowerProtect Data Manager UI to change the priority of a dynamic filter.

About this task

When multiple dynamic filters exist, you can define the priority of the dynamic filter. Priority determines which dynamic filter PowerProtect Data Manager applies for an asset if an asset matches multiple dynamic filters, and if the matching dynamic filters have conflicting actions. For example, if an asset protection policy assignment matches several dynamic filters and each dynamic filter specifies a different protection policy assignment, the protection policy is determined by the dynamic filter with the highest priority.

An integer is used to represent the priority of the dynamic filter. The smaller value has the higher priority.

Procedure

1. Select Protection > Dynamic Filter.

The Dynamic Filter window appears, which displays the following information:

l Dynamic Filter Name

l Priority

l Asset Filter

l Assigned Protection Policy

2. To change a dynamic filter's priority, select the dynamic filter and click Up or Down.

The smaller value has the higher priority.

Managing Protection Policies

126 PowerProtect Data Manager Administration and User Guide

CHAPTER 9

Restoring Data and Assets

This section includes the following topics:

l View copies.......................................................................................................128 l Restore a virtual machine................................................................................. 128 l Restore an application-aware virtual machine backup.......................................138 l Performing centralized restore of a File System host....................................... 138 l Restore the PowerProtect Data Manager server ............................................. 140 l Restore operations for cloud tier...................................................................... 140

PowerProtect Data Manager Administration and User Guide 127

View copies You can view summaries of protected copy sets in the system. PowerProtect Data Manager displays details such as the name of the storage system that contains the copy set, system usage, location, date the copy set was created, date the copy set expires, size, and recovery time.

Procedure

1. From the PowerProtect Data Manager UI, select Infrastructure > Assets. Alternatively, select Recovery > Assets.

All the assets in the system display.

2. Select an asset, or select one of the following tabs to view assets by type:

l Virtual Machines.

l Oracle Databases.

l SQL Databases.

l File System.

The entire list of assets that are associated with this type displays in the right pane.

Note: You can also search for assets by name.

3. To view more details, select an asset and click View copies.

The copy map consists of the root node and its child nodes. The root node in the left pane represents an asset, and information about copy locations displays in the right pane. The child nodes represent storage systems. When you click a child node, the right pane displays the storage system where the copy is stored, the number of copies, and details of each copy, including the time that each copy was created, the size of the copy, the backup type, and the retention time.

Restore a virtual machine After virtual assets are backed up as part of a virtual machine protection policy in the PowerProtect Data Manager UI, you can perform image-level and file-level recoveries from individual or multiple virtual machine backups.

All types of recoveries are performed from the Recovery > Assets window. Recovery options include the following:

l Restore to the original virtual machine (image-level restore)

l Restore to a new virtual machine (image-level restore)

l Restore multiple virtual machines (image-level restore)

l Instant access virtual machine (instant access to the virtual machine)

l File-level restore (to the original or a new virtual machine)

l Direct Restore to ESXi (recover the virtual machine directly to an ESXi host without a vCenter server)

The Restore button, which launches the Restore wizard, is disabled until you select one or more virtual assets in the Recovery > Assets window. Selecting multiple assets

Restoring Data and Assets

128 PowerProtect Data Manager Administration and User Guide

disables the View Copies button, since this functionality is available within the first page of the Restore wizard.

To access the Restore to Original, Restore to New, and Instant Access Virtual Machine recovery options, select one or more virtual assets and then click Restore to launch the Restore wizard.

To access the File Level Restore and Direct Restore to ESXi recovery options, select a virtual asset and then click View Copies.

In both instances, you must select a backup copy in the first page of the Restore wizard before you can go to the Options page, which displays the available recovery options.

Note: For all options, recovery in the PowerProtect Data Manager UI can only be performed if the backup or replica is on a Data Domain system. If a replica backup does not exist on such storage, you must manually replicate this backup to Data Domain storage before performing the restore.

The following sections describe each recovery option and provide instructions to perform the recovery.

Note: SQL virtual machine full database and transaction log restore from application-aware virtual machine protection policies must be performed using Microsoft application agent tools. The section Restore an application-aware virtual machine backup provides more information.

Prerequisites to restore a virtual machine Review the following requirements before you restore a virtual machine in PowerProtect Data Manager:

l Users who want to perform a virtual machine restore must have Admin or Export and Recovery Admin privileges. Go to Administration > Roles and review the user profile to ensure that the user has the appropriate privileges. A user with the role "User" cannot perform a restore.

l Ensure that you have added the Data Domain system, the Data Domain Management Center (DDMC) or Data Domain Virtual Edition (DDVE), and the vCenter server, and that the protection of virtual machine copies has completed successfully. To check, go to Infrastructure > Assets and Infrastructure > Asset Sources.

l Ensure that protection of the virtual machines completed successfully. If the virtual machines have been backed up by a protection policy, the assets appear in the Recovery > Assets window.

l If performing a restore to a new location, ensure that sufficient space is available on the target datastore.

l Verify that the virtual machine copy that is selected for restore has not expired.

Restore to original Restoring to the original location recovers a virtual machine backup to its original location on the vCenter, rolling the virtual machine that you backed up with the protection policy in PowerProtect Data Manager to an earlier point in time. Use this process for restoring the production system.

Before you begin

Review Prerequisites to virtual machine restore before you perform the following procedure.

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 129

About this task

Note: If the original virtual machine was deleted, a Restore to Original attempts to re-create the virtual machine. However, if the original virtual machine resources such as the datastore and cluster are no longer available, the restore fails and a Restore to New is required.

Procedure

1. In the PowerProtect Data Manager UI, select Recovery > Assets and select the Virtual Machines tab.

The Recovery window displays all virtual machines available for recovery.

2. Select the checkbox next to the appropriate virtual machines and click Restore.

You can also use the filter in the Name column to search for the name of the specific virtual machine.

The Recovery wizard appears.

3. On the Select Copy page, for each virtual machine that is listed in the table, select the radio button next to the virtual machine and click Choose Copy.

The Choose Copy dialog appears. Note: If you click Next without choosing a copy, the most recent backup copy is used.

4. If the backup is on a Data Domain system, click DD, and then select from one of the available copies that display in the table.

5. Click OK to save the selection and exit the dialog, and then click Next.

6. On the Options page, for the restore type select Restore to Original.

The Summary page appears with a confirmation message indicating that the virtual machine will be powered off and that the virtual machine in the datastore will revert to the point in time of the selected backup copy before being powered on.

7. On the Summary page, click Restore.

An informational dialog box appears indicating that the restore has started.

8. Go to the Jobs window to monitor the restore.

A restore job appears with a progress bar and start time.

Restore to new A restore to a new location enables you to create a new virtual machine using a copy of the original virtual machine backup. Other than having a new name or location and a new vSphere VM Instance UUID, this copy is an exact replica of the virtual machine that you backed up with the protection policy in PowerProtect Data Manager.

Before you begin

Review Prerequisites to virtual machine restore before you perform this procedure.

Procedure

1. Select the checkbox next to the appropriate virtual machines and click Restore.

You can also use the filter in the Name column to search for the name of the specific virtual machine.

The Recovery wizard appears.

Restoring Data and Assets

130 PowerProtect Data Manager Administration and User Guide

2. On the Select Copy page, for each virtual machine that is listed in the table, select the radio button next to the virtual machine and click Choose Copy.

The Choose Copy dialog appears. Note: If you click Next without choosing a copy, the most recent backup copy is used.

3. If the backup is on a Data Domain system, click DD, and then select from one of the available copies that display in the table.

4. Click OK to save the selection and exit the dialog, and then click Next.

5. On the Options page:

a. For the restore type, select Restore to New.

b. For Select Access Level, keep the slider set to Yes if you want to enable instant access for this restore.

When you select this option, the virtual machine is created and powered on while temporarily accessing the VMDKs from Data Domain storage. Storage vMotion is initiated to the target datastore. The virtual machine becomes available for use when it is powered on.

c. (Optional) For the recovery options, select Power on the virtual machine when the recovery completes and Reconnect the virtual machine's NIC when the recovery completes. Power on the virtual machine when the recovery completes is selected by default when instant access is enabled.

d. Click Next.

6. On the VM Information page:

a. Select whether you want to use the original virtual machine name or rename the new virtual machine by appending a suffix to the original name. If the location for the new virtual machine restore will be a different folder than the original location, you can use the original name.

b. From the Restore to vCenter list, select the vCenter server for the new virtual machine restore. This list displays any vCenter server that has been added from the Assets window.

When you select a vCenter server, available data centers appear.

c. Select the destination data center.

d. Click Next.

7. On the Restore Location page, select the location within this data center that you want to restore the virtual machine by expanding the hierarchical view. For example, select a specific cluster, and then select a host within the cluster. If you select an ESX host within this page, the next page is unnecessary. Click Next.

8. On the ESX Host page:

l If you did not select a specific host in the previous step, select a host that is connected with the cluster, and then click Next.

l If you selected a host in the previous step, this page indicates that a host is already selected and you can click Next to proceed.

9. On the Disk Files Datastore page, select the datastore where you want to restore the virtual machine disks, and then click Next.

l To restore all disks to the same location, keep the Configure per disk slider to the left, and then select the datastore from the Storage list.

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 131

l To restore disks to different locations, move the Configure per disk slider to the right, and then:

a. Select a datastore for each disk from the Storage list.

b. Select the type of provisioning you want to apply to the disk from the Disk Format list.

10. On the Summary page, verify that the information you specified in the previous steps is correct, and then click Restore.

11. Go to the Jobs window to monitor the restore.

A restore job appears with a progress bar and start time. You can also click More Details next to the job to verify what steps have been performed, for example, if the instant access session has been created.

Restore an instant access virtual machine An instant access virtual machine restore enables you to create a new virtual machine directly from the original virtual machine backup on the Data Domain system for the purposes of instant backup validation and recovery of individual files. The instant access virtual machine is initially available for 7 days. This process does not copy or move any data from the Data Domain system to the production datastore. An instant access virtual machine restore also provides the option to move the virtual machine to a production datastore if you want to retain access to the virtual machine for a longer time.

Procedure

1. Select the checkbox next to the desired virtual machines and click Restore.

You can also use the filter in the Name column to search for the name of the specific virtual machine.

The Recovery wizard appears.

2. On the Select Copy page, for each virtual machine that is listed in the table, select the radio button next to the virtual machine and click Choose Copy.

The Choose Copy dialog appears. Note: If you click Next without choosing a copy, the most recent backup copy is used.

3. If the backup is on a Data Domain system, click DD, and then select from one of the available copies that display in the table.

4. Click OK to save the selection and exit the dialog, and then click Next.

5. On the Options page:

a. For the restore type, select Instant Accss Virtual Machine.

b. (Optional) For the recovery options, select Power on the virtual machine when the recovery completes and Reconnect the virtual machine's NIC when the recovery completes, if desired. Power on the virtual machine when the recovery completes is selected by default for instant access virtual machine restores.

c. Click Next.

6. On the VM Information page:

a. Select whether you want to use the original virtual machine name for the instant access virtual machine restore, or rename the instant access virtual machine by appending a suffix to the original name.

Restoring Data and Assets

132 PowerProtect Data Manager Administration and User Guide

b. From the Restore to vCenter list, select the vCenter server for the instant access virtual machine restore. You can select the vCenter of the original virtual machine backup, or another vCenter. This list displays any vCenter server that has been added from the Assets window.

When you select a vCenter server, available data centers appear.

c. Select the destination data center.

d. Click Next.

7. On the Restore Location page, select the location within this data center that you want to restore the virtual machine by expanding the hierarchical view. For example, select a specific cluster, and then select a host within the cluster. If you select an ESX host within this page, the next page is unnecessary. Click Next.

8. On the ESX Host page:

l If you did not select a specific host in the previous step, select a host that is connected with the cluster, and then click Next.

l If you selected a host in the previous step, this page indicates that a host is already selected and you can click Next to proceed.

9. On the Summary page, verify that the information you specified in the previous steps is correct, and then click Restore.

A confirmation message displays indicating that the restore has been initiated and providing the option to go to the Jobs window to monitor the restore progress.

10. Go to the Jobs window to view the entry for the instant access virtual machine recovery and verify when the recovery completes successfully. You can also click More Details next to the job to verify what steps have been performed, for example, if the instant access session has been created.

Results

To monitor and manage the instant access virtual machine recovery, select Recovery > Instant Access sessions. You can extend the instant access virtual machine session beyond the default period of 7 days.

Manage and monitor Instant Access Sessions The Instant Access Sessions window allows you to manage the status of a virtual machine restore to new or instant access virtual machine restore (for example, by extending the availability period or deleting an instant access virtual machine) and monitor vMotion events.

Note: The Instant Access Sessions used by a SQL application-aware self-service restore are displayed in the PowerProtect Data Manager UI, but management is disabled. Use the SQL application-aware self-service restore UI to manage these sessions.

When the Jobs window indicates that a recovery has completed successfully, go to Restore > Instant Access sessions to access the Managing Instant Access Sessions window. This window allows you to monitor and manage all exported copies that you have created from the Data Domain system. An active restore session with a state of Mounting indicates that the restore is still in progress. Once the state changes to Mounted, the restore is complete and the instant access virtual machine is ready. When you select the checkbox next to the session, you can choose from three options, as shown in the following figure.

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 133

Figure 9 Instant access session with instant access virtual machine

l Extend Click to extend the number of days the instant access virtual machine restore is available. The default retention period of an instant access virtual machine restore is 7 days.

l Migrate Click to open the Migrate Storage vMotion wizard, which allows you to move the instant access virtual machine to a protection datastore. Migrate an instant access session provides instructions.

l Delete Click if you no longer require the active restore session. Note that you can also vMotion from inside of the vCenter server, and PowerProtect Data Manager will remove the Instant Access Session upon detection.

For instant access virtual machine restores, availability of the instant access virtual machine session is also indicated in the vSphere Client. The session appears in the Recent Tasks pane, and you can expand the cluster and select the instant access virtual machine to view summary information, as shown in the following figure. Figure 10 instant access virtual machine restore in the vSphere Client

Migrate an Instant Access session Once you validate that the instant access virtual machine is the virtual machine that you require for production, click Migrate to open the Migrate Storage vMotion wizard, which allows you select the session and move the virtual machine to a production datastore.

Procedure

1. In the Instant Access Sessions window, select a session from the table that is in Mounted state, and click Migrate.

Restoring Data and Assets

134 PowerProtect Data Manager Administration and User Guide

The Migrate Storage vMotion wizard displays.

2. On the Disk Files Datastore page, select the datastore where you want to relocate the instant access virtual machine, and then click Next.

l To migrate all VMDKs to the same datastore, keep the Configure per disk slider to the left, and then select the datastore from the Storage list.

l To migrate VMDKs to separate datastores, move the Configure per disk slider to the right, and then:

a. Select a datastore for each disk from the Storage list.

b. Select the type of provisioning you want to apply to the disk from the Disk Format list.

3. On the Summary page, review the information to ensure that the details are correct, and then click Migrate.

4. Go to the Jobs window or the Instant Access Sessions window to view the progress of the migration.

In the Jobs window, the migration job appears with a progress bar and start time. You can also click More Details next to the job to verify what steps have been performed. In the Instant Access Sessions window, you can monitor the vMotion status of the migration. When a vMotion is in progress, the status indicates VMotioning. Once the storage vMotion for the session is complete, the status of the session changes to Deleting as the session is being removed from the Instant Access Sessions window.

File level restore A file level restore allows you to recover individual files from backups of virtual machines or VMDKs performed in PowerProtect Data Manager to a primary or secondary vCenter server.

Before you begin

Review the section Supported platform versions for file-level restore for supported platform and operating system versions.

PowerProtect Data Manager only supports file level restore if the backup or replica is on a Data Domain device. If a replica backup does not exist on such storage, you must manually replicate this backup to Data Domain before performing the file level restore.

About this task

Note: File level restore in the PowerProtect Data Manager UI can only be performed by an administrator.

Procedure

1. In the PowerProtect Data Manager UI, go to Recovery > Assets and select the Virtual Machines tab.

The Recovery window displays all of the virtual machines available for recovery.

2. Select the checkbox next to the desired virtual machine and click View Copies.

You can also use the filter in the Name column to search for the name of the specific virtual machine.

The Recovery > Assets window provides a map view in the left pane and copy details in the right pane. When a virtual machine is selected in the map view, the virtual machine name displays in the right pane with the copy locations underneath. When you select

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 135

a specific location in the left pane to view the copies, for example, on a Data Domain system, the copies on that system display in the right pane.

3. If the backup is on a Data Domain system, click DD, and then select from one of the available copies that display in the table.

4. In the right pane, select the checkbox next to the virtual machine backup you want to restore, and then click File Level Restore.

The File Level Recover wizard appears.

5. On the Select Target VM page, choose from one of the following options:

l Perform the file-level restore to the original virtual machine.

l Search for the destination virtual machine by typing the name.

l Browse from the available vCenter servers to locate the destination virtual machine.

6. On the Mount Copy page:

a. Type the user credentials to access the virtual machine that you want to recover objects to in order to initiate the disk mount. This user should have privileges to install the FLR Agent, which is required to perform file level restore. For Windows virtual machines, this is an administrator account. For Linux virtual machines, this requires the root user account.

Note: Once you approve storing the credentials for the virtual machine, the user credentials prompt will not appear unless the credentials change.

b. (Optional) Leave Keep FLR Agent Installed selected if you want the FLR Agent to remain on the destination virtual machine after the restore completes.

c. Click Start Mount to initiate the disk mount.

A progress bar identifies when the mount has completed. Note: You cannot browse the contents of the virtual machine backup until the mounting of the destination virtual machine completes successfully.

d. When the mount completes successfully, click Next.

7. On the Select Files to Recover page:

a. Expand individual folders to browse the original virtual machine backup, and select the objects you want to restore to the destination virtual machine.

b. Click Next.

Note: When browsing for objects to recover on this page, each directory/ hard drive appears twice. Therefore, when you select an object from one location, the object will be selected in the duplicate location as well.

8. On the Select Restore Location page:

a. Browse the folder structure of the destination virtual machine to select the folder where you want to restore the objects.

b. Click Next.

9. On the Summary page:

a. Review the information to ensure that the restore details are correct.

Restoring Data and Assets

136 PowerProtect Data Manager Administration and User Guide

b. Click Restore.

10. Go to the Jobs window to monitor the restore.

A restore job appears with a progress bar and start time.

Direct Restore to ESXi If the virtual machine you protected with PowerProtect Data Manager was a vCenter virtual machine, but this virtual machine and vCenter is now lost or no longer available, Direct Restore to ESXi allows you to recover the virtual machine directly to an ESXi host without a vCenter server.

Before you begin

Direct Restore to ESXi restore requires either the embedded or an added VM Proxy which is registered to PowerProtect Data Manager.

Additionally, ensure that you disconnect the ESXi host from the vCenter server.

Procedure

1. In the PowerProtect Data Manager UI, go to Recovery > Assets and select the Virtual Machines tab.

The Recovery window displays all of the virtual machines available for recovery.

2. Select the checkbox next to the desired virtual machine and click View Copies.

Note: If you cannot locate the virtual machine, you can also use the filter in the Name column to search for the name of the specific virtual machine.

The Recovery > Asset window provides a map view in the left pane and copy details in the right pane. When a virtual machine is selected in the map view, the virtual machine name displays in the right pane with the copy locations underneath. When you select a specific location in the left pane to view the copies, for example, on a Data Domain system, the copies on that system display in the right pane.

3. If the backup is on a Data Domain system, click DD, and then select from one of the available copies that display in the table.

4. In the right pane, select the checkbox next to the virtual machine backup you want to restore, and then click Direct Restore to ESXi.

The Direct Restore to ESXi wizard appears.

5. On the Options page:

a. (Optional) Select Reconnect the virtual machine's NIC when the recovery completes, if desired. Power on the virtual machine when the recovery completes is selected by default.

b. Click Next.

6. On the ESX Host Credentials page:

a. In the ESX Host field, type the IP of the ESX server where you want to restore the virtual machine backup.

b. Specify the root Username and Password for the ESX Server.

c. Click Next.

7. On the Datastore page, select the datastore where you want to restore the virtual machine disks, and then click Next.

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 137

l To restore all of the disks to the same location, keep the Configure per disk slider to the left, and then select the datastore from the Storage list.

l To restore disks to different locations, move the Configure per disk slider to the right, and then:

a. For each available disk that you want to recover, select a datastore from the Storage list.

b. Select the type of provisioning you want to apply to the disk from the Disk Format list.

8. On the Summary page:

a. Review the information to ensure that the details are correct.

b. Click Restore.

9. Go to the Jobs window to monitor the restore.

A restore job appears with a progress bar and start time.

Restore an application-aware virtual machine backup When virtual machine applications are protected within a protection policy in PowerProtect Data Manager, you can recover the application data using the Microsoft application agent.

The PowerProtect Microsoft Application Agent SQL Server User Guide provides instructions on how to restore an application-aware virtual machine using the VM Direct SQL Server Management Studio (SSMS) plug-in.

Performing centralized restore of a File System host When File Systems are protected within a protection policy in PowerProtect Data Manager, you can recover the File System data using the centralized PowerProtect Data Manager restore functionality, or directly using the self-service restore feature. The following section describes the procedure for centralized restore of File Systems in the PowerProtect Data Manager UI.

Prerequisites for File System restores

Before performing centralized or self-service File System restores:

l Ensure that the target or destination volume is not a system volume.

l Ensure that the File System agent is not installed and running on the target volume.

l Ensure that there is sufficient space on the target volume for the restore.

Centralized restore of File Systems in PowerProtect Data Manager A File System host image-level restore allows you to recover data from backups of file systems performed in PowerProtect Data Manager.

Before you begin

Ensure the following for Linux File System hosts:

l You have disabled Security-Enhanced Linux (SELinux) by running one of the following relevant commands:

n RHEL 7.x or CentOS7.x: setsebool -P nis_enabled 1

Restoring Data and Assets

138 PowerProtect Data Manager Administration and User Guide

n RHEL 6.x or CentOS 6.x: setsebool -P allow_ypbind 1 l You have installed the iscsiadm utility by installing one of the following relevant

packages on the Linux client:

n RHEL or CentOS: iscsi-initiator-utils .rpm

n SLES: open-iscsi .rpm

l On SLES, if you want to start the iscsiadm utility for the first time, restart the iSCSI services by running the following command: service open-iscsi restart

Procedure

1. In the PowerProtect Data Manager UI, select Recovery > Assets and select the File System tab.

The Recovery window displays all of the file systems available for recovery.

2. Select the checkbox next to the desired file system and click View Copies.

You can also use the Search field or the filter in the Name column to locate a specific file system.

The Recovery > Assets window provides a map view in the left pane and copy details in the right pane. When a file system is selected in the map view, the file system name displays in the right pane with the copy locations underneath. When you select a specific location in the left pane to view the copies, for example, on a Data Domain system, the copies on that system display in the right pane.

3. Click DD, and then select from one of the available copies that display in the table.

4. In the right pane, select the checkbox next to the file system backup you want to restore, and then click Restore.

The Restore wizard appears.

5. On the Select Target Location page, choose from one of the following options, and then click Next.

l Restore to original Restore the file system to the original location.

l Restore to a new location on the original host Select the destination file system asset (volume) from the list of available assets on the host.

l Restore to a new host Browse from the available hosts to locate and select a destination host and file system.

Note: If the destination file system asset already contains some data, this data will be overwritten.

6. On the Summary page:

a. Review the information to ensure that the restore details are correct.

b. Click Restore.

7. Go to the Jobs window to monitor the restore.

A restore job appears with a progress bar and start time.

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 139

Restore the PowerProtect Data Manager server You can restore PowerProtect Data Manager server persisted data as a new instance using any of the backups. A System Administrator can carry out the restore.

Before you begin

Ensure that:

l The PowerProtect Data Manager version that is deployed on your system and the backups you are using for the restore match.

l The network configuration is the same on the newly deployed PowerProtect Data Manager system as on the failed instance that you are restoring.

Procedure

1. Deploy the PowerProtect Data Manager OVA and power it on.

2. Select Restore Backup.

3. Specify the following storage information:

a. Data Domain System IP where the recovery backups are stored.

b. Data Domain NSF Export Path where the recovery backups are stored.

c. Click Connect.

4. Select the PowerProtect Data Manager instance that you would like to restore, and click OK.

5. Select the backup file that you would like to use for recovery, and click Recover.

6. Specify the lockbox passphrase associated with the backup, and start the recovery.

This will initiate the recovery and display the progress status. The recovery process can take approximately eight minutes before the URI is redirected to the PowerProtect Data Manager login. If the recovery status shows progress as Failed, refer to Recover a failed PowerProtect Data Manager backup on page 178

After you finish

After a successful recovery:

l The time zone of the PowerProtect Data Manager instance is set to the same as that of the backup.

l The OS user passwords and PowerProtect Data Manager login are set to the lockbox phrase previously provided in step 6.

Restore operations for cloud tier Restore operations of backups that have been tiered to the cloud are identical to normal restore operations.

The PowerProtect Data Manager software recalls a copy of the backup from the cloud to the active tier of the Data Domain system, and then performs a restore of the backup from the active tier to the client. The status appears as Cloud. The backup is stored on the Data Domain cloud tier after the restore. The copy of the backup on the Data Domain active tier is used for restore operation and is deleted after 10 days.

Restoring Data and Assets

140 PowerProtect Data Manager Administration and User Guide

Restore from cloud tier

Procedure

1. Select Recovery > Assets, click DD, and then select from one of the available copies that appear in the table.

2. Click Recall, and specify how long the copy should be kept on the active tier.

The copy is moved and the Location changes from Cloud to Local.

3. Click the appropriate restore option.

Restoring Data and Assets

PowerProtect Data Manager Administration and User Guide 141

Restoring Data and Assets

142 PowerProtect Data Manager Administration and User Guide

CHAPTER 10

Performing Self-service Backup and Restore of Application and File System Agents

This section includes the following topics:

l Performing self-service backups of Microsoft SQL databases..........................144 l Performing self-service backups of Oracle databases.......................................144 l Performing self-service backups of File Systems..............................................145 l Restore a SQL application host.........................................................................146 l Restore an Oracle application host................................................................... 146 l Performing self-service restore of a File System host...................................... 147

PowerProtect Data Manager Administration and User Guide 143

Performing self-service backups of Microsoft SQL databases

To enable self-service protection, when you create the SQL protection policy, select Self-Service Protection.

When performing a self-service stand-alone backup of an AAG asset, the backups display under the AAG asset.

Chapter 4, Backing Up SQL Server with Application Direct, in the PowerProtect Microsoft Application Agent SQL Server User Guide provides instructions on how to perform self-service SQL Server backups.

Performing self-service backups of Oracle databases To enable self-service protection, when you create the Oracle protection policy, select Self-Service Protection.

To perform a self-service or manual backup of an Oracle database, you must create and run an RMAN backup script. The Oracle RMAN documentation provides detailed information about how to create the backup scripts. The documentation also describes all the supported backup features.

The following example shows an RMAN script that performs a full backup of the database and its archive logs:

connect target username/password;

run { allocate channel c1 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com);

backup database include current controlfile format %U plus archvielog;

release channel c1; }

The libddobk.so library location and the RMAN_AGENT_HOME, STORAGE_UNIT, and BACKUP_HOST settings must be specified in the allocate channel command. All other parts of the script are standard RMAN commands.

To increase the parallelism of the backup, you can allocate more channels:

connect target username/password;

run { allocate channel c1 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com);); allocate channel c2 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com);); allocate channel c3 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ,

Performing Self-service Backup and Restore of Application and File System Agents

144 PowerProtect Data Manager Administration and User Guide

BACKUP_HOST=bu-ddbealin-17.lss.emc.com);); allocate channel c4 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com););

backup database include current controlfile format %U plus archivelog;

release channel c1; release channel c2; release channel c3; release channel c4; }

Performing self-service backups of File Systems A host with the File System Agent installed requires a PowerProtect Data Manager server to back up file systems. However, an administrator can configure a retention policy only instead of a complete backup.

To back up file systems manually and use PowerProtect Data Manager for compliance purposes, register the host to PowerProtect Data Manager, create a self-service protection policy, and configure only the retention policy.

Note: To enable self-service protection, select Self-Service Protection when you create the File Systems protection policy in the PowerProtect Data Manager UI.

After a host is registered with PowerProtect Data Manager and assets are added to a self-service protection policy, use the ddfssv command to run self-service or manual backups on the host file system assets, as in the following example:

ddfssv -LL -l FULL -a DFA_SI_DD_HOST=IPv4 address -a DFA_SI_DD_USER=username (for example, PLC-Protection) -a DFA_SI_DEVICE_PATH=device path (for example, /PLCProtection/LVMs/2)) Where:

-l {full | incr}

Specifies the type of the backup to perform such as full (full), or incremental (incr). The default value is full.

-a "DFA_SI_DD_HOST= "

Specifies the name of the Data Domain server that contains the storage unit where you want to back up the databases.

-a "DFA_SI_DEVICE_PATH= "

Specifies the name and the path of the storage unit where you want to direct the backup.

-a "DFA_SI_DD_USER= "

Specifies the protection storage username. You must register the hostname and the protection storage username in the lockbox to enable the Microsoft application agent to retrieve the password for the registered user.

These details are provided in the .app.settings file on both Linux and Windows hosts. If the default installation path was used, the .app.settings file is at /opt/ dpsfsagent/settings/.app.settings on a Linux host and C:\Program Files\DPSFSAGENT\settings\.app.settings on a Windows host. More

Performing Self-service Backup and Restore of Application and File System Agents

PowerProtect Data Manager Administration and User Guide 145

information about how to use the admin utility to query the list of backups for an asset, see Using the ddfsadmin utility for File Systems.

Note: This command uses only the retention period that was specified when the self-service protection policy was created.

To perform a self-service backup, use the storage unit and username that was created on the Data Domain system when the policy was created. PowerProtect Data Manager discovers these backups and enables centralized restore operations. You can also perform a manual restore operation.

Restore a SQL application host You can perform database or table-level restores directly to the SQL application host using the Microsoft application agent.

Chapter 6, Restoring Application Direct Backups, in the PowerProtect Microsoft Application Agent SQL Server User Guide provides instructions on how to restore an application-aware SQL Server backup.

Restore an Oracle application host You can perform database restores directly to the Oracle application host by using the Oracle RMAN agent.

To perform an Oracle database restore, you must prepare the database and then run an RMAN script to restore the data. The RMAN documentation provides detailed information about how to prepare the database and create the RMAN restore script. The documentation also describes all the supported restore features.

The following example shows an RMAN script that performs a complete restore of the database to the current time, after the database has been prepared:

connect target username/password;

run { allocate channel c1 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com););

restore database; recover database;

release channel c1; }

The libddobk.so library location and the RMAN_AGENT_HOME, STORAGE_UNIT, and BACKUP_HOST settings must be specified in the allocate channel command. All other parts of the script are standard RMAN commands.

To increase the parallelism of the restore, you can allocate more channels:

connect target username/password;

run { allocate channel c1 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com););

Performing Self-service Backup and Restore of Application and File System Agents

146 PowerProtect Data Manager Administration and User Guide

allocate channel c2 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com);); allocate channel c3 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com);); allocate channel c4 type SBT_TAPE parms SBT_LIBRARY=rman_agent_home/lib/libddobk.so, ENV=(RMAN_AGENT_HOME=rman_agent_home, STORAGE_UNIT=XYZ, BACKUP_HOST=bu-ddbealin-17.lss.emc.com););

restore database; recover database;

release channel c1; release channel c2; release channel c3; release channel c4; }

Performing self-service restore of a File System host When File Systems are protected within a protection policy in PowerProtect Data Manager, you can recover the File System data using the centralized PowerProtect Data Manager restore functionality, or directly using the self-service restore feature. The following section describes the procedure for self-service restore of File Systems.

Prerequisites for File System restores

Before performing centralized or self-service File System restores:

l Ensure that the target or destination volume is not a system volume.

l Ensure that the File System agent is not installed and running on the target volume.

l Ensure that there is sufficient space on the target volume for the restore.

Using the ddfsadmin utility for File Systems The ddfsadmin utility provides the following command line options for File System recovery.

ddfsadmin backup query

Before running the ddfsrc command to perform a self-service image-level restore of File Systems, you can use the ddfsadmin backup command to query a list of all the local and remote backups taken for a particular host, as shown in the following:

ddfsadmin backup query -local -v=volume name -t=time value [h = hour,d = days,w = weeks,m = months] queries the local record file for listing backups.

ddfsadmin backup query -remote -d=Protection storage system -s=storage unit -u=username -p=DD password -c=hostname -v=volume name -t=time value [h = hour,d = days,w = weeks,m = months] queries the record file on the protection storage system for listing backups.

Example 1 Example usage

Performing Self-service Backup and Restore of Application and File System Agents

PowerProtect Data Manager Administration and User Guide 147

Example 1 Example usage (continued)

ddfsadmin backup query -local -v="C:\\" -t=5 will display a list of local backups in C:\ taken within the last five days.

ddfsadmin sync

The following is the usage for the ddfsadmin sync command:

sync -local options: Sync local record file with record file on DD sync -remote options: Sync remote record file with file in the local options: -d=

: Protection storage system host IP -u=
: Protection storage system username -s=
: Protection storage system device path -p=
: Protection storage system password.[Optional]

Example 2 Example usage

ddfsadmin sync -local -d x.x.x.x -u username -s /dev_path

Self-service image-level restore of File Systems You can perform self-service image-level restores of file systems by using the ddfsrc command. Note that this restore is not supported in the following scenarios:

l When the restore destination is the C:\ volume, which can result in the operating system becoming unavailable.

l When the restore destination is a volume with the File System agent installed.

Before running ddfsrc, use the ddfsadmin backup command to query a list of all the local backups taken for a particular host, as described in the section Using the ddfsadmin utility for File Systems, and obtain the ID of the save set you want to restore.

To restore from a particular backup, specify the ID of the save set as an input to the ddfsrc command, as in the following example:

ddfsrc -h DFA_SI_DEVICE_PATH=device path (for example, /fsa2) -h DFA_SI_DD_HOST=Protection storage system IPv4 address -c BackupClientHostName (for alternate host restore) -h DFA_SI_DD_USER=Protection storage system username (for example, sysadmin) -h DFA_SI_DD_PASSWORD=Protection storage system password -S 1551407738 -r file path (for example, /volume1_ext3) -i y.

where:

-h "DFA_SI_DEVICE_PATH= "

Specifies the name and the path of the storage unit that contains the backup.

-h "DFA_SI_DD_HOST= "

Specifies the name of the protection storage system server that contains the backup. When you have a remote (secondary) protection storage system server that has replicated databases to restore, type the name of the secondary server. A user on the secondary protection storage system server must be in the same group as the primary protection storage system server.

Performing Self-service Backup and Restore of Application and File System Agents

148 PowerProtect Data Manager Administration and User Guide

-h "DFA_SI_DD_USER= "

Specifies the protection storage system username. You must register the hostname and the DD Boost username in the lockbox to enable Microsoft application agent to retrieve the password for the registered user.

-h "DFA_SI_DD_PASSWORD= "

Specifies the password of the protection storage system user. A password is only required in this command if restoring to a new host. If you are a file system administrator and need the password to use for a particular storage system, storage unit and user, contact the backup administrator. If restoring to the original host, the password will be picked up from the lockbox.

Self-service file-level restore of File Systems You can perform self-service file-level restores of File Systems using the ddfsrc command with the -I option.

Before executing the command, create a file that contains the list of file(s) to be restored. Provide the location of this file as an input to the -I option, as shown in the following example

Example 3 ddfsrc command with input file specified

ddfsrc -h DFA_SI_DEVICE_PATH=Protection storage unit -h DFA_SI_DD_HOST=Protection storage system IP address -c BackupClientHostName (for alternate host restore) -h DFA_SI_DD_USER=Protection storage system username -h DFA_SI_DD_PASSWORD=Protection storage system password -S savetime- value -I path-of-file-containing-list-of-files-for-restore -i R -d destination-path-for-restoring-files

Performing Self-service Backup and Restore of Application and File System Agents

PowerProtect Data Manager Administration and User Guide 149

Performing Self-service Backup and Restore of Application and File System Agents

150 PowerProtect Data Manager Administration and User Guide

CHAPTER 11

Preparing for and Recovering from a Disaster

This section includes the following topics:

l Managing system backups................................................................................152 l Manage PowerProtect Data Manager backups for disaster recovery............... 152 l Prepare the Data Domain recovery target........................................................ 153 l Configure backups for disaster recovery.......................................................... 153 l Configure PowerProtect Data Manager server disaster recovery backups....... 154 l Record settings for disaster recovery...............................................................154 l Restore PowerProtect Data Manager from an external Data Domain system... 155

PowerProtect Data Manager Administration and User Guide 151

Managing system backups The PowerProtect Data Manager system protection service enables you to protect the persistent data of a PowerProtect Data Manager system from catastrophic loss by creating a series of system backups.

Each backup is considered a full backup although it is created in an incremental manner. The persistent data that is saved in a backup includes the Lockbox and Elasticsearch databases. The backup operation creates a point-in-time snapshot of the database while the system is in a quiesced state. While the system is quiesced, user functionality is limited. After the snapshot completes and while PowerProtect Data Manager copies the snapshots to the Data Domain storage unit, full user functionality is restored. If the system fails to quiesce, PowerProtect Data Manager still takes a backup, which is marked as crash consistent instead of application consistent.

To store system backups, you must configure and assign a private Data Domain storage unit for the PowerProtect Data Manager system. The system protection service enables you to manage the frequency and start time of an automated system backup, perform on-demand backups, and define the length of time that the system backups are available for recovery.

Manage PowerProtect Data Manager backups for disaster recovery

View PowerProtect Data Manager backups and perform manual backups.

Before you begin

About this task

You can view the last 5 PowerProtect Data Manager backups.

Procedure

1. From the PowerProtect Data Manager UI, select System Settings > DR Backups > Manage Backups.

2. To perform a manual backup:

You can back up to only one Data Domain host at a time. When you enter new Data Domain information for backup, you overwrite the existing Data Domain host for backup. If there are more than one external Data Domain systems, you can change which Data Domain has the backup.

a. Click Backup Now.

The Enter a name for your backup dialog appears.

b. [Optional] Type a name for your backup.

You can leave the backup name blank, and PowerProtect Data Manager provides a name for the backup using the naming convention UserDR-. If you provide a name with the convention that PowerProtect Data Manager uses for scheduled backups, which is SystemDR, PowerProtect Data Manager displays an error.

c. Click Start.

Preparing for and Recovering from a Disaster

152 PowerProtect Data Manager Administration and User Guide

3. To delete a backup:

a. Select a backup from the list.

b. Click Delete.

The system displays a warning to confirm you want to delete the backup. Click Yes to proceed.

4. Click Close.

Prepare the Data Domain recovery target Before you can configure PowerProtect Data Manager for backup and recovery, you must configure the NFS export on the Data Domain target system.

Procedure

1. Use a Web browser to log in to the Data Domain System Manager as the system administrator user.

2. In the Summary tab in the Protocols pane, select NFS Exports > Create Export.

3. In the Create NFS Export window, provide the following information, and then click OK.

l Export Namethe name of the Data Domain MTree

l Directory Paththe full directory path for Data Domain MTree that you created. Ensure that you use the same name for the directory.

Note: For an external Data Domain system, specify a path similar to the following, /data/col1/ . Where is the MTree used to store the DR backups.

4. When the progress message indicates that the save operation is complete, click Close.

5. In the Summary tab in the Protocols pane, click NFS Exports.

6. Under NFS Protocols > Exports, select the Data Domain MTree from the list of exports and click Add Clients.

7. In the Add Clients window, provide the following information, and then click OK.

l ClientIP address or host name of the PowerProtect Data Manager.

l Accept the default settings for the rest of the fields.

l Current SelectionEnsure that the list includes no_root_squash, which is required for permission for your system to change the directory structure on the NFS share.

Configure backups for disaster recovery Configure your system to automatically create backups in the event of a disaster or catastrophic outage.

Before you begin

Ensure that you have configured Data Domain as a replication location. See Prepare the Data Domain recovery target on page 153.

Preparing for and Recovering from a Disaster

PowerProtect Data Manager Administration and User Guide 153

Procedure

1. Log in to PowerProtect Data Manager as administrator.

2. Select System Settings > DR Backups > Configuration.

3. Enter the following information, and then click Save.

l Data Domain SystemIP address or host name of the Data Domain System where you created the MTree with NFS Export

l NFS Export Paththe path of the NFS Export

Results

The initial backup runs, and then backups are automatically triggered every hour.

Configure PowerProtect Data Manager server disaster recovery backups

Configure disaster recovery protection for the PowerProtect Data Manager system and the system metadata.

Before you begin

For external Data Domain system backups, ensure that you carry out the procedure described in Configure the Data Domain system on page 211.

Procedure

1. From the PowerProtect Data Manager UI, select System Settings > DR Backups > Configuration.

2. Configure the backup with the following attributes:

a. In the Data Domain System field, type the Data Domain system to back up.

b. In the NFS Export Path field, type the path where backups are stored on the target Data Domain system.

3. Click Save.

Record settings for disaster recovery Plan for disaster recovery by recording vital information.

About this task

In the event of a major outage, you will need certain information to recover your systems.

Procedure

l Ensure that you record the following information on a local drive outside PowerProtect Data Manager:

n PowerProtect Data Manager build numberCustomer Support can provide this information. It is not mandatory.

n Port GroupsLog in to the vSphere Client, right-click the appliance name and select Edit Settings. Record the port group settings that are assigned to PowerProtect Data Manager.

Preparing for and Recovering from a Disaster

154 PowerProtect Data Manager Administration and User Guide

n NFS export detailsClick the System Settings icon and select DR Backups > Configuration. Under Backup, record the host IP address and the NFS Export Path.

n Run the GET /Configurations API (api/v2/configurations) from PowerProtect Data Manager and save the details for network information.

Restore PowerProtect Data Manager from an external Data Domain system

You can restore PowerProtect Data Manager from an external Data Domain system where the data is replicated.

Before you begin

l Ensure that all the information listed in Record settings for disaster recovery on page 154 is available.

l Ensure that the FQDN of the PowerProtect Data Manager is the same as the host name.

l Ensure that the VM for PowerProtect Data Manager is powered on.

l Ensure that you have set up the recovery target system. See Prepare the Data Domain recovery target on page 153.

About this task

When your primary PowerProtect Data Manager system fails because of a major event, deploy a new PowerProtect Data Manager system and recover the backup from the external Data Domain system.

Note: If your recovery system is on a different FQDN, see Troubleshoot recovery of PowerProtect Data Manager on page 186.

Procedure

1. Use the .ova file to deploy a new PowerProtect Data Manager system.

2. On the Install window under Welcome, select Restore Backup and click Next.

3. Under Select File, enter the Data Domain System and NFS Export Path where the backup is located, and then click Connect.

A list of the available recovery backups on Data Domain appears.

4. Select the backup from which to recover the system, and click OK.

5. Provide the Lockbox Passphrase and click Start.

When the Passphrase is verified, the recovery starts. Recovery can take a few minutes.

Results

When recovery is complete, the PowerProtect Data Manager login page appears.

Preparing for and Recovering from a Disaster

PowerProtect Data Manager Administration and User Guide 155

Preparing for and Recovering from a Disaster

156 PowerProtect Data Manager Administration and User Guide

CHAPTER 12

Managing Alerts, Jobs, and Tasks

This section includes the following topics:

l Configure Alert Notifications............................................................................ 158 l View and manage System Alerts.......................................................................158 l View and manage System Alerts.......................................................................159 l Monitor jobs and view job details...................................................................... 159 l Monitor and view job tasks............................................................................... 159 l Cancel a job or task.......................................................................................... 160 l Retry a job or task............................................................................................ 160

PowerProtect Data Manager Administration and User Guide 157

Configure Alert Notifications The Alert Notifications window of the UI enables you to configure email notifications for PowerProtect Data Manager alerts.

Procedure

1. Select Administration > Alert Notifications

The Alert Notifications window appears with a table that displays the details for existing notifications.

2. Click Add.

The Add Alert Notification dialog appears.

3. In the Name field, type name of the individual or group who will receive the notification email.

4. In the Email field:

a. Specify the email address and/or alias that notifications will be sent to. This field is required in order to create an alert notification. Ensure that multiple entries are separated by a comma.

b. Click Test Email to ensure that a valid SMTP configuration exists.

5. From the Category list, select the notification category.

6. From the Severity list, select the notification severity.

7. In the Duration field, specify the amount of time that the notification will display.

8. In the Subject field, optionally type the subject that you would like to attach to the notification email.

9. Click Save to save your changes and exit the dialog.

Results

The Alert Notifications window updates with the new alert notification. At any time, you can Edit, Delete, or Disable the notification by selecting the entry in the table and using the buttons in this window.

View and manage System Alerts System alerts enable you to determine if there are issues with the PowerProtect Data Manager system or any data protection operations in PowerProtect Data Manager. Alerts are classified into three categories critical, warning, and informational. You can monitor alert messages from the Alerts window.

Procedure

1. In the PowerProtect Data Manager UI left navigation pane, select Alerts.

The Alerts window displays alert information in a table. You can filter the alerts by Severity, Date, Category, or Acknowledge.

2. Select the System tab.

3. To view more details about a specific alert, click next to the entry in the table.

Managing Alerts, Jobs, and Tasks

158 PowerProtect Data Manager Administration and User Guide

4. Select one or more alerts in the table and click Acknowledge to acknowledge that you have reviewed the alert information, and Add/Edit Note to append information to an alert.

View and manage System Alerts Alerts enable you to track the performance of data protection operations in PowerProtect Data Manager so that you can determine whether there is compliance to service level objectives. You can access the system alerts from the Alerts window.

Procedure

1. In the PowerProtect Data Manager UI left navigation pane, select Alerts.

The Alerts window displays alert information in a table. You can filter the alerts by Severity, Date, Category, or Acknowledge.

2. Select the System tab.

3. To view more details about a specific entry, click next to the entry in the table.

4. To acknowledge the system alert, select the alerts and click Acknowledge.

5. To add or edit a note for the system alert, click Add/Edit Note, and when finished, click Save.

Monitor jobs and view job details A job represents a sequence of tasks. Each task is a data protection operation. The Jobs window of the UI allows you to monitor the status of certain data protection, system, and maintenance jobs in PowerProtect Data Manager, and to drill down to the job task level to view more details.

Procedure

1. Select Jobs in the left pane.

The Jobs window appears, displaying the jobs performed within the last 24 hours by default. You can filter the job entries by Name, Job Type, or Status and sort them by Create Time or Last Updated.

2. To get more information about a job, click the arrow (>) to the left of the job name, and then click More Details. You can use the left arrow in each subsequent window to drill down to see even more details.

Monitor and view job tasks When you drill down within a job, you can view the status of specific tasks within a job. This information can be helpful when troubleshooting to determine whether one or more tasks caused a job to fail.

Procedure

1. Select Jobs.

The Jobs window appears.

2. Click the arrow (>) to the left of the job name, and then click More Details.

The Tasks window appears. The success or failure of individual tasks is indicated in the Status column.

Managing Alerts, Jobs, and Tasks

PowerProtect Data Manager Administration and User Guide 159

3. Click the arrow (>) to the left of an individual job task to view the summary, which describes the task activity, and then click More Details.

The Task detail window appears.

4. (Optional) Filter tasks by Status or Description, and sort tasks by Start Time and End Time.

Cancel a job or task From the Jobs window in the UI, you can cancel any virtual machine protection policy backup that is still in progress, or any asset protection and replication activities when the tasks are queued.

About this task

For the most recent job, you can also retry a canceled or failed job, as described in the section Retry a job.

Procedure

1. Select Jobs in the left pane.

The Jobs window appears, displaying the jobs performed within the last 24 hours by default. You can filter the job entries by Name, Job Type, or Status.

2. Click the arrow (>) to the left of the in-progress job.

Further information about the job displays, along with the option to cancel the job or view more details, such as individual job tasks.

Note: You can use the left arrow in each subsequent window to drill down to see even more details.

3. To cancel a job, click Cancel.

Note: If a job is almost completed, cancellation of the job might fail. If this occurs, a message displays indicating that the job cannot be cancelled.

4. To cancel an individual task, click More Details, and then click Cancel next to an activity in progress.

Note: If a task is almost completed, cancellation of the task might fail. If this occurs, a message displays indicating that the task cannot be cancelled.

5. Go back to the Jobs window to view the status of the cancelled job or task.

When you return to the Jobs window, the status of the job changes to Cancelled.

Retry a job or task During the activity window, you can retry the most recent virtual machine backup failure.

Procedure

1. Select Jobs in the left pane.

The Jobs window appears, displaying the jobs performed within the last 24 hours by default. You can filter the job entries by Name, Job Type, or Status.

Managing Alerts, Jobs, and Tasks

160 PowerProtect Data Manager Administration and User Guide

2. Click the arrow (>) to the left of the failed job.

Further information about the job displays, along with the option to retry the failed job or view more details, such as individual job tasks.

Note: You can use the left arrow in each subsequent window to drill down to see even more details.

3. To retry a job, click Retry.

4. To retry one or more failed tasks, click More Details, and then click Retry next to the failed task(s).

The Tasks window shows the progress of the task.

5. Go back to the Jobs window to view the status of the retried job or task.

When you return to the Jobs window, the status of the job/task(s) changes to In Progress.

Managing Alerts, Jobs, and Tasks

PowerProtect Data Manager Administration and User Guide 161

Managing Alerts, Jobs, and Tasks

162 PowerProtect Data Manager Administration and User Guide

CHAPTER 13

Best Practices and Troubleshooting

This section includes the following topics:

l Compatibility information..................................................................................164 l Power off the PowerProtect Data Manager OVA............................................. 164 l Creating a dedicated vCenter user account and assigning the role in vCenter..164 l Best practices with the VM Proxy.....................................................................167 l Troubleshooting backup configuration issues....................................................173 l Troubleshooting virtual machine backup issues.................................................173 l Recover a failed PowerProtect Data Manager backup...................................... 178 l Troubleshooting virtual machine restore issues.................................................179 l Troubleshoot recovery of PowerProtect Data Manager................................... 186 l Application agent and File System agent co-existence..................................... 186 l Microsoft application agent for SQL Server application-aware protection........188 l Troubleshooting Microsoft Application Agent discoveries on Windows 2008 and

Application Direct............................................................................................. 190 l Supporting more than 50 database clients....................................................... 190 l File System agent limitations.............................................................................191 l Time synchronization required between PowerProtect Data Manager and the

systems it interfaces with.................................................................................192 l PowerProtect Data Manager allows completion of protection policy when

storage unit on the Data Domain cannot be created......................................... 192 l Viewing the DD Boost storage unit password................................................... 193

PowerProtect Data Manager Administration and User Guide 163

Compatibility information Software compatibility information for the PowerProtect Data Manager software is provided in the eLab Navigator, available at https://elabnavigator.emc.com/eln/ modernHomeDataProtection.

Power off the PowerProtect Data Manager OVA Before you begin

Stop any tasks or services that are in process.

Procedure

1. In vCenter, select the VM that has the PowerProtect Data Manager OVA on it, which you would like to power off.

2. Right-click and select Shutdown.

For additional details on VMware UI, refer to VMware vendor documentation.

3. Alternatively, select Reboot.

Creating a dedicated vCenter user account and assigning the role in vCenter

It is strongly recommended that you set up a separate vCenter user account at the root level of the vCenter that is strictly dedicated for use with PowerProtect Data Manager and the VM Proxy protection engine.

Use of a generic user account such as Administrator might make future troubleshooting efforts difficult as it might not be clear which Administrator actions are actually interfacing, or communicating, with PowerProtect Data Manager. Using a separate vCenter user account ensures maximum clarity if it becomes necessary to examine vCenter logs.

You can specify the credentials for this vCenter user account when you add the vCenter as an asset source in the UI. Note that when adding the vCenter, ensure that you specify a user whose role is defined at the vCenter level, as opposed to being restricted to a lower level container object in the vSphere object hierarchy.

Specify the required privileges for a dedicated vCenter user account You can use the vSphere Client to specify the required privileges for the dedicated vCenter user account, or you can use the PowerCLI, which is an interface for managing vSphere. The following table includes the privileges required for this user.

About this task

Table 22 Minimum required vCenter user account privileges

Setting vCenter 6.0 and later required privileges PowerCLI equivalent required privileges

Alarms l Create alarm

l Modify alarm

$privileges = @( 'System.Anonymous',

Best Practices and Troubleshooting

164 PowerProtect Data Manager Administration and User Guide

Table 22 Minimum required vCenter user account privileges (continued)

Setting vCenter 6.0 and later required privileges PowerCLI equivalent required privileges

Datastore 'System.View', 'System.Read', 'Global.ManageCustomFields', 'Global.SetCustomField', 'Global.LogEvent', 'Global.CancelTask', 'Global.Licenses', 'Global.Settings', 'Global.DisableMethods', 'Global.EnableMethods', 'Folder.Create', 'Datastore.Rename', 'Datastore.Move', 'Datastore.Delete', 'Datastore.Browse', 'Datastore.DeleteFile', 'Datastore.FileManagement', 'Datastore.AllocateSpace', 'Datastore.Config', 'Network.Config', 'Network.Assign', 'Host.Config.Storage', 'VirtualMachine.Inventory.Create', 'VirtualMachine.Inventory.Register', 'VirtualMachine.Inventory.Delete', 'VirtualMachine.Inventory.Unregister', 'VirtualMachine.Interact.PowerOn', 'VirtualMachine.Interact.PowerOff', 'VirtualMachine.Interact.Reset', 'VirtualMachine.Interact.ConsoleInteract', 'VirtualMachine.Interact.DeviceConnection', 'VirtualMachine.Interact.SetCDMedia', 'VirtualMachine.Interact.ToolsInstall', 'VirtualMachine.Interact.GuestControl', 'VirtualMachine.GuestOperations.Query', 'VirtualMachine.GuestOperations.Modify', 'VirtualMachine.GuestOperations.Execute', 'VirtualMachine.Config.Rename', 'VirtualMachine.Config.Annotation', 'VirtualMachine.Config.AddExistingDisk', 'VirtualMachine.Config.AddNewDisk', 'VirtualMachine.Config.RemoveDisk', 'VirtualMachine.Config.RawDevice', 'VirtualMachine.Config.HostUSBDevice', 'VirtualMachine.Config.CPUCount', 'VirtualMachine.Config.Memory', 'VirtualMachine.Config.AddRemoveDevice', 'VirtualMachine.Config.EditDevice', 'VirtualMachine.Config.Settings', 'VirtualMachine.Config.Resource', 'VirtualMachine.Config.UpgradeVirtualHardware', 'VirtualMachine.Config.ResetGuestInfo', 'VirtualMachine.Config.AdvancedConfig', 'VirtualMachine.Config.DiskLease', 'VirtualMachine.Config.SwapPlacement', 'VirtualMachine.Config.DiskExtend', 'VirtualMachine.Config.ChangeTracking', 'VirtualMachine.Config.ReloadFromPath', 'VirtualMachine.Config.ManagedBy', 'VirtualMachine.State.CreateSnapshot', 'VirtualMachine.State.RevertToSnapshot', 'VirtualMachine.State.RemoveSnapshot', 'VirtualMachine.Provisioning.MarkAsTemplate', 'VirtualMachine.Provisioning.DiskRandomAccess', 'VirtualMachine.Provisioning.DiskRandomRead', 'VirtualMachine.Provisioning.PutVmFiles', 'Resource.AssignVMToPool', 'Resource.HotMigrate', 'Resource.ColdMigrate', 'Alarm.Create',

l Allocate space

l Browse datastore

l Configure datastore

l Low-level file operations

l Move datastore

l Remove datastore

l Remove file

l Rename datastore

Extension l Register extension

l Unregister extension

l Update extension

Folder l Create folder

Global l Cancel task

l Disable methods

l Enable methods

l Licenses

l Log event

l Manage custom attributes

l Settings

l Set custom attribute

Host l Configuration > Storage partition configuration

Network l Assign network

l Configure

Resource l Assign virtual machine to resource pool

l Migrate powered off virtual machine

l Migrate powered on virtual machine

Sessions l Validate session

Tasks l Create task

l Update task

vApp l Export

l Import

l vApp application configuration

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 165

Table 22 Minimum required vCenter user account privileges (continued)

Setting vCenter 6.0 and later required privileges PowerCLI equivalent required privileges

Virtual Machine 'Alarm.Edit', 'Task.Create', 'Task.Update', 'Sessions.ValidateSession', 'Extension.Register', 'Extension.Update', 'Extension.Unregister', 'VApp.ApplicationConfig', 'VApp.Export', 'VApp.Import' )

New-VIRole -Name 'PowerProtect' -Privilege (Get-VIPrivilege -Id $privileges)

Configuration l Add existing disk

l Add new disk

l Add or remove device

l Advanced

l Change CPU count

l Change resource

l Configure managed by

l Disk change tracking

l Disk Lease

l Extend virtual disk

l Host USB device

l Memory

l Modify device settings

l Raw device

l Reload from path

l Remove disk

l Rename

l Reset guest information

l Set annotation

l Settings

l Swapfile placement

l Upgrade virtual machine compatibility

Guest Operations

l Guest operation modifications

l Guest operation program execution

l Guest operation queries

Interactions l Configure CD media

l Console interaction

l Device Connection

l Guest operating system management by VIX API

l Power off

l Power on

l Reset

l VMware Tools install

Best Practices and Troubleshooting

166 PowerProtect Data Manager Administration and User Guide

Table 22 Minimum required vCenter user account privileges (continued)

Setting vCenter 6.0 and later required privileges PowerCLI equivalent required privileges

Inventory l Create new

l Register

l Remove

l Unregister

Provisioning l Allow disk access

l Allow read-only disk access

l Allow virtual machine download

l Mark as Template

Snapshot Management

l Create snapshot

l Remove Snapshot

l Revert to snapshot

Best practices with the VM Proxy Observe the following best practices when using PowerProtect Data Manager with the VM Proxy protection engine.

l Install VMware Tools on each virtual machine by using the vSphere Client. VMware Tools adds additional backup and recovery capabilities that quiesce certain processes on the guest operating system prior to backup.

l Use Hot Add transport mode for faster backups and restores and less exposure to network routing, firewall, and SSL certificate issues. To support Hot Add mode, deploy the VM Proxy on an ESXi host that has a path to the storage that holds the target virtual disk(s) for backup.

Note: Hot Add mode requires VMware hardware version 7 or later. Ensure all virtual machines that you want to back up are using Virtual Machine hardware version 7 or later.

For sites that contain a large number of virtual machines that do not support Hot Add requirements, Network Block Device (NBD) transport mode will be used. This can cause congestion on the ESXi host management network. Plan your backup network carefully for large scale NBD installs. You may consider configuring one of the following options:

n Set up Management network redundancy.

n Set up backup network to ESXi for NBD.

n Set up storage heartbeats. http://www.vmware.com/files/pdf/techpaper/ vmw-vsphere-high-availability.pdf provides more information.

l If you have vFlash-enabled disks and are using hotadd transport mode, ensure that you configure the vFlash resource for the VM Proxy host with sufficient resources (greater than or equal to the virtual machine resources), or migrate the VM Proxy to a host with vFlash already configured. Otherwise, backup of any vFlash-enabled disks will fail with the error "VDDK Error: 13: You do not have access rights to this

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 167

file," and the error "The available virtual flash resource '0' MB ('0' bytes) is not sufficient for the requested operation" on the vCenter server.

l Avoid deploying VMs with IDE virtual disks; using IDE virtual disks degrades backup performance. Use SCSI virtual disks instead whenever possible.

Note: You cannot use Hot Add mode with IDE Virtual disks and therefore backup of these disks will be performed using NBD mode.

l During policy configuration, assign virtual machines to a protection group based on logical grouping to allow for better scheduling of backups that will help you avoid resource contention and create more organized logs for review.

l When configuring or unconfiguring a very large number of virtual machines (300 or more) in a protection policy, an error message might display indicating that the request is too large. You can click OK and proceed, but system performance will be impacted due to the size of the request. As a best practice, it is recommended to use dynamic filters to automatically determine which assets get assigned to protection policies when the assets are discovered.

l When you plan the backups, ensure that PowerProtect Data Manager supports the disk types that you use in the environment. Currently, PowerProtect Data Manager does not support the following disk types:

n Independent (persistent and non-persistent)

n RDM Independent - Virtual Compatibility Mode

n RDM Physical Compatibility Mode

l The VM Proxy leverages Changed Block Tracking (CBT) by default. If CBT is disabled on the virtual machine, then it will enable CBT automatically. If you add a disk to the virtual machine after the first full backup, for the next policy run a full backup will be performed automatically for the newly added disk, and an incremental backup will be performed for the existing disk.

l When backing up thin-provisioned Virtual Machines or disks for Virtual Machines on NFS datastores, an NFS datastore recovery does not preserve thin provisioning. VMware knowledge base article 2137818 at http:// kb.vmware.com/kb/2137818 provides more information.

l Virtual Machines with extremely high IO may face hangs during consolidation due to the ESXi forced operation called synchronous consolidate. Plan your backups of such Virtual Machines according to the amount of workload on the Virtual Machine.

Software requirements The following table lists the required components for PowerProtect Data Manager and the VM Proxy.

Table 23 PowerProtect Data Manager and VM Proxy requirements

Component Requirements

PowerProtect Data Manager with the VM Proxy appliance

Version 19.1

vCenter Server l vSphere and ESXi versions 6.0, 6.5, 6.7. Note: Version 6.5 and later is required to perform Microsoft SQL Server application-aware protection.

Best Practices and Troubleshooting

168 PowerProtect Data Manager Administration and User Guide

Table 23 PowerProtect Data Manager and VM Proxy requirements (continued)

Component Requirements

Refer to VMware documentation on physical host requirements for the ESXi hosts:

l ESXi 6.5 minimum requirements

l ESXi 6.0 hardware requirements

VMware Tools Version 10 or later. Note: Version 10.1 and later is required to perform Microsoft SQL Server application-aware protection.

Data Domain l A minimum of one configured DD Boost device is required. Note that all models of Data Domain are supported.

l Data Domain operating system (DDOS) version 6.1 and later and the Data Domain Management Console (DDMC).

l Make note of the hosts writing backups to your Data Domain(s).

Web browser The latest version of the Google Chrome browser in order to access the PowerProtect Data Manager UI.

PowerProtect Data Manager resource requirements on VMware environment The PowerProtect Data Manager appliance has the following minimum system requirements for the VMware environment (ESXi server) it is running on:

l 10 CPU cores

l 18 GB (The ESXi server requires at least 18 GB of RAM available for PowerProtect Data Manager)

l Five total disks:

n Disk 1 of 100 GB

n Disk 2 of 500 GB

n Disk 3 of 10 GB

n Disk 4 of 10 GB

n Disk 5 of 5 GB

l One 1-GB NIC

Configuration checklist for common issues The following configuration checklist provides best practices and troubleshooting tips that might help resolve some common issues.

Basic configuration

Review the following basic configuration requirements:

l Synchronize system time between vCenter and ESX/ESXi/vSphere.

l Assign IPs carefully do not reuse any IP addresses.

l Use Fully Qualified Domain Names (FQDNs) where possible.

l For any network related issue, confirm that forward and reverse DNS lookups work for each host in the datazone.

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 169

Virtual machine configuration

Review the following virtual machine configuration requirements:

l Ensure that the virtual machine has access to and name resolution for the Data Domain system.

l Ensure that the virtual machine firewall has port rules for Data Domain.

l For application-aware backups, ensure that Microsoft SQL Server instances are enabled for data protection using a SYSTEM account, as described in the software and security requirements section of the topic Microsoft Application Agent for SQL Server application-aware protection.

VM Proxy performance and scalability The VM Proxy appliance performance and scalability of depends on several factors, including the number of vCenter Servers and proxies and the number of concurrent virtual machine backups. The following table provides information on these scalability factors and maximum recommendations, in addition to concurrency recommendations for sessions created from backups using the VM Proxy engine.

The count of sessions is driven by the number of proxies, and backups running through this server.

Table 24 Performance and scalability factors

Component Maximum limit

Recommended count

Notes

Number of concurrent NBD backups per ESXi Server

50 (10G network)

VMware uses Network File Copy (NFC) protocol to read VMDK using NBD transport mode. You need one VMware NFC connection for each VMDK file being backed up. The VMware Documentation provides more information on vCenter NFC session connection limits.

Concurrent VMDK backups per vCenter Server

100 Can be achieved with a combination of the number of proxies multiplied by the number of configured Hot Add sessions per VM Proxy.

Number of proxies per vCenter Server

4 A limit of 25 concurrent backup and recovery sessions.

Number of files/directories per file level recovery

200,000 File-level recovery is recommended for quickly recovering a small set of files. Image-level or VMDK- level recoveries are optimized and recommended for recovering a large set of files/folders.

Table 25 Proxy session limits by proxy type

Component Total number of sessions (backup and recovery) maximum

Notes

Added (External) VM Proxy 25

Best Practices and Troubleshooting

170 PowerProtect Data Manager Administration and User Guide

Table 25 Proxy session limits by proxy type (continued)

Component Total number of sessions (backup and recovery) maximum

Notes

Embedded VM Proxy (the proxy pre- bundled with the PowerProtect Data Manager software)

4 The embedded proxy is only used as a fallback when all internal and external proxies are disabled or in Failed state.

Increasing the number of instant access sessions PowerProtect Data Manager supports up to 32 concurrent instant access sessions at the storage level.

You can be increase the number of sessions by adding an external VM Proxy and modifying a configuration file to override the internal proxy's maximum sessions value. Note that sessions created in excess of the maximum concurrent sessions supported will be queued for 24 hours before timing out. To increase the number of concurrent sessions manually to match the capability of the underlying cluster, perform the following steps.

1. Create a file named vmdm_recovery.properties in the /usr/ local/brs/lib/vmdm/config/ directory.

2. Add the parameter value to override the default value. For example: vmdm.recovery.queue.ia_session_allowance=32

3. Run vmdm stop and then vmdm start to restart the vmdm service.

Enabling or disabling Changed Block Tracking The VM Proxy uses changed block tracking (CBT) automatically upon the first virtual machine backup so that only changed disk areas on the virtual machine get backed up. Some virtual machines, however, do not support CBT and you may be required to disable CBT for those virtual machines.

A vCenter administrator can control the application of CBT by using the custom field EMC vProxy Disable CBT in the vSphere Client. You can set this custom field to true to disable CBT, or false to enable CBT. If you do not set this field for a virtual machine, or the field is not present, CBT is enabled by default for that virtual machine.

To set CBT for virtual machines, perform the following:

1. Log into the vSphere Client (vSphere versions 6 and earlier) or vSphere Web Client (vSphere versions 6.5 and later) as an administrator.

2. Select a virtual machine in the vCenter tree, and then click the Summary tab.

3. Edit the virtual machine attributes:

l In vSphere versions 6.x and earlier, click Edit in the Annotation box.

l In vSphere versions 6.5 and later, click Edit under Custom Attributes.

4. Locate the EMC vProxy Disable CBT field, or create a string for EMC vProxy Disable CBT. The string must match the field name exactly and is case-sensitive.

5. Set the value to true to disable CBT on the virtual machine, or to false (or leave the field blank) to enable CBT on the virtual machine. Setting or resetting the field for one virtual machine does not affect the other virtual machines in the vCenter.

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 171

Fixing CBT if corrupted on virtual machine

If CBT becomes corrupted on the virtual machine, warnings similar to the following appear in the backup logs:

WARN: Change block tracking needs to be reset. WARN: Change Block Tracking could not be reset, causing full backup: Second attempt failed. NOTICE: Change block tracking cannot be reset by proxy. Please remediate VM.

If these messages appear, you can use PowerCLI commands to disable and then enable CBT without powering off the virtual machines as described in the VMware knowledgebase article at https://kb.vmware.com/selfservice/search.do? cmd=displayKC&docType=kc&docTypeID=DT_KB_1_1&externalId=1031873, or perform the following steps to clean up CBT:

1. Power down the virtual machine.

2. Remove CBT flags.

3. Delete CTK files from the datastore.

4. Power ON the virtual machine.

Configure a backup to support vSAN datastores Backup and recovery functionality is supported for vSAN virtual machines.

About this task

When performing backups or restores of virtual machines residing on vSAN datastores, it is highly recommended to deploy the vProxy on a vSAN datastore. A vProxy deployed on any one vSAN datastore can be used for backing up virtual machines from other vSAN or non-vSAN datastores by using Hot Add or nbdssl transport modes, as applicable.

Disable SSL certification on the vCenter Server If the vCenter's SSL certificate cannot be trusted automatically, a dialog box appears when adding the vCenter Server as an asset source in the PowerProtect Data Manager UI, requesting certificate approval. It is highly recommended that you do not disable certificate enforcement.

If disabling of the SSL certificate is required, you can perform the following procedure.

WARNING These steps should only be performed if you are very familiar with certificate handling and the issues that can arise from disabling a certificate.

1. Create the following files (and file contents) in the /home/admin directory on the VM Proxy appliance: A file named cbs_vmware_connection.properties with the line cbs.vmware_connection.ignore_vcenter_certificate=true A file named vmdm_vmware_connection.properties with the line vmdm.vmware_connection.ignore_vcenter_cert=true A file named .vmdm_discovery.properties with the line vmdm.discovery.ignore_vcenter_cert=true

Note: Note the period at the start of this file.

Best Practices and Troubleshooting

172 PowerProtect Data Manager Administration and User Guide

2. Run cbs stop to stop the cbs service, and then cbs start to restart the service.

3. Run vmdm stop to stop the vmdm service, and then vmdm start to restart the service.

4. Perform a test to determine if SSL certificate disabling was successful by adding a vCenter Server using the vCenter's IP address (if the SSL certificate uses FQDN), and then verify that the asset source was added and virtual machine discovery was successful.

Troubleshooting backup configuration issues The following section provides a list of error messages that might appear when you configure an appliance backup configuration.

Data Domain storage unit mount command failed with error: 'Cannot mount full path: Access is denied'

This error message appears when an NFS export does not exist on the Data Domain System for the full path to the DD Boost Storage Unit.

To resolve this issue, ensure that you have configured an NFS export for the full path of the DD Boost storage unit and that the appliance is an Export client.

Data Domain storage unit mount command failed with error: 'Cannot resolve FQDN: The name or service not known'

This error message appears when the appliance cannot contact the Data Domain System by using the specified FQDN. To resolve this issue, ensure that you can resolve the FQDN and IP address of the Data Domain System.

Troubleshooting virtual machine backup issues This section provides information about issues related to virtual machine backup operations with the VM Proxy protection engine.

VM Proxy limitations and unsupported features Review the following limitations and unsupported features related to the VM Proxy.

VMware limitations by vSphere version

VMware limitations for vSphere 6.0 and later versions are available at https:// configmax.vmware.com/home. For vSphere 5.5, go to https:// www.vmware.com/pdf/vsphere5/r55/vsphere-55-configuration-maximums.pdf.

VM Proxy configuration settings cannot be modified after adding the VM Proxy

After adding a VM Proxy, the only field you can modify is the Transport Mode. Any other configuration changes require you to delete and then re-add the VM Proxy. Additional VM Proxy actions provides more information.

Limitations to SQL Server application consistent data protection

Review the SQL Server application-consistent protection support limitations in the section Microsoft application agent for SQL Server application-aware protection on page 188.

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 173

Network configuration settings do not get restored with virtual machine after recovery of a vApp backup

Network configuration settings are not backed up with the virtual machine as part of a vApp backup. As a result, when you restore a vApp backup, you must manually reconfigure the network settings.

VM Proxy configured with dual stack is not supported

The VM Proxy does not support dual stack (IPv4 and IPv6) addressing. If you want to run backups and restores using the VM Proxy, use IPv4 only addressing.

Virtual machine alert "VM MAC conflict" may appear after successful recovery of virtual machine

After performing a successful recovery of a virtual machine through vCenter version 6, an alert may appear indicating a "VM MAC conflict" for the recovered virtual machine, even though the new virtual machine will have a different and unique MAC address. You must manually acknowledge the alert or clear the alert after resolving the MAC address conflict. Note that this alert can be triggered even when the MAC address conflict is resolved.

The VMware release notes at http://pubs.vmware.com/Release_Notes/en/ vsphere/60/vsphere-vcenter-server-60u2-release-notes.html provide more information.

Protection fails for virtual machine name containing { or }

A PowerProtect Data Manager virtual machine protection policy fails to back up virtual machines that contain the special characters { or } in the name. This limitation exists with vSphere versions previous to 6.7. If you do not have vSphere 6.7 installed, avoid using these two characters in virtual machine names.

Datastore names cannot contain special characters

Using special characters in datastore names can cause problems with the VM Proxy, such as failed backups and restores. Special characters include the following: % & * $ # @ ! \ / : * ? " < > | ;, and so on.

Hot Add backups fail when datacenter names contain special characters

Virtual machine backups fail when the datacenter name contains special characters and the transport mode specified for VM Proxy backups is Hot Add only. Avoid using special characters in the datacenter name, for example, "Datacenter_#2@3", or specify Hotadd with fallback to Network Block Device for the transport mode.

Hot Add backups fail when virtual machine protection policy configured with Virtual Flash Read Cache value

When using Hot Add transport mode for a virtual machine protection policy, the backup fails with the following error if configured with the Virtual Flash Read Cache (vFRC) value:

"Backup has FAILED. Failed to backup virtual disk \"Hard disk \". Failed to initialize Block Reader. Failed to open source VMDK \ / \": VDDK Error: 13: You do not have access rights to this file. (500)".

Best Practices and Troubleshooting

174 PowerProtect Data Manager Administration and User Guide

Backups fail for resource pools recreated with the same name as deleted pool

When you delete a resource pool in vCenter and then recreate a resource pool with the same name, backups fail. Re-configure the protection group with the newly created resource pool.

Data Domain Boost over fibre channel not supported

PowerProtect Data Manager does not support Data Domain Boost over fibre channel (DFC).

SAN transport mode not supported

PowerProtect Data Manager supports only the Hot Add and NBD transport modes. The Hot Add mode is the default transport mode. For a protection policy, you can specify to use only Hot Add mode, only NBD mode, or Hot Add mode with fallback to NBD of Hot Add is not available.

Specify NBD for datastores if VM Proxy should use NBD mode only

For a VM Proxy that will only use NBD transport mode, you must also specify the datastores for which you want the proxy to perform only NBD backups to ensure that any backups of virtual machines running on these datastores are always performed using NBD mode. This also ensures that the same NBD-only proxies are never used for backups of virtual machines residing on any other datastores.

Backup of individual folders within a virtual machine is not supported

PowerProtect Data Manager only supports image-level backup and disk-level backup. You cannot perform backups of individual folders within the virtual machine.

I/O contention when all Virtual Machines on a single data store

I/O contention may occur during snapshot creation and backup read operations when all Virtual Machines reside on a single datastore.

VMware snapshot for backup is not supported for independent disks

When using independent disks you cannot perform VMware snapshot for backup.

Managing command execution for VM Proxy Agent operations on Linux The VM Proxy Agent automatically creates a PAM service file named vproxyra in the /etc/pam.d system directory, if the file does not already exist.

This file, which allows you to manage command execution through the VM Proxy Agent, is modeled on the corresponding vmtoolsd file. The settings in this file permit command execution by any user who is able to perform VM Proxy-based operations on the guest virtual machine. A system administrator can further modify this file to specify which users can perform VM Proxy Agent operations, for example, file-level restore and SQL application-aware protection. For more information on the configuration of PAM service files, see the system documentation for your specific guest virtual machine operating system.

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 175

SQL Server application-consistent backups fail with error "Unable to find VSS metadata files in directory"

SQL Server application-consistent virtual machine backups might fail with the following error when the disk.enableUUDI variable for the virtual machine is set to False.

Unable to find VSS metadata files in directory C:\Program Files \DPSAPPS\MSVMAPPAGENT\tmp\VSSMetadata.xxxx. To resolve this issue, ensure that the disk.enableUUDI variable for the virtual machines included in an SQL Server application-consistent backup is set to True.

Failed to lock Virtual Machine for backup: Another EMC vProxy operation 'Backup' is active on VM

This error message appears when a backup fails for a virtual machine, when previous backups of the virtual machine was abruptly ended and the VM annotation string was not cleared.

To resolve this issue, clear the annotation string value for the virtual machine.

1. Connect to the vCenter server and navigate Home > Inventory > Hosts and Clusters.

2. Select the virtual machine, and then select the Summary tab.

3. Clear the value that appears in the EMC Proxy Session field.

Windows 2008 R2 VMs may fail to backup with disk.EnableUUID configured to true.

Windows 2008 R2 backups may fail if the VM is configured with the disk.EnableUUID parameter set to true. To correct this problem, manually update the vmx configuration parameter disk.EnableUUID to false by using the vSphere Web Client:

1. Shut down the VM by right clicking the VM and selecting Shut Down Guest OS.

2. Right click the VM and select Edit Settings.

3. Click VM Options.

4. Expand the Advanced section and click Edit Configuration.

5. Locate the name disk.EnableUUId and set the value to false.

6. Click OK on the next two pages.

7. Right click the VM and select Power On.

After you update the configuration parameter, the backups of the Windows 2008 R2 VM should succeed.

vMotion operations are not allowed during active backup operations The vSphere vMotion feature enables the live migration of running virtual machines from one physical server to another. You cannot run vMotion operations on the vProxy appliance or VMware Backup appliance during active backup operations. This is expected behavior. Wait until all backup operations have completed prior to performing a vMotion operation.

Best Practices and Troubleshooting

176 PowerProtect Data Manager Administration and User Guide

Backups fail if certain characters are used in the virtual machine name, datastore, folder, or datacenter names

When you use spaces or special characters in the virtual machine name, datastore, folder, or datacenter names, the .vmx file is not included in the backup. The vProxy appliance does not back up objects that include the following special characters, in the format of character/escape sequence:

l & %26

l + %2B

l / %2F

l = %3D

l ? %3F

l % %25

l \ %5C

l ~ %7E

l ] %5D

Lock placed on virtual machine during backup and recovery operations continues for 24 hours if vProxy appliance fails

During vProxy backup and recovery operations, a lock is placed on the virtual machine. If a vProxy appliance failure occurs during one of these sessions, the lock gets extended to a period of 24 hours, during which full backups and transaction log backups will fail with the following error until the lock is manually released: Cannot lock VM 'W2K8R2-SQL-2014' (vm-522): Another EMC vProxy operation 'Backup' is active on VM vm-522.

Workaround

To manually release the lock on the virtual machine:

1. Open the vSphere Web Client.

2. Select the virtual machine and select Summary.

3. Select Custom attribute and click Edit.

4. Remove the attribute EMC vProxy Session.

Trailing spaces not supported in SQL database names Due to a VSS limitation, you cannot use trailing spaces within the names of SQL databases protected by an application-consistent data protection policy.

SQL databases skipped during virtual machine transaction log backup When an advanced application-consistent policy is enabled with transaction log backup, the msvmagent_appbackup.exe program evaluates databases to determine if transaction log backup is appropriate.

If transaction log backup is not appropriate for a database, the database will automatically be skipped. Databases are skipped for the following reasons:

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 177

Table 26 SQL Skipped Database Cases and Descriptions

Case Description

Database has been restored

When a database has been restored, this database will be skipped during transaction log backup because there is no Backup Promotion.

System Database

System databases are automatically skipped for transaction log backup.

Database State Database is not in a state that allows backup. For example, the database is in the NORECOVERY state.

Recovery Model

Database is in SIMPLE recovery model, which does not support transaction log backup

Other Backup Product

Most recent backup for the database was performed by a different backup product.

New Database Database was created after most recent full backup.

Backup Failure Database was in state to allow backup, backup was attempted, but backup failed.

All skipped databases will be backed up as part of the next full backup. Also, a skipped database will not result in msvmagent_appbackup.exe failure. The only instance in which msvmagent_appbackup.exe would potentially fail is if all databases failed to back up.

The msvmagent_appbackup.exe program generates a history report of the databases, if the database backup status was success/skipped/failed, and a reason if they were skipped or failed if applicable. This history report is visible in the action logs for the vProxy, which are available as part of the appbackup logs.

Note: For SQL virtual machine application-consistent data protection, the SQL and operating system versions follow the NMM support matrix available at http:// compatibilityguide.emc.com:8080/CompGuideApp/.

Accessing Knowledge Base Articles Additional troubleshooting information is available through the Featured VMware Documentation Sets website at https://www.vmware.com/support/pubs/. Select Support > Search Knowledge Base.

Recover a failed PowerProtect Data Manager backup Procedure

1. Redeploy the PowerProtect Data Manager OVA.

2. Call Dell EMC Technical support.

Best Practices and Troubleshooting

178 PowerProtect Data Manager Administration and User Guide

Troubleshooting virtual machine restore issues The following topics provide information on troubleshooting virtual machine restore failures.

Virtual machine protection copy does not display under available copies

If a virtual machine protection copy does not display under the available copies in PowerProtect Data Manager, verify the following:

l Ensure that protection of the virtual machine completed successfully.

l Check that the desired copy has not expired according to the PowerProtect Data Manager protection policy.

l Run a discovery of the Data Domain Management Center (DDMC) and ensure that discovery completed successfully for virtual machine copies.

l Check the discovery logs for any exceptions or errors that might have occurred during discovery.

Virtual machine restore fails with name resolution error

A virtual machine restore might fail with the following error due to network issues between Data Domain and PowerProtect Data Manager or the vCenter/ESXi:

com.emc.brs.vmdm.http.HttpsConnector - null: Temporary failure in name resolution java.net.UnknownHostException : null: Temporary failure in name resolution

Ensure that you have proper name resolution between the Data Domain and PowerProtect Data Manager /vCenter/ESX.

DD NFS share not removed after restore to original

The DD NFS share might not get removed after a successful virtual machine restore to original. When this occurs, the restore hangs and the following DD NFS clients appear enabled in the Data Domain. Figure 11 DD NFS clients still enabled after restore

If you encounter this issue, you can wait 24 hours for PowerProtect Data Manager to clean up the DD NFS shares, or you can stop the restore and clean up the DD NFS clients manually by performing the following steps:

1. Restart the VMDM service by typing /usr/local/brs/lib/vmdm/bin/vmdm restart.

2. Clean up DD NFS clients by typing nfs del .

3. In the vSphere Client's Configuration tab, manually unmount the EMC-vProxy- vm-qa-xxxxx DDNFS datastore that is mounted on the ESXi host.

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 179

Virtual machine restore fails with error due to VM Proxy corruption

A virtual machine restore might fail with the following error due to corruption of the VM Proxy that is running in PowerProtect Data Manager:

com.emc.dpsg.vproxy.client.VProxyManager - Error(createSession): javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection

Ensure that the vproxyd service is running in PowerProtect Data Manager by typing the following command.

ps xa | grep vproxy Ensure that the vproxy rpm is installed as expected in PowerProtect Data Manager by typing the following command.

rpm -qa | grep vProxy When logged in as the root user, restart the vproxyd service on PowerProtect Data Manager by typing the following command.

systemctl restart vproxyd Virtual machine restore fails with error "Unable to create NAS Datastore"

A virtual machine restore might fail with the following error when a change is made to the DD restore user role in Data Domain:

Unable to create NAS Datastore: Unable to create NFS export at 'irv- dd9500-skyline1.asl.lab.emc.com:/data/col1/eCDM-SU-1497653922167/ vProxy-vm-qa-1084.asl.lab.emc.com-abfd110d- cdfa-4517-9485-27767ef75d35':

Ensure that the DD user performing the restore has the admin role. You can change the user's status in Data Domain by identifying the Data Domain user that starts with ecdmsu-admin and using the following commands:

To check the user's status, type user show list To change the role of the user, type user change role < ecdmsu-admin- xxxxxxxxxxxxx> admin Virtual machine restore fails with error "User UserEARA does not have proper privileges"

A virtual machine restore fails with the error "User UserEARA does not have proper privileges" when the user does not have adequate privileges to perform the restore operation.

Ensure that the PowerProtect Data Manager user performing the restore belongs to System Tenant and has the Export and Recovery Admin role.

Virtual machine restore fails when the previous restore of this virtual machine is in progress or did not complete

A virtual machine restore fails with the following error if the previous restore operation for the same virtual machine is still in progress or did not complete successfully:

Error : There is another running restore operation that conflicts with this request.

If the previous restore operation for this virtual machine is still in progress, monitor the progress in PowerProtect Data Manager until the restore completes. If the virtual machine restore is complete but the task stops responding, then you must manually

Best Practices and Troubleshooting

180 PowerProtect Data Manager Administration and User Guide

cancel the restore in PowerProtect Data Manager by restarting the VMDM service. You can restart the VMDM service by typing /usr/local/brs/lib/vmdm/bin/ vmdm restart.

Troubleshooting instant access restore failures An instant access restore consists of two stages. First, a virtual machine is made available in the UI as an instant access virtual machine without moving the virtual machine to permanent storage. Second, storage vMotion is initiated to migrate the virtual machine to permanent storage.

If at any point during the migration a restore failure occurs, the instant access session is not automatically removed until after the expiration period for an instant access virtual machine restore, which is 7 days by default. This behavior is intentional for the following reasons:

l To avoid data loss, since changes might have been made to the virtual machine during that time

l To provide you with the opportunity to fix the issue (for example, to free up space on the restore destination or choose a different datastore) and then take the appropriate action

When the cause of the failure is determined and/or fixed, you can use the Instant Access Sessions window of the UI to retry the migration, or save the data and delete the instant access virtual machine, as required. The section Manage and monitor Instant Access Sessions provides detailed information about these actions.

FLR Agent for virtual machine file-level restore The VM Proxy FLR Agent is required for file-level restore operations and gets installed automatically on the target virtual machine when you initiate a file-level restore and provide the virtual machine credentials.

The FLR Agent installation on Linux virtual machines requires that you use the root account. If non-root credentials are provided for the target virtual machine, the FLR Agent installation fails, even if this user has privileges similar to a root user. Once the FLR Agent installation is completed by a root user, you can perform file-level restore operations as a non-root user.

FLR Agent installation on Windows virtual machines requires that you use administrative privileges. If the provided credentials for the target virtual machine do not have administrative privileges, the FLR Agent installation fails.

On Linux, to perform a file-level restore using a non-root user, ensure that the FLR Agent has already been installed on the target virtual machine using the root user account. Otherwise, ensure that you are using a supported platform and the root user is specified, and click OK. For Linux, file-level restore is only supported on Red Hat Enterprise Linux versions 6 and 7, and SuSE Linux Enterprise Server versions 11 and 12.

On Windows, to perform a file-level restore using a non-administrator user, ensure that the FLR Agent is already installed on the target machine using administrative privileges. Otherwise, ensure that an administrative user is specified, and click OK.

FLR Agent installation on Windows virtual machines with User Account Control enabled

Performing the FLR Agent installation on User Account Control (UAC) enabled Windows virtual machine requires you to either provide the credentials of the

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 181

administrator user, or to disable UAC during the FLR Agent installation and then re- enable upon completion.

On Windows versions 7, 8, and 10, the administrator account is disabled by default. To enable the account, complete the following steps:

1. To activate the account, open a command prompt in administrative mode, and then type net user administrator /active: yes.

2. To set a password for the administrator account, go to Control Panel > User Accounts and select the Advanced tab. Initially, the account password is blank.

3. In the User Accounts pane, right-click the user and select Properties, and then clear the Account is disabled option.

To disable UAC during the FLR Agent installation and then re-enable on completion of the installation, complete the following steps:

1. Initiate a file-level restore to launch the FLR Agent installation window. The FLR Agent installation is automatically started during a mount operation if it is not already installed on the destination virtual machine.

2. In the FLR Agent installation window, select the Keep vProxy FLR on target virtual machine option.

3. Open regedit and change the EnableLUA registry key value at HKLM\SOFTWARE \Microsoft\Windows\CurrentVersion\Policies\System to 0x00000000. By default, this is set to 1.

4. Proceed with the FLR Agent installation.

5. Open regedit and reset the EnableLUA registry key to the previous value to re- enable UAC.

Updating the Microsoft Application Agent and FLR Agent software The Microsoft Application Agent and FLR Agent software required to perform SQL application-aware data protection and file-level restore operations will be automatically updated on the target virtual machine by the VM Proxy appliance during the file-level restore operation. The VM Proxy detects the available software on the client and updates the Agent software with the new version of software from its repository. If the update does not occur automatically, contact a Dell EMC technical support professional for a procedure to update the VM Proxy software repository with the latest version of the Agent software packages.

Supported platform versions for file-level restore File-level restore is only supported for the following platforms and operating system versions.

Note: Platforms/operating systems are qualified for file-level restore support using the default file system for these platforms.

l RedHat Enterprise Linux versions 6.x and 7.x

l SuSE Linux Enterprise Server versions 11.x and 12.x

l Debian version 9.1

l Ubuntu version 17.10

l CentOS version 7.2

l Oracle Enterprise Linux version 7.2

Best Practices and Troubleshooting

182 PowerProtect Data Manager Administration and User Guide

l Windows 7, 8, 10, Server 2008, 2012, 2016 (all 64-bit platforms and R2, where applicable) for FAT, and NTFS.

Support for Debian or Ubuntu operating system vProxy file-level restore is supported on the Debian/Ubuntu operating system. To configure the Debian or Ubuntu guest operating system for file-level restore, perform the following steps.

About this task

Note: File-level restore is not supported on Debian/Ubuntu ext4 file systems.

Procedure

1. Log in to the system console as a non-root user.

2. Run the sudo passwd root command.

Enter the new password twice to set a password for the root account.

3. Run the sudo passwd -u root command to unlock the root account.

4. Specify the root user credentials in the Dell EMC Data Protection Restore Client and proceed to complete the file-level restore operation at least once.

While performing the file-level restore operation for the first time, remember to select Keep FLR agent.

5. After performing the above steps at least once, you can revert the root account to the locked state and use non-root account for future file-level restore requests. Non-root user can lock the root account with the sudo passwd -l root command.

Operating system utilities required for file-level restore On Linux and Windows, the installed operating system must include several standard utilities in order to use file-level restore. Depending on the target operating system for restore and the types of disks or file systems in use, some of these standard utilities, however, may not be included.

The following utilities and programs may be required for performing file-level restore.

On Windows:

l msiexec.exe

l diskpart.exe

l cmd.exe

On Linux:

l blkid

l udevadm

l readlink

l rpm

l bash

Note: On Linux LVM, LVM2 rpm version 2.02.117 or later is required. Also, additional binaries required on Linux LVM include dmsetup, lvm, and vgimportclone.

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 183

File-level restore and SQL restore limitations This section provides a list of limitations that apply to file-level restore and individual SQL database and instance restore.

Consider the following:

l The vProxy FLR Agent is installed automatically on the target virtual machine for file-level restore when a disk mount operation is initiated. The mount, however, fails and the FLR Agent is not installed if the user does not have sufficient administrator privileges. Ensure that the user performing file-level restore is a system administrator. Note that adding a user to the Administrators group does not grant this user sufficient privileges to perform this operation.

l When performing a file-level restore, VMDKs will fail to mount with the following error if the FLR Agent service is not running on the target virtual machine: "Cannot connect to vProxy Agent: dial tcp <127.0.0.1: : connectex: No connection could be made because the target machine actively refused it."

l If you no longer require the vProxy FLR Agent on the target virtual machine, the agent must be properly uninstalled. If you manually delete vProxy FLR Agent files instead of uninstalling the agent, and at some point reinstall the agent, subsequent mount attempts to perform restores will fail. To uninstall the vProxy FLR Agent on Linux:

1. Execute the following command: /opt/emc/vproxyra/bin/ preremove.sh.

2. Uninstall FLR agent package by running rpm -e emc-vProxy-FLRAgent.

3. If the uninstall fails due to a broken installation or other issue, you can force removal of the package by running rpm -e --force emc-vProxy- FLRAgent.

To uninstall the vProxy FLR Agent on Windows:

1. Select Control Panel > Programs > Programs and Features.

2. Locate EMC vProxy FLR.

3. Right-click the program and select Uninstall.

l When a file-level restore or SQL restore operation is in progress on a virtual machine, no other backup or recovery operation can be performed on this virtual machine. Wait until the file-level restore session completes before starting any other operation on the virtual machine.

l Clean up from a suspended or cancelled mount operation requires a restart of the virtual machine before you can initiate a new mount for the file-level restore.

l When you enable Admin Approval Mode (AAM) on the operating system for a virtual machine (for example, by setting Registry/ FilterAdministratorToken to 1), the administrator user cannot perform a file-level restore to the end user's profile, and an error displays indicating "Unable to browse destination." For any user account control (UAC) interactions, the administrator must wait for the mount operation to complete, and then access the backup folders located at C:\Program Files (x86)\EMC\vProxy FLR Agent\flr\mountpoints by logging into the guest virtual machine using Windows Explorer or a command prompt.

Best Practices and Troubleshooting

184 PowerProtect Data Manager Administration and User Guide

l When you perform file-level restore on Windows 2012 R2 virtual machines, the volumes listed under the virtual machine display as "unknown." File-restore operations are not impacted by this issue.

l When you perform file-level restore on Ubuntu/Debian platforms, you must enable the root account in the operating system. By default, the root account will be in locked state.

l You can only restore files and/or folders from a Windows backup to a Windows machine, or from a Linux backup to a Linux machine.

l You must install VMware Tools version 10 or later. For best results, ensure that all virtual machines run the latest available version of VMware Tools. Older versions are known to cause failures when you perform browse actions during file-level restore or SQL retore operations.

l You can perform file-level restore across vCenters as long as the vCenters are configured in PowerProtect Data Manager, and the source and target virtual machine have the same guest operating system. For example, Linux to Linux, or Windows to Windows.

l File-level restore does not support the following virtual disk configurations:

n LVM thin provisioning

n Unformatted disks

n FAT16 file systems

n FAT32 file systems

n Extended partitions (Types: 05h, 0Fh, 85h, C5h, D5h)

n Two or more virtual disks mapped to single partition

n Encrypted partitions

n Compressed partitions

l File-level restore of virtual machines with Windows dynamic disks is supported with the following limitations:

n The restore can only be performed when recovering to a virtual machine different from the original. Also, this virtual machine cannot be a clone of the original.

n The restore can only be performed by virtual machine administrator users.

n If Windows virtual machines were created by cloning or deploying the same template, then all of these Windows virtual machines may end up using the same GUID on their dynamic volumes.

l File-level restore does not restore or browse symbolic links.

l File-level restore of Windows 8, Windows Server 2012 and Windows Server 2016 virtual machines is not supported on the following file systems:

n Deduplicated NTFS

n Resilient File System (ReFS)

n EFI bootloader

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 185

Troubleshoot recovery of PowerProtect Data Manager When the FQDN of the recovery site is different from the FQDN of the primary site, you might get a mount error and the recovery process requires a few extra steps.

About this task

If you get a mount error during recovery, follow this work-around procedure.

Procedure

1. On the Data Domain system where the backup is located, delete the replication pair and mount it for PowerProtect Data Manager.

2. When recovery is complete, on PowerProtect Data Manager, regenerate the certificates using the following command.

sudo -H -u admin /usr/local/brs/puppet/scripts/ generate_certificates.sh -c

3. Restart the system and select the URL of the primary PowerProtect Data Manager system.

The https://PPDM IP/#/progress page appears and recovery resumes.

4. Log in to the primary PowerProtect Data Manager.

The PowerProtect Data Manager VM vCenter console shows an error, which you can ignore.

5. Open the primary PowerProtect Data Manager using the original IP address and log in.

Results

Recovery is complete.

Application agent and File System agent co-existence PowerProtect Data Manager 19.1 supports the coexistence of the Microsoft SQL Application agent with the File System agent on Windows, and the Oracle agent with the File System agent on Linux, which allows you to protect the SQL or Oracle database with the host file system. The following co-existence scenarios are supported:

l Both agents in managed mode (registered to PowerProtect Data Manager)

l The SQL or Oracle agent in standalone mode, with the File System agent registered to PowerProtect Data Manager

Note: Version 19.1 of each agent must be installed if both agents are registered to PowerProtect Data Manager. In the single agent co-existence scenario (SQL or Oracle agent in standalone mode), the File System agent is supported in managed mode only.

The steps for installation and usage for each agent are the same.

The table below lists the supported use cases and limitations.

Best Practices and Troubleshooting

186 PowerProtect Data Manager Administration and User Guide

Category Supported cases Current limitations

Agent installation and uninstallation

1. New installation of both agents with:

a. SQL Application agent or Oracle Application agent in standalone or managed mode.

b. File System agent in managed mode.

2. New installation of an agent in managed mode with an already existing agent in standalone mode.

3. New installation of an agent in standalone mode with an already existing agent in managed mode.

4. Repair of an already existing agent installation.

5. Uninstallation of agents.

l Uninstalling the last agent installed on the host un- registers the host from PowerProtect Data Manager. Any new agent installation that occurs after the uninstall will have to be newly registered to the PowerProtect Data Manager server.

l Similar to the agent installations, uninstallation of each agent is performed separately.

Host Registration and Un- registration

1. Registration of an installed agent to the PowerProtect Data Manager server.

2. Changing the registration of an already registered agent to a different PowerProtect Data Manager server.

3. Un-registration of agents from the PowerProtect Data Manager server.

l Both agents, if operating in managed mode, should be registered to the same PowerProtect Data Manager server only. There is no option to register each agent to a different PowerProtect Data Manager server.

l On an already registered host, performing a direct registration (explicitly using register.sh/ register.bat) with a

different PowerProtect Data Manager server IP will un-register the host from the current PowerProtect Data Manager server and register the host to the new server. Standalone agents will continue to operate in standalone mode and will not get registered.

l Un-registering a host will un-register all of the managed agents installed

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 187

Category Supported cases Current limitations

on that host. Standalone agents will not be affected.

l After un-registering a host, the host's assets will still display in the UI in order to support restore of these assets to a different host. However, backups will not be initiated on these assets as the protection policies will be disabled.

Backup and restore features 1. Protection policy creation supported on all registered agents.

2. All scheduled protection policy backups are supported on both agents as per individual protection policies.

3. Self-service backups are supported on both agents.

4. Restores are supported on both agents.

5. Compliance is supported on both agents as per the individual Service Level Agreements (SLAs).

Microsoft application agent for SQL Server application- aware protection

The Microsoft application agent is a component of the PowerProtect Data Manager data protection solution for VMware virtual machines.

A PowerProtect Data Manager application-aware VM protection policy uses the Microsoft application agent to provide advanced application-consistent protection for the following SQL workloads:

l SQL Server full backup to Data DomainConfigure a PowerProtect Data Manager protection policy with the application-aware option to perform a SQL Server backup to a Data Domain device as part of a VMware image-level backup. A SQL Server full backup is performed during the in-guest quiesce by VMware Tools. When the backup is performed as part of the VMware image-level backup, the SQL data files are backed up as part of the VMDKs during the VM Proxy backup. After completing the backup, the Microsoft application agent is automatically run

Best Practices and Troubleshooting

188 PowerProtect Data Manager Administration and User Guide

on the virtual machine to catalog the SQL server backup on the Data Domain associated with the protection policy.

l Transaction log backupWhen configuring a PowerProtect Data Manager protection policy with the Application Aware option, set an interval for Transaction log backup to enable transaction log backups for SQL instances running on the virtual machine, and specify the frequency of backups. The Microsoft application agent is run on the virtual machine to perform the transaction log backup. Backups are written directly to the Data Domain associated with the protection policy. A transaction log backup is only performed for databases in the proper state; otherwise, databases are skipped.

l Database restore, flat file restore, table-level restore, or database Instant Access restore to the source virtual machine or an alternate virtual machine. To perform restores to an alternate virtual machine, that virtual machine must be an asset of PowerProtect Data Manager. However, instance-level restores can only be performed to the original source instance. For more details on how to use Microsoft application agent to restore SQL databases backed up with an application-aware VM protection policy, see the PowerProtect Microsoft Application Agent SQL Server User Guide.

The Microsoft application agent software package is bundled with the PowerProtect Data Manager appliance, and is automatically configured on a virtual machine when you add the virtual machine asset to a VM application-aware protection policy. As part of the VM protection policy configuration, both the vProxy Agent and the Microsoft application agent are installed on the virtual machine. The Microsoft application agent installation includes the software components required for self-service restore, including the SQL Server Management Studio Microsoft App Agent plug-in and ItemPoint. After the agent installations, configuration information for the Data Domain is also sent to the virtual machine, calling the Microsoft application agent to perform the lockbox configuration. Subsequent protection policy backups and self- service restore operations jobs will also use this information without any further action required. During application-aware SQL Server full backups and transaction log backups, PowerProtect Data Manager upgrades the vProxy Agent and Microsoft application agent software packages as required.

The virtual machine credentials provided in the protection policy or within the virtual machine asset are used during Microsoft application agent installation and during SQL Server full and transaction log backups. The Microsoft application agent is first called to validate the virtual machine SQL configuration. The agent verifies that the SQL Server is installed and running, and that the provided virtual machine credentials have the necessary permissions to perform an SQL Server backup.

In order to perform SQL Server application-consistent data protection for virtual machines, the Microsoft application agent requires the following:

l The Microsoft application agent runs under the virtual machine credentials provided in the VM protection policy or virtual machine asset for installation and data protection operations. Configure all SQL Server instances on the virtual machine to grant account rights for this account to perform SQL database backup and recovery operations:

n Add the account to SQL logins.

n Grant the account the sysadmin role.

l Network connectivity, hostname resolution, and firewall ports between the Data Domain device and the virtual machines that are part of SQL Server application- consistent protection policies and restore to alternate operations. This

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 189

connectivity is required to enable the Microsoft application agent to perform client direct operations to Data Domain.

l VMware vCenter server version 6.5 or later.

l VMware ESXi server version 6.5 or later.

l VMware Tools version 10.1 or later.

l Enable the UUID attribute (disk.EnableUUID=TRUE) in the vSphere Client.

l The virtual machine must use SCSI disks only, and the number of available SCSI slots must at least match the number of disks. For example, a virtual machine with 7 disks will only require one SCSI controller, but a virtual machine with 8 disks will require 2 SCSI controllers.

l The VM Proxy requires live network connectivity to the ESXi where the targeted SQL virtual machine resides.

Troubleshooting Microsoft Application Agent discoveries on Windows 2008 and Application Direct

When you perform a Microsoft Application Agent discovery on Windows 2008 on PowerProtect Data Manager and Application Direct versions 4.5 and 4.6, the PowerProtect Data Manager agent uses the wmic.exe command to discover the installed programs. The default PowerProtect Data Manager agent installation on Windows 2008 R2 produces an error in the ecdmagent log, and discovery fails.

In Some Windows 2008 environments, the wmic.exe command does not work properly when you run it from the local user or local system account, and it causes the following error: Failed to run wmic: ERROR: error running command `wmic.exe product where name like 'DDBEA and ProtectPoint Microsoft app agent' or name like 'Microsoft Application agent' get Name, Version /format:csv`: exit status 44210 To avoid the error and ensure that Microsoft Application Agent discoveries on Windows 2008 and Application Direct succeed, run the wmic.exe command as domain administrator instead of local administrator.

Supporting more than 50 database clients About this task

If you are supporting more than 50 database clients and the following error message is displayed, perform the following steps:

Error:Protect Databases failed. The service is unavailable"

Procedure

1. Modify the following parameter in the /usr/local/brs/lib/zuul/conf/ application.yml file.

MaxTotalConnections = (Number of clients * 12)

2. Increase the value in the MaxTotalConnections parameter by a factor of 12 for every client.

For example, to protect 70 SQL clients, set the parameter to MaxTotalConnections=840.

Best Practices and Troubleshooting

190 PowerProtect Data Manager Administration and User Guide

3. Restart the Zuul service:

zuul restart

File System agent limitations Review the following limitations related to File System agent support in PowerProtect Data Manager.

l It is recommended to use different mount points for each drive. Reusing mount points might cause unexpected issues during File System discovery.

l The File System agent does not support non-English operating systems. Software compatibility information for the PowerProtect Data Manager software and the File System agent is provided in the eLab Navigator, available at https:// elabnavigator.emc.com/eln/modernHomeDataProtection.

l If a Windows or Linux File System host is unregistered from PowerProtect Data Manager and then re-registered with a different FQDN, because PowerProtect Data Manager recognizes the registration as a new host by its new name, duplicate asset entries will appear in the UIthose for the host registered earlier, as well as for the host registered by the new name. This does not impact backup and restore functionality on the new host.

l IPv6 is not supported. Use IPv4 instead.

l Image-level recovery to a system volume is not supported.

l Recovery of ReFS or deduplicated volumes to Windows 2008 R2 is not supported.

l If File System host discovery does not occur on Windows hosts, verify that the fs plugin - adm-fs-4.0.0-1-SNAPSHOT-windows-amd64.exe plug-in file has been copied to C:\Program Files\DPSFSAGENT\ADM Agent\bin. Note that copying the file to this location can take 10-15 minutes. When the plug-in file appears in this location, initiate a manual discovery from the UI's Asset sources window.

l File system discovery requires an EXT 3 or EXT 4 file system type. Note, however, that some Linux platform installations such as Red Hat Enterprise Linux (RHEL) version 7 use the XFS file system type by default. If performing a default installation of a Linux platform that does not use the EXT file system by default, file system discovery fails.

l If a Windows or Linux File System host has DNS incorrectly configured or is part of a workgroup with a dummy DNS suffix added, centralized restore of a backup copy performed on this host will fail. This is because the storage name on the protection storage system is created with the actual shortname of the host, and does not include the incorrect suffix. For the same reason, a restore from PowerProtect Data Manager will also fail if the host name or domain name of the client is changed and then re-registered to PowerProtect Data Manager. As a workaround, use the ddfsrc command with the -c flag, with the short name as input to restore the required copies. More information on how to use the ddfsrc command is provided in the section Performing self-service restore of a File System host on page 147.

l If the FIle System agent will co-exist with the Microsoft SQL or Oracle application agents, it is recommended that you use either the IP address or FQDN for registering both agents. Registering one agent using an IP address and another

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 191

using the FQDN will require you to re-approve the host in PowerProtect, and might cause other unexpected inconsistencies.

l For a protection policy backup with assets from different hosts, the backup status displays as "Failed" in the UI if the backup of one asset within the policy fails.

l Running the ddfssv and ddfsrc commands to perform self-service backup and restore of File Systems fails if you provide the Data Domain host name for the DFA_SI_DD_HOST variable.

l A File System backup might fail with the error Insufficient space exists in the volume group for creating shadow of the volume when there is not enough space in the volume group for a block based backup to succeed. Each volume group on LVM2 or VxVM must have at least 10% free space.

l On the Linux hosts that have the UEFI Secure Boot option enabled, block based backup drivers do not load, and the error message insmod: ERROR: could not insert module /lib/ modules/ 3.10.0-693.el7.x86_64/ extra/nsrbbb.ko: Required key not available appears. As a workaround, you can disable the Secure Boot option.

l On Linux, the block based incremental backups consistently fail and display a message similar to save: Block Based Error subsystem error while performing Block Based Backup. Check if any other process is already accessing the snapshot, or delete the snapshot manually, and then try again.

l If the Bytes of sector sizes of the source and target volumes are different, PowerProtect Data Manager does not support block based image recoveries. For example, you cannot perform a block based image recovery of a volume that has 4096 as the Bytes of sector size to a volume that has 512 as the Bytes of sector size, and vice versa.

Time synchronization required between PowerProtect Data Manager and the systems it interfaces with

The PowerProtect Data Manager system time is synchronized with the ESXi host system time. It is critical to PowerProtect Data Manager operation that the PowerProtect Data Manager system time matches the systems that it interfaces with. Otherwise, compliance check will fail.

Dell EMC recommends that the ESXi host, and all of the systems that the ESXi host interfaces with, be configured to use a NTP server.

PowerProtect Data Manager allows completion of protection policy when storage unit on the Data Domain cannot be created

When adding a protection policy in PowerProtect Data Manager, creation of a storage unit on the selected Data Domain system fails if you reach the maximum Mtree count on the Data Domain. However, PowerProtect Data Manager allows you to finish adding the protection policy without the storage unit. If you subsequently run a backup of this protection policy, instead of the backup failing or an error message displaying, the backup hangs indefinitely.

Best Practices and Troubleshooting

192 PowerProtect Data Manager Administration and User Guide

If this occurs, clean up on the Data Domain is required in order to continue backup operations on this device.

Viewing the DD Boost storage unit password PowerProtect Data Manager provides a script to retrieve the password of a DD Boost unit that is configured as a backup target.

Before you begin

This process requires the name of the Data Domain MTree where the DD Boost storage unit resides.

Procedure

1. SSH to the PowerProtect Data Manager appliance as the admin user.

2. Navigate to the /usr/local/brs/puppet/scripts directory.

3. Obtain the DD Boost storage unit password by typing the following command:

./get_ _credential.py PLC-PROTECTION-1551667983302

Best Practices and Troubleshooting

PowerProtect Data Manager Administration and User Guide 193

Best Practices and Troubleshooting

194 PowerProtect Data Manager Administration and User Guide

CHAPTER 14

Modifying the System Settings

This section includes the following topics:

l System settings................................................................................................196 l System Support................................................................................................198 l Upgrade PowerProtect Data Manager ............................................................ 206 l Managing certificates after upgrading from versions earlier than PowerProtect

Data Manager 19.1............................................................................................208 l Modifying the PowerProtect Data Manager virtual machine disk settings....... 209 l Configure the Data Domain system................................................................... 211

PowerProtect Data Manager Administration and User Guide 195

System settings You can use the PowerProtect Data Manager UI to modify system settings that are typically configured during PowerProtect Data Manager installation.

To access System Settings, click the icon in the top-right.

Modify the network settings Perform the following steps if you want to modify the IP address, subnet mask, gateway, and DNS servers that are defined for the appliance.

Procedure

1. Select System Settings > System > Network.

2. Update the fields as necessary:

l Domain Name

l IP Address Note: When you change the domain name or IP address, the system becomes unavailable until all components are restarted.

l Subnet Mask

l Gateway

l Primary DNS

l Secondary DNS

3. Click Save.

Modify the appliance time zone Perform the following steps if you want to modify the time zone for the PowerProtect Data Manager appliance.

Procedure

1. Select System Settings > System > Timezone.

2. In the Timezone field, select the desired time zone from the menu.

3. Click Save.

Change the system root user password Perform the following steps if you want to change the password for the root user.

Procedure

1. Select System Settings > Authentication.

The System Users window appears.

2. Select User name of the user password that you want to edit and click Edit.

The Change the password for the root user window appears.

3. Type the existing password in the Old Password field.

4. Type the new password in the New Password field, and then retype it in the Confirm Password field.

Modifying the System Settings

196 PowerProtect Data Manager Administration and User Guide

5. Click Save.

Enable replication encryption You can select the Replication Encryption option within the PowerProtect Data Manager UI to ensure that replicated content gets encrypted while in-flight to the destination storage and then decrypted before being saved on the destination.

About this task

Note that the encryption settings on both the source and destination systems must match in order to ensure successful replication. For example, if you enable in-flight encryption in PowerProtect Data Manager, the setting must be explicitly enabled on each source and destination server before defining the PowerProtect Data Manager replication objective. If encryption is enabled after the initial definition of replication objectives, any replication jobs initiated during the period that the source and destination server encryption settings did not match will fail.

Procedure

1. Select System Settings > Security.

The Security dialog appears.

2. Move the Replication Encryption slider to the right, and then click Save.

After you finish

The Infrastructure > Storage window of the PowerProtect Data Manager UI displays the status of the in-flight encryption setting for all attached storage systems. Note that for systems with DDOS version 6.2 and earlier installed, the status might display as Unknown.

You can take additional steps on your PowerProtect Data Manager server to enable in- flight encryption on connected Data Domain systems by using Data Domain System Manager, as described in the Data Domain Operating System Administration Guide.

License types Learn about the licenses that are available.

The following list provides information about the license types:

l Trial licenseApplied automatically on installation of PowerProtect Data Manager and enables full use of the product without applying a license key for up to 90 days. When the trial period ends, PowerProtect Data Manager continues to operate with full functionality, so you can apply a permanent license.

l Front-end protected capacity by terabyte or FETBThe primary model of eLicensing, which is based on the actual capacity that you want to protect. For example, you can purchase a 100-TB license, which enables you to protect up to 100 TB of actual data.

l Socket-basedLicensed per CPU socket on virtual machine hosts being backed up and/or replicated.

Note: When you upgrade from a previous release, for example, 3.0.0-18, to PowerProtect Data Manager 19.1, any existing license and its associated secure remote services (SRS) connection get removed from the system, and replaced with the 90-day trial license. If you have a valid FETB or Socket-based license for PowerProtect Data Manager19.1, ensure that you upload this license and set up the associated SRS connection.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 197

Perpetual and term-based (subscription) licensing

Licensed software is offered in perpetual and term-based licenses. Your quote will identify whether your license rights are perpetual or term-based.

A perpetual license enables you to use the software for as long as you are in compliance with the terms of the license agreement.

A term-based license enables you to use the software for a specified period of time, as long as you are in compliance with the terms of the license agreement. At the end of the license term, you must either stop using the software, extend the license term, or purchase new licenses through an agreement with Dell EMC.

PowerProtect Data Manager licenses The License area in Settings provides PowerProtect Data Manager license status details, such as capacity usage and software ID number. You can also add a license file to the PowerProtect Data Manager.

Before you begin

You can obtain the .xml license file from the Dell EMC license management website. To obtain the license file, you must have the License Authorization Code (LAC), which was emailed from Dell EMC. If you have not received the LAC, contact your customer support representative.

About this task

To review existing license information, go to Settings > License.

To add a license, perform the following steps.

Procedure

1. Click the System Settings icon along the top-right: .

2. Go to Settings > License > Upload file.

3. Do one of the following:

l Copy and paste license file text into the License window.

l Browse to the location where a license file is located, select the license file and click Open.

The license file content appears in the License window.

4. Click Save.

Results

A message appears in the License window to confirm that the license is successfully added.

System Support You can use the PowerProtect Data Manager UI to manage and modify support settings, such as the mail server setup and Secure Remote Services registration, that are typically configured during installation.

To access the Support window, click the icon in the top-right, and then select System Settings > Support.

Modifying the System Settings

198 PowerProtect Data Manager Administration and User Guide

Register the Secure Remote Services gateway Secure Remote Services (SRS) allows you to register PowerProtect Data Manager with a gateway host IP address for remote access. You can register only one SRS gateway for PowerProtect Data Manager. After PowerProtect Data Manager is registered, Technical Support Engineers can remotely connect to PowerProtect Data Manager to troubleshoot issues, and you can upgrade PowerProtect Data Manager by using SRS version 3.36.20.10 or later.

Before you begin

l You must apply a valid PowerProtect Data Manager license appliance.

l You must have an SRS gateway ServiceLink account open and deployed. Your Dell EMC Sales representative can assist you.

About this task

If you update a license file with a different SWID, the SRS gateway requires the new SWID. Reregister the license file with the SRS gateway to ensure the SRS gateway has the new SWID.

Procedure

1. From the PowerProtect Data Manager UI, select System Settings > Support > Secure Remote Services

2. Enter the following information:

l The hostname or IP address of the virtual machine that is deployed for SRS.

l The username and password for the SRS gateway account. The SRS gateway account credentials are provided by the ServiceLink team.

3. Click Save to complete registration of the SRS gateway.

Note: Currently, you can use only an IPv4 address for the gateway. IPv6 is not supported.

Remove the Secure Remote Services gateway

Before you begin

You must disable Auto Support to delete Secure Remote Services. If you have Auto Support enabled, you will receive an error message when you attempt to delete Secure Remote Services.

About this task

Use the following procedure to remove the Secure Remote Services gateway.

Procedure

1. From the PowerProtect Data Manager UI, select System Settings > Support > Auto Support.

2. Move the Enable Auto Support slider to Disabled, and then click Save.

3. Select System Settings > Support > Secure Remote Services

The Secure Remote Services Configuration dialog box appears.

4. Click Delete to remove the Secure Remote Services gateway.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 199

Callhome When you register an SRS gateway, you also enable the Callhome feature, which allows Technical Support Engineers to collect data that is related to troubleshooting device and PowerProtect Data Manager software issues. Callhome does not collect any personal information.

Callhome populates three reportsa telemetry report, an alert summary report, and a PowerProtect Central report. The following table lists the information that Callhome collects for the telemetry report.

Table 27 Telemetry report information

Category Type of information collected

PowerProtect Data Manager appliance

l Date of the last upgrade

l Any applied patches

l Version of the appliance

l Uptime (in days) since the last appliance reboot

l Operating system version

l Installation date

l Telemetry report last sent date

l System upgrade packages

l Hostname

l Node ID

l Time zone

l Secondard DNS configured

l Number of additional users

l Backup configured

l Backup storage type

Asset Sources l DDMC instances

l XMS instances

l vCenter instances

l SMIS instances

l SQL groups instances

l RecoverPoint instances

Hosts information l ESXi hosts

l ESXi cluster hosts

l Application hosts

Data Domain inventory

l Number of Data Domain systems

l Data Domain operating system version and system ID

l MTree inventory

Modifying the System Settings

200 PowerProtect Data Manager Administration and User Guide

Table 27 Telemetry report information (continued)

Category Type of information collected

l Asset source ID

l Serial number

l Model

l Data Domain system capacity

PowerProtect Data Manager operational inventory

l Asset information (number of assets, asset groups, assets protected versus unprotected)

l Protection policies (number of policies)

l Tags (number of tags and tag categories)

l Active protection policy details (assets and their types, objectives for each stage)

l Failed jobs

l Application agents

l SLA violations

l External proxies

Usage l Amount of data that is protected

Licensing l Status of the applied license

Compliance in last 24 hours

l FETB in compliance

l FETB out of compliance

Callhome collects details about the following objects for the PowerProtect Central report:

l Protection Life Cycle

l Service Level Agreement

l Assets

l Storage Systems

l Data targets

l Protection Details

l Compliance Details

l Audit logs

Set up the email server The Email Setup area on the PowerProtect Data Manager System Settings area enables you to set SMTP email server information to send emails for resetting local user passwords and customized alert notifications.

Procedure

1. Select System Settings > Support > Email Setup.

2. Populate the following fields:

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 201

a. Mail Server

The SMTP mail server.

b. Email from:

The email address at which you would like to receive the PowerProtect Data Manager autosupport email.

c. [Optional] Recipient for Test Email:

The email address to which you would like to send the PowerProtect Data Manager test email.

d. [Optional] Port:

The default port is 25. PowerProtect Data Manager supports using nondefault ports.

If the SMTP port is deleted, you must manually choose any nondefault port that is not in use anywhere else.

e. User Name:

The user name associated with the PowerProtect Data Manager SMTP email server.

f. Password:

The password associated with the PowerProtect Data Manager SMTP email server.

3. Click Send Test Email.

PowerProtect Data Manager sends a test email.

4. Click Save.

Add Auto Support When auto support is enabled, auto support information, telemetry reports, alert summary, and PowerProtect Central reports will be sent.

About this task

If Secure Remote Services and SMTP are both configured, this information will be sent via Secure Remote Services.

Procedure

1. Select System Settings > Support > Auto Support.

The Auto Support window appears. The PowerProtect Data Manager

2. Change the Enable Auto Support option to Disabled or Enabled, and click Save.

When you enable Auto Support, the Telemetry Software Terms page displays. Review and scroll down to the bottom of the page to accept the terms, and then click Save to save your changes.

When you disable Auto Support, PowerProtect Data Manager stops sending error and telemetry data to SRS or the SMTP server. PowerProtect Data Manager continues to send information for upgrades and other information.

Modifying the System Settings

202 PowerProtect Data Manager Administration and User Guide

Note: You must disable Auto Support to delete SRS.

Add a log bundle Use the following procedure to add a log bundle.

About this task

Note: You can add a maximum of 10 log bundles.

Procedure

1. Select System Settings > Support > Logs.

2. Click Add to add a log bundle.

The Add Log Bundle window appears.

3. Select the systems for the log bundle (Data Manager and/or VM Proxy), set the log bundle duration, and click Save.

The range can be a maximum period of 7 days up to the current date. The range must be a minimum of 1 day.

The Jobs window displays the progress of the log bundle creation. Additionally, a green banner in the UI indicates that the log bundle has successfully been created. If you want to dismiss the banner, click X.

4. To delete the log bundle, select the box to the left of log bundle and click Delete.

The Log Capacity indicates how much space in GB remains on the disk for logs and the percentage of the disk in use for log storage.

5. To download the log bundle, click the bundle name.

Monitor system state and system health In addition to the summary system health view provided in the PowerProtect Data Manager UI's Dashboard window, the System Settings > Support window provides a further breakdown of PowerProtect Data Manager system health information.

Monitor system component health Through the Settings window, you can monitor the state of the appliance and the health of each system component. .

To view the health of system components, click the icon in the top-right, select System Settings > Support, and then select System Health.

The following table provides a summary of each component state.

Table 28 Component status

Status Description

Running This state appears when the associated service or component is running with full functionality. When all components are in running state, the state of the appliance is operational.

Initializing This state appears when the component is starting. When the component successfully starts, the state changes to Running.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 203

Table 28 Component status (continued)

Status Description

Maintenance This state appears when the associated service is in maintenance. In the maintenance state, components have limited functionality. Infrastructure services do not go into maintenance state. When other components are in maintenance, the appliance state is also maintenance.

Note: You must put the appliance in Maintenance mode for some configuration changes, for example, to upgrade the appliance. When configuration changes or an update completes, you must manually change the state of the appliance from Maintenance to Operational.

Quiesce This state appears when the service that is associated with the component is stopping.

Shut down This state appears when the service has stopped.

No response This state appears when the service that is associated with the component is running, but the service is not responding.

Business Service components

The following table summarizes the business services health components.

Table 29 Business Service components

System option Description

Application Data Management Service Provides the status of the Application Data Management Service.

Common Business Service Provides the status of the Common Business Service.

Storage Manager Provides the status of the Storage Manager.

VMDM Provides the status of the VMDM service.

Replication Manager Provides the status of the Replication Manager service.

Cloud Manager Provides the status of the Cloud Manager service.

Core Service system health components

The following table summarizes the core services system health components.

Table 30 Core system health components

System option Description

Authentication Provides the status of the Authentication Service.

Event Provides the status of the Event Service.

Log Manager Provides the status of the Log Manager service.

Server Disaster Recovery

Provides the status of a system disaster recovery

Modifying the System Settings

204 PowerProtect Data Manager Administration and User Guide

Table 30 Core system health components (continued)

System option Description

System Manager Provides the status of the System Manager.

Infrastructure Service system health components

The following table summarizes the Infrastructure system health components.

Table 31 Infrastructure system health components

System option Description

API Gateway Provides the status of the API Gateway service.

Catalog Store Provides the status of the Catalog database.

HTTP Proxy Provides the status of the HTTP Proxy service.

Message Bus Provides the status of the Message Bus.

Secrets Manager Provides the status of the Secrets Manager service.

Service Manager Provides the status of the Service service.

Service Registry Provides the status of the Service Registry service.

UI Provides the status of the User Interface service.

Workflow Database Provides the status of the Workflow database.

Management Service system health components

The following table summarizes the Management system health components.

Table 32 Management system health components

System option Description

Historical Provides the status of the Historical Data Service.

Monitoring Server Provides the status of the Server.

Scheduler Provides the status of the Scheduler service.

Telemetry Manager Provides the status of the Telemetry Manager service.

Workflow Manager Provides the status of the Workflow Manager service.

Protection Service system health component

The following table summarizes the Protection system health component.

Table 33 Protection system health components

System option Description

Compliance Verification

Provides the compliance status.

Discovery Provides the status of the Discovery Service.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 205

Configure PowerProtect Central reporting You can enable or disable PowerProtect Central data collection for Dell EMC storage systems.

Before you begin

l Add a valid license in Settings > License.

l Set up SRS in Settings > Support > SRS.

About this task

PowerProtect Central is a no-cost SaaS/cloud-based management application that proactively monitors and measures the overall health of Dell EMC systems through intelligent, comprehensive, and predictive analytics. The data reported to PowerProtect Central includes configuration data, historical metrics and health score data.

Procedure

1. Select System Settings > Support > Auto Support.

2. Click Enable Auto Support or Disable Auto Support.

Results

When Auto Support is enabled, PowerProtect Central reports are sent automatically. To log in to PowerProtect Central, click the Reporting menu item, or go to https:// powerprotectcentral.emc.com

For more information on PowerProtect Central, refer to the PowerProtect Central Online Support site.

Upgrade PowerProtect Data Manager Perform the following steps to upgrade PowerProtect Data Manager 19.1 and later.

Before you begin

Complete the following steps before beginning the upgrade process:

1. Ensure that you have a Dell EMC Online Support account to access PowerProtect Data Manager software update packages from https://www.dell.com/support/ home/us/en/19?app=drivers&sc=e&lwp=rt.

2. Ensure that you have administrator credentials. Only a PowerProtect Data Manager administrator can initiate the upgrade.

3. Check for running tasks, and cancel them, or allow them to complete.

4. Disable any Protection Policies that are scheduled to run in the next few hours.

5. Take a snapshot of the system: Select the PowerProtect VM in the vSphere client, right click, and then select Snapshot > Take snapshot .

About this task

You can upgrade PowerProtect Data Manager by manually downloading upgrade packages or by connecting to an SRS gateway.

When PowerProtect Data Manager is licensed and you have registered the SRS gateway host with PowerProtect Data Manager, you can upgrade using SRS. When a PowerProtect Data Manager upgrade package is available, the packages are uploaded to the SRS gateway. The appliance checks the SRS gateway once a day for available upgrade packages, or you can manually initiate a check operation.

Modifying the System Settings

206 PowerProtect Data Manager Administration and User Guide

An upgrade package can upgrade one or more of the following:

l The PowerProtect Data Manager, including application agent installers stored on the PowerProtect Data Manager VM

l External vProxies

Procedure

1. If you have not configured SRS, download the upgrade package.

You can download the upgrade package from the Dell EMC Support website at https://www.dell.com/support/home/us/en/19?app=drivers&sc=e&lwp=rt.

2. From a host that has network access to the virtual appliance, use Google Chrome to connect to the appliance: https://appliance_hostname.

3. (Optional) If an SSL certificate warning page is displayed with the message, Your connection is not private, click Advanced, and then click. Proceed to hostname_or_ip_address (unsafe).

4. Type the system administrator user name and password and click Log In.

5. Click the System Settings icon in the banner.

6. Select Upgrade. The UI lists the latest available PowerProtect Data Manager package. Select the package and click Upload Upgrade File.

7. (Optional) If the system is unable to locate an upgrade package or if you are using the manual package download method, click Upload Upgrade File to select the upgrade file manually.

a. Browse to the path that contains the upgrade package, select the package, and click Open.

An upgrade status progress bar is displayed.

8. Click OK to close the package upload status message.

The UI shows details of the package, including a description, a list of the subcomponents inside the package, and one of the following States:

l ProcessingThe precheck stage is ongoing. Wait until the state changes to Available.

l AvailableThe upgrade package is valid and ready for installation.

l InvalidThe upgrade package is not valid and cannot be installed.

9. When the package state is Available, click the Perform Upgrade button to the right of the upgrade package.

10. Click YES to accept any required certificates.

Note: If any tasks are running, a warning dialog box appears. Click View Tasks or Proceed Install (default) to continue the install process.

11. Depending on the contents of the upgrade package, the UI might prompt for a lockbox pass phrase. Enter the pass phrase so that the lockbox can be reset after restart.

The lockbox pass phrase was set at deployment time, and by default is the same as the admin password.

After the upgrade completes, the browser is redirected to the Upgrade Manager UI on port 14443. This enables you to monitor upgrade progress while the PowerProtect Data Manager components are shutdown for the upgrade.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 207

Note: To monitor the update status if the connection to the appliance closes, connect to https://IP_address_appliance:14443.

When the upgrade completes successfully, the browser is redirected back to the main PowerProtect Data Manager UI logon page.

12. Log in toPowerProtect Data Manager.

13. Return to the Upgrade page to verify that the state of the upgrade is Installed.

Results

The overall package status covers critical upgrades for the PowerProtect Data Manager. Other subcomponents, such as Agents and vProxies, may still be processing, or even fail. This does not impact the overall status of the upgrade. You can view the state of each subcomponent by expanding the package that was installed.

Note: If the upgrade fails, you must delete the failed package before uploading a new package (or the same package) to try again.

After you finish

Use the vSphere web client to delete the snapshot:

1. Right-click the appliance and select Manage Snapshots.

2. In the Manage Snapshots window, select the snapshot and click Delete.

Managing certificates after upgrading from versions earlier than PowerProtect Data Manager 19.1

Use this procedure to ensure that certificates existing on the pre-upgrade system also exist on the post-upgrade system.

Before you begin

Ensure that you update any expired certificates on external systems to valid certificates.

Procedure

1. Log in to thePowerProtect Data Manager operating system with administrator credentials.

2. Run the upgrade command:

/usr/local/brs/lib/secretsmgr/bin/secretsmgr-tls-upgrade

The system displays the external system certificates.

3. Verify each certificate as trusted or untrusted: At the prompt for each certificate, type Y to accept.

Any other character rejects the certificate. Expired certificates are automatically rejected.

Modifying the System Settings

208 PowerProtect Data Manager Administration and User Guide

Modifying the PowerProtect Data Manager virtual machine disk settings

Follow the steps in this section, under the guidance and recommendations of Dell EMC Support, to expand the size of the data disk and system disk, and modify the memory configuration.

Modify the virtual machine memory configuration Adjust the PowerProtect Data Manager virtual machine memory configuration to support changes in the protection environment.

Before you begin

Shut down PowerProtect Data Manager and the VM Proxy.

Procedure

1. Log in to the vSphere Web Client.

2. Right-click the appliance and select Edit Settings.

The Edit Settings window appears with the Virtual Hardware button selected.

3. In the Memory field, specify the new memory value.

Ensure that the value you specify does not exceed 16 times the amount of memory the virtual machine has when powered on and is a multiple of 4 MB.

4. Click OK.

Modify the data disk size Follow these steps to expand the size of a data disk that is single partitioned and has the log partition is on the system disk.

Procedure

1. Perform the following steps from the vSphere Web Client:

a. Right-click the VM Proxy and select Shut Down Guest OS.

b. After the power off completes, right-click the appliance and select Edit Settings.

The Edit Settings window appears with the Virtual Hardware button selected.

c. Increase the provisioned size of Hard disk 2 to the desired size, and then click OK.

Note: You cannot decrease the provisioned size of the disk.

d. Right-click the VM Proxy and select Power On.

2. Perform the following steps from the appliance console, as the root user.

Note: If you use ssh to connect to the appliance, log in with the admin account, and then use the su command to change to the root account.

a. Reboot the appliance by typing reboot.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 209

b. On the GNU GRUB menu, press Esc to edit the GNU GRUB menu.

c. In the edit screen, search for the line that starts with Linux, and then add word single before the entry splash=0

The following figure provides an example of the edit screen with the updated text. Figure 12 Editing the GNU GRUB menu

d. Press Ctrl-x to reboot into single-user mode.

e. When prompted, type the password for the root account.

f. Unmount the data disk, by typing umount /data01.

g. Start the partition utility, by typing parted, and then perform the following tasks:

a. Type select /dev/sdb.

b. Type print. If you are prompted to fix issues, type fix at each prompt. The output displays the new disk size in the Size field and the current size in the table.

c. Type resize 1 new_size. Where new_size is the value that appears in the Size field in the output of the print command.

For example, to resize the disk to 700 GB, type: resize 1 752GB d. Type quit.

3. Reboot the VM Proxy by typing systemctl reboot.

4. Log in to the console as the root user.

Note: If you use ssh protocol to connect to the VM Proxy, log in with the admin account, and then use the su command to change to the root account.

5. Grow the xfs file system by typing xfs_growfs -d /data01.

6. Confirm the new partition size by typing df -h.

Modifying the System Settings

210 PowerProtect Data Manager Administration and User Guide

Modify the system disk size Follow these steps to expand the size of a data disk when the log partition is the last partition on the system disk.

Procedure

1. Perform the following steps from the vSphere Web Client:

a. Right-click the VM Proxy and select Shut Down Guest OS.

b. After the power off completes, right-click the appliance and select Edit Settings.

The Edit Settings window appears with the Virtual Hardware button selected.

c. Increase the provisioned size of Hard disk 1 to the desired size, and then click OK.

Note: You cannot decrease the provisioned size of the disk.

d. Right-click the VM Proxy and select Power On.

2. Boot from a SuSE Linux Enterprise Server (SLES) version 12 CD.

3. Start the partition utility, by typing parted, and then perform the following tasks.

a. Type select /dev/sdx.

b. Type print. If you are prompted to fix issues, type fix at each prompt. The output displays the new disk size in the Size field and the current size in the table.

c. Type quit.

4. Reboot the VM Proxy by typing systemctl reboot.

5. Log in to the console as the root user.

Note: If you use ssh protocol to connect to the VM Proxy, log in with the admin account, and then use the su command to change to the root account.

6. Grow the xfs file system by typing xfs_growfs -d /data01.

7. Confirm the new partition size by typing df -h.

Configure the Data Domain system Before you begin

Before you can use Data Domain to protect the system, use NFS to export the MTree that PowerProtect Data Manager uses on the Data Domain system. The setup on Data Domain requires that you add the PowerProtect Data Manager client with no_root_squash.

Procedure

1. Use a web browser to log in to the Data Domain System Manager as the system administrator.

Modifying the System Settings

PowerProtect Data Manager Administration and User Guide 211

2. In the Summary tab, Protocols pane, select NFS export > create export.

The Create NFS Exports window appears.

3. In the Create NFS Exports window:

a. In the Export Name field, specify the name of the Data Domain MTree.

b. If you have not yet created the Data Domain MTree, follow the prompts to create the MTree and click Close.

c. In the Directory path field, specify the full directory path for Data Domain MTree that you created. Ensure that you use the same name for the directory.

d. Click OK.

A message appears to indicate that the NFS export configuration

Manualsnet FAQs

If you want to find out how the 19.1 Dell works, you can view and download the Dell PowerProtect 19.1 Data Manager Administration And User Guide on the Manualsnet website.

Yes, we have the Administration And User Guide for Dell 19.1 as well as other Dell manuals. All you need to do is to use our search bar and find the user manual that you are looking for.

The Administration And User Guide should include all the details that are needed to use a Dell 19.1. Full manuals and user guide PDFs can be downloaded from Manualsnet.com.

The best way to navigate the Dell PowerProtect 19.1 Data Manager Administration And User Guide is by checking the Table of Contents at the top of the page where available. This allows you to navigate a manual by jumping to the section you are looking for.

This Dell PowerProtect 19.1 Data Manager Administration And User Guide consists of sections like Table of Contents, to name a few. For easier navigation, use the Table of Contents in the upper left corner.

You can download Dell PowerProtect 19.1 Data Manager Administration And User Guide free of charge simply by clicking the “download” button in the upper right corner of any manuals page. This feature allows you to download any manual in a couple of seconds and is generally in PDF format. You can also save a manual for later by adding it to your saved documents in the user profile.

To be able to print Dell PowerProtect 19.1 Data Manager Administration And User Guide, simply download the document to your computer. Once downloaded, open the PDF file and print the Dell PowerProtect 19.1 Data Manager Administration And User Guide as you would any other document. This can usually be achieved by clicking on “File” and then “Print” from the menu bar.