after v9 U2 install: Backup Service does not start

[hirratas]

Case 01873743

Hi
this morning I read Gostevs Mail and decided to install v9 Update 2.
After the installation the Backup Service fails to start (error 1053).

Anyone else experienced this issue?

My SQL Server and db is up and I can see in SQL Logs that the Logon user of the Backupservice logons successfully.

I restarted the B&R Server and the SQL Server without success.

Thanks

[EDIT] Click here for solution

[widmerkarl]

Hi,

What says the eventlog of the server?

Did you check the user account used on the Backup Service? Usually its installed / started with [DOMAIN\administrator].

Did you use a another account, perhaps a service account? Did you try to change the user which starts this service?

[hirratas]

application event log / event id 0:

Code: Select all

Der Dienst kann nicht gestartet werden. Veeam.Backup.DBCreator.DatabaseException: Failed to deploy database. Alter failed for Database 'Veeam'. 
   bei Veeam.Backup.DBCreator.BackupDatabaseDeployer.Deploy()
   bei Veeam.Backup.DBManager.SqlRetryableInitializer.Init()
   bei Veeam.Backup.Service.CVbServiceImpl..ctor(CVbEnvironment env, CTerminationMediator terminator)
   bei Veeam.Backup.Service.CVeeamBackupSvc.OnStart(String[] args)
   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Service account is the same (correct one) as prior the update. I also resaved it to make sure.
As I said the account successfully logs on to the SQL Server.
Sorry for the bad English.

[widmerkarl]

No problems with the english, i'm also not a native english speaking person

I found a blog post which describes exactly your problem:
http://www.webbosworld.co.uk/?p=632#prettyPhoto

He is working with the PSTools from SysInternals and deleted the VeeamEndPoint instance.

Then he did a repair install of Veeam Backup & Replicaiton.

[hirratas]

Thanks a lot.

I will wait for a reply from Veeam Support.
I do not want to do something wrong.
If Support does not come up with a solution I will try this.

Anyway I will update this thread with the outcome.

[widmerkarl]

No problem, we are all trying to help.

Thanks for keeping us posted.

[hirratas]

Veeam Support gave me a call half an hour after the appointment and gave the User for "Veeam Backup Service" sysadmin rights on the SQL Server instance. He did not even asked me if he could give the user sysadmin rights.
I asked the Support if this is neccessary and explained that SQL sysadmin rights were not neccessary since Veeam v6, and that the user just has db_owner permissions on the db.

He told me that it is neccessary that this user has sysadmin rights on the sql instance and did not explain anything further.
The service then started fine.
I removed the sysadmin rights again because it does not comply with our regulations, and restarted the Veeam Server and the service is running. Maybe after Upgrade 2 some operations needed to take place and more permissions were neccessary for a short time. Not concinved from Veeam Support.

According this sysadmin rights are not neccessary: https://helpcenter.veeam.com/backup/vsp ... sions.html
Microsoft SQL Server
The account used to run Veeam Backup Service requires db_datareader and db_datawriter roles as well as permissions to execute stored procedures for the configuration database on the Microsoft SQL Server. Alternatively, you can assign db_owner role for this database to the service account.

[Sistemi.informativi]

Thank you

I got the same exact problem after i upgrade from Veeam B&R9u1 to u2, I add the sysadmin rights to the Veeam SQL login user and solve the problem.

[hirratas]

Good thing with It problems is that you are not the only one with it

[Gostev]

We will investigate.

[Gostev]

Confirmed: upgrade requires db_owner, after that you can drop account permissions back to "db_datareader and db_datawriter roles as well as permissions to execute stored procedures".

[chattingh]

We have experienced the same issue. After installing v9 update 2, the Veeam Backup Service will not start.

In our case, the Veeam Service Account was already db_owner. To fix I had to temporarily grant the Veeam Service Account sysadmin rights on the SQL server to get the service to start. Once that was done, the sysadmin rights were removed and the Veeam Backup Service starts & stops fine.

[Gostev]

We can't confirm this one. QC has just completed an additional round of testing, and they could not reproduce any upgrades problems with Veeam Service Accounts not having sysadmin rights on the SQL Server. All upgrades completed successfully with db_owner privilege alone during their tests.

Could it be that some other issue was preventing the Veeam Backup Service from starting in your case, and it was not granting sysadmin that fixed it?

[chattingh]

That is very interesting Gostev.
It happened across two installs, although same SQL server. This was the error logged in the application event log every time we tried to start the service unsuccessfully:

Service cannot be started. Veeam.Backup.DBCreator.DatabaseException: Failed to deploy database. Alter failed for Database .....

SQL 2014 Exp installed separately, not as bundled with Veeam if that helps at all.

[Gostev]

Yes, they have tested with SQL Server 2014 as well. If you have time, please send setup logs to support and we will investigate. Thanks!

[mkaec]

The same thing occurred with me. Both VeeamEnterpriseManagerSvc and VeeamBackupSvc would not start until I granted sysadmin rights. The user already had db_owner access to both databases and dbcreator rights on the server. This is also with SQL Server 2014. After starting the services the first time, I was able to remove sysadmin rights.

Thanks to this thread, I am up and running.

[alanbolte]

What service pack and cumulative update are you all running? I'm wondering if the problem might be with some specific version.

[chattingh]

Hi Gostev, I have PM'ed you a link to the setup logs. I have taken them from C:\ProgamData\Veeam\Setup\Temp. Let me know if there are others you require.

[mkaec]

What service pack and cumulative update are you all running? I'm wondering if the problem might be with some specific version.

Ours is SQL Server 2014 SP1 CU6 12.0.4449. And Veeam was 9.0 Update 1 with hotfix 68457.

[albertwt]

OK, so in this case, We shall elevate the SQL Server service account privillege to sysadmin role first before applying the VBR 9.0 Update 2 upgrade ?

[Vitaliy S.]

Shouldn't be required according to the posts on the previous page, but to be on the safe side you can temporarily do it as a part of the upgrade procedure.

[Gostev]

OK, we've found the real cause: db_owner on Veeam configuration database is indeed sufficient, it is another permission elsewhere that is lacking.

Code: Select all

VIEW SERVER STATE permission was denied on object ‘server’, database ‘master’

The failing query is required to obtain some information regarding Veeam configuration database from SQL Server, and this information resides in the system table. But depending on SQL Server version, accounts may not have a privilege to view system table content by default.

So instead of granting sysadmin role, you can simply grant Veeam service account the required rights:

Code: Select all

GRANT VIEW SERVER STATE TO "DOMAIN\ACCOUNT"

@chattingh your case is actually very different (another operation fails) and support needs additional logs to investigate it.

[mkaec]

That makes sense. Granting admin rights often satisfies the immediate need, but is usually overbroad and doesn't address the actual cause of the problem.

[sooperfly]

I upgraded as well from 9.0 Update1 to Update2 and experience the exact same log. Setting the Windows Service account used for SQL to have sysadmin rights allowed the service to start. This was following a reboot post upgrade. The services failed to start during the upgrade (Backup and Enterprise Manager) and prompted to start them manually. Glad to send any logs to whomever that may be of use. I will go ahead and fix the permissions as suggested.
Thanks all!

[rgeorge]

Hi guys,

im having the same issue, once update 2 is installed, im not even able to open the console , i get the below message

Failed to connect to Veeam Backup and Replication server : No connection could be made because the target machine actively refused it 127.0.0.1:9392

Also please advise how i can " temporarily grant the Veeam Service Account sysadmin rights on the SQL server to get the service to start "

Appreciate your help, im pretty nice to Veeam

Thanks
Raj

[glouton]

Hi,

I got the same issue here. Server has been upgraded from v8 update 2 to v9 (success) then to v9 update 2 (failed).

SQL server is a 2014 version and the service account is dbo on VeeamBackup.

Log file shows:

Code: Select all

[29.08.2016 13:30:59] <04> Info     [DB|ERROR] Alter failed for Database 'VeeamBackup'.  (Microsoft.SqlServer.Management.Smo.FailedOperationException)
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Smo.SqlSmoObject.AlterImpl()
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Smo.Database.Alter(TerminationClause terminationClause)
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Veeam.Backup.DBCreator.DatabaseNamedOptions.Set()
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Veeam.Backup.DBCreator.BackupDatabaseDeployer.Deploy()
[29.08.2016 13:30:59] <04> Info     [DB|ERROR] An exception occurred while executing a Transact-SQL statement or batch. (Microsoft.SqlServer.Management.Common.ExecutionFailureException)
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Smo.Database.IsDatabaseEncryptionKeyPresent()
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Smo.Database.ScriptAlter(StringCollection alterQuery, ScriptingPreferences sp)
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Smo.SqlSmoObject.AlterImplWorker()
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Smo.SqlSmoObject.AlterImpl()
[29.08.2016 13:30:59] <04> Info     [DB|ERROR] L'autorisation VIEW SERVER STATE a été refusée sur l'objet 'server', base de données 'master'.
[29.08.2016 13:30:59] <04> Info     [DB|ERROR] L'utilisateur n'est pas autorisé à effectuer cette action. (System.Data.SqlClient.SqlException)
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Common.ConnectionManager.ExecuteTSql(ExecuteTSqlAction action, Object execObject, DataSet fillDataSet, Boolean catchException)
[29.08.2016 13:30:59] <04> Info     [DB|ERROR]    à Microsoft.SqlServer.Management.Common.ServerConnection.ExecuteWithResults(String sqlCommand)
[29.08.2016 13:30:59] <04> Error    An error occurred during the connect to sql server. Failed to deploy database. Alter failed for Database 'VeeamBackup'. 

It seems that VIEW SERVER STATE is needed. I gave sysadmin rights to the service account (OMG !!!) and reinstalled update 2. It worked.

The veeam database maintenance needs more than "simple" dbo rights.
When the upgrade is over, sysadmin rights are no longer needed. I think, it should be fixed. In real life, sysadmin rights are never given to a service account.

[foggy]

Above you can find instructions on how to grant Veeam service account the required rights without giving it sysadmin role.

[rgeorge]

Hi Glouton and Foggy,
Glad to know that giving sysadmin rights to service account worked, please advise how we do this. my apologies since im pretty new to veeam , infact this is my first install of veeam.

Like how some mentioned here Veeam 9 version 902 works well, im able to add Server 2008 R2 as back up repository BUT NOT server 2012

When update 1 is applied i can have server 2008 R2 as back up repository BUT NOT server 2012

But when update 2 is applied , i cannot even open the console

I dont have separate SQL server , im not sure how to give sysadmin rights to service account , please help

Thanks
Raj

[foggy]

Hi Raj, you can google for the step-by-step instruction on granting roles and permissions in SQL Server Management Studio. Basically, all you need to do is executing the statement given by Anton above to grant the VIEW SERVER STATE permission to the Veeam service account (no need for full sysadmin role).

In case adding permissions doesn't help, feel free to contact technical support for a closer investigation.

[rgeorge]

Thanks Foggy, i will try that and let you know how it goes , appreciate your help guys