Backup Configuration Failed Since v8

[tfloor]

Hello,

I have upgraded to V8 and i have enabled the Encryption on all places.
But now i get this error each day, it will not make backups of the configuration anymore.

Code: Select all

24-11-2014 15:03:38 Error Unable to write to configuration backup file.
24-11-2014 15:03:38 Error Processing configuration VeeamBackup at WSQL1\MSSQLP1
24-11-2014 15:03:38 Error Compressing database VeeamBackup
24-11-2014 15:03:38 Error Key not valid for use in specified state.
24-11-2014 15:03:38 Error Creating configuration backup
24-11-2014 15:03:38 Error Writing data section
24-11-2014 15:03:38 Error Saving configuration catalog (0% done)

Any idea what this error means, and maybe a solution?

Thanks.

[foggy]

Tristan, configuration backup should also be encrypted if configuration contains encryption keys. Haven't you seen the corresponding warning once you've added the first encryption key?

Also, please don't forget to add a case ID any time you post about technical issues. Thanks.

[tfloor]

I already have the tickbox "Encrypt Configuration backup" ticked.
And created a password.

So i don't see any other things that i could missed.

[foggy]

Than once more I encourage you to contact support directly, since this behavior doesn't look as expected. Thanks.

[scott.lundberg]

I am having the same issue. Seems to be a problem with encrypting the backup specifically. In my case, it's choking on a saved root password for one of my linux servers.

[tfloor]

Than once more I encourage you to contact support directly, since this behavior doesn't look as expected. Thanks.

Alexander,

I will do that!
Thanks!

[scott.lundberg]

My case has been escalated.... 00686341 I will post back the results once I have a resolution.

[RGlintmeijer]

I had the same problem in my lab environment, after i had enabled encrypted config backup. I discovered there were some old (orphaned?) user accounts in the database, with encrypted passwords. After deleting the passwords of these accounts in the database, the config backup went succesful. So probably a support engineer can look at this and help you with it.

[veremin]

I believe that all credentials, even orphaned ones, can be listed through Get-VBRCredentials and then deleted through Remove-VBRCredentials. Thanks.

[TomR]

I'm having the same issue (Case # 00685623), I checked our user accounts using the Get-VBRCredentails and couldn't see any old/orphaned accounts.

[RGlintmeijer]

When i had the problem, i've first checked the logfiles for the exact error, and it gave some errors like this (don't know if you have the same):

Code: Select all

Cannot save database row (table: Ssh_creds, field: rootpassword, value: Veeam.Backup.Configuration.V80.PlainPasswordFieldValue). (System.Exception)
..
Key not valid for use in specified state

I assume the rootpassword field was encrypted on another installation of Veeam (and maybe an older version).

That's why i looked in the SQL database table dbo.Ssh_creds. There were some records with a filled rootpassword field, which didn't have a relation with a record in dbo.Credentials. (That's why i call them orphaned). I've cleared the rootpassword field for those records and the config backup was succesful.

The "orphaned" accounts do not show up in Get-VBRCredentials, that command seems to query dbo.Credentials.

Making changes to the database is not supported, so that's why i advise to let a support engineer help you with this.

[smarteam]

I also received this error, so I went to the main options screen, Configuration Backup option, and selected to use my encryption password that I had already created for the backups themselves.

[jp34]

Hi, I also receive this error (Case #01304777), support engineer asks me to retype all backup job credentials (Menu > Manage Credentials).
My jobs work fine, I dont understant why I should retype their passwords... whereas it's only "configuration backup job" which fails...
I have so many passwords to retype and I'm not sure it will fix my issue...
What do you think about it ?
Thanks in advance.

[veremin]

Did you get the said error after upgrade or it just happened all of a sudden? If you got the error after upgrade, was it an upgrade from v7 to v8 or from v8 to v9? Was it in-place upgrade or upgrade via backup/restore server configuration? Thanks.

[foggy]

The error can be caused by the fact that some of the credentials were encrypted on another computer (for example, if configuration was previously backed up on another machine and then restored to the current one). In this case, when you enable encryption, those credentials cannot be decrypted using the current machine key. Support should be able to clean the DB of those records, if you do not want to re-type everything.

[jp34]

It's not related to update.
I just selected "Encrypt configuration backup", created a password, ran a "backup now", it worked once.
When I click "Backup now", I get the error "Error Key not valid for use in specified state."
When I try to uncheck "Encrypt configuration backup" in order to backup configuration without password (as in the past), I get "Configuration backup encryption must be enabled because product configuration contains encryption keys".
All IDs in "creds" column of "Ssh_creds" exist in "Credentials" table... no orphaned password...

[foggy]

I'd let support engineers check the DB as well.

[jp34]

As I said before, she asked me to retype all "backup job" passwords, but I dont understand why and it's a very boring task...

[foggy]

Those "problem" records are stored in the DB just like ordinary ones, so to identify them you need to try to decrypt every record with the current machine key. Support should be able to do this for you.

[jp34]

Support engineer has checked all credentials and all have to be retyped.....
But I dont understand...
"Encryption password" is used to encrypt "job credentials" before to be written in "backup config file (.bco)". OK.
But "Job credentials" are also encrypted in database with the "encryption password" ?
If yes, when I enable "Encrypt configuration backup", existing "job credentials" get also automatically encrypted in the database ? or I have to retype them all in order them to get encrypted ?

[foggy]

Credentials are stored in database encrypted with the backup server machine key. Typically, you do not have to re-type anything when you enable encryption for configuration backup, however, in case configuration was migrated to another server, they cannot be decrypted and need to be re-typed.

[jp34]

I didn't migrate backup server configuration... so backup server machine key is still the same, so credentials in database are correct and it's true because all my backups still works.
Why should I retype all my passwords ? Why shloud it fix my issue ?!

[jp34]

If I sum up:
- job credentials are encrypted in "SQL database" with static "server machine key"
- job credentials are encrypted in "configuration backup file" with custom "encryption password"

In my case, credentials in database are readable because they are working in VM jobs (VSS). Why shloud I retype them ?!

How can I tell Veeam to stop encrypting its "configuration backup file" ? It refuses to uncheck "Encrypt configuration backup"...

What a bug ?!

[foggy]

The fact that you cannot enable encryption on configuration backup tells that some of the credentials in the database cannot be decrypted using the current machine key (to be further encrypted with the password in configuration file). I suggest to escalate the case for deeper investigation.

To be able to disable configuration backup encryption, you need to disable encryption on all the jobs and delete all passwords using the Password Manager.

[jp34]

How to "disable encryption on all the jobs" ? I cannot see this option in job parameters...

[foggy]

When you try to delete the password, it should tell you what jobs are currently using it, so you can open corresponding job settings and disable encryption.

[jp34]

True but when I uncheck "Encrypt configuration backup" I get "Configuration backup encryption must be enabled because product configuration contains encryption keys"... infinite loop...

[foggy]

Please ask your engineer to take a closer look at that.

[jp34]

Veeam engineer said it's a known issue, I have to retype all passwords. But nobody seems to understand why retyping job credentials will fix configuration backup job...

[foggy]

Upon re-typing, credentials will be encrypted with the current machine key, which will give the ability to decrypt them prior to saving into encrypted configuration backup.