Agent-based backups for Windows and Linux, centralized agent management
Post Reply
tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm »

Veeam support case - 04726248

After upgrading from version 9.5 release 4b, to Version 11.0.0.837 I received these warnings after jobs complete. It appears the backups are successful, yet I've not been able to find a similar enough reported warning message. Nor could I track down the cause. I'm not seeing any new errors on the server being backed up. (Windows 2016 via remote Veeam agent)

Warning: Collecting recovery media files Details: This access control list is not in canonical form and therefore cannot be modified

Any help is appreciated!

Cheers

PetrM
Veeam Software
Posts: 1242
Liked: 190 times
Joined: Aug 28, 2013 8:23 am
Full Name: Petr Makarov
Location: Prague, Czech Republic
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by PetrM »

Hi Tim,

Thanks for providing a case ID! Most likely the error is provoked by specific ACL permissions at the OS level. Let's wait for findings of our support team.

Thanks!

tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm »

Veeam support case - 04726248
So my case was archived. I've not found a lot of information on this KB (https://www.veeam.com/kb3026) which suggests making a registry edit to work around the issue. My worry is the error doesn't show which ACL is the issue. Nor do I want to randomly run ICACL verify on all directories to see if this is resolved. Has anyone come across ACL warnings before? I haven't had time to try to restore from a backup with the warning yet they do seem to process data. We do run Webroot AV, yet I have the endpoint directories added to an exclusion set as well. https://www.veeam.com/kb2034

Cheers,
Tim

PetrM
Veeam Software
Posts: 1242
Liked: 190 times
Joined: Aug 28, 2013 8:23 am
Full Name: Petr Makarov
Location: Prague, Czech Republic
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by PetrM »

Hello,

We provide support on a "best effort" basis for customers using Community licensed products but you may try to open a support case once again. Every single attempt increases chances of getting support.

Thanks!

tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm »

Case #04739186

I ran the jobs with AV turned off and still get the warning. I guess checking all directories is next. https://docs.microsoft.com/en-us/window ... nds/icacls

tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm »

Case #04751729

I've not been able to location any information in the logs or forums as to which ACL is being accessed by Veeam to perform this backup. Is there a list of file sets used? I have not found any resolution via ICACLS verify commands. Though I have not run it on the whole of C:/Windows or C:/Programfiles.

Cheers,

PetrM
Veeam Software
Posts: 1242
Liked: 190 times
Joined: Aug 28, 2013 8:23 am
Full Name: Petr Makarov
Location: Prague, Czech Republic
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by PetrM » 1 person likes this post

Hi Tim,

Let's wait for what our support engineers can figure out.

Thanks!

tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm »

Case #04765287, all prior cases were closed without review. I know this is policy, but this seems excessive.

I can find no other related information on the process that Veeam runs to create the recovery media. I've not been able to locate the ACL the warning is referencing. Even locating related information on the given warning has been impossible to find, nor could I locate what the entry in the KB above controls. I will make an update after further testing.

Cheers,
Tim

Mike.Powell
Veeam Software
Posts: 5
Liked: 2 times
Joined: Jun 13, 2016 6:19 pm
Full Name: Mike Powell
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by Mike.Powell » 1 person likes this post

https://www.veeam.com/kb3026

explicitly set the location for Agent to unpack and backup the winRE component to C:\temp as described in the KB and it will resolve the issue, any other internal drive would also work, but C:\temp is the one I normally recommend people.
Can't speak to the logic or why it fails, way above my paygrade, but that'll fix it.

tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm »

#04778497
Thanks after a bit more research I found a way to restore should this break anything. I was just hesitate to make the entry as so little was available on the cause, and how the job creates the media along with what the registry edit from the KB actually does. I'll post an update after the outage window when I make our change.

Cheers
Tim-

tkCPSadm
Novice
Posts: 7
Liked: 1 time
Joined: Mar 29, 2021 4:04 pm
Full Name: tim kraft
Contact:

Re: This access control list is not in canonical form and therefore cannot be modified

Post by tkCPSadm » 1 person likes this post

I'm still not sure why it happened or if there is a better way, but this KB resolution did correct the issue. https://www.veeam.com/kb3026

Cheers
Tim

Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests