Comprehensive data protection for all workloads
tfloor
Expert
Posts: 270
Liked: 14 times
Joined: Jan 03, 2012 2:02 pm
Full Name: Tristan Floor
Contact:

Backup Configuration Failed Since v8

Post by tfloor » Nov 24, 2014 2:08 pm

Hello,

I have upgraded to V8 and i have enabled the Encryption on all places.
But now i get this error each day, it will not make backups of the configuration anymore.

Code: Select all

24-11-2014 15:03:38 Error Unable to write to configuration backup file.
24-11-2014 15:03:38 Error Processing configuration VeeamBackup at WSQL1\MSSQLP1
24-11-2014 15:03:38 Error Compressing database VeeamBackup
24-11-2014 15:03:38 Error Key not valid for use in specified state.
24-11-2014 15:03:38 Error Creating configuration backup
24-11-2014 15:03:38 Error Writing data section
24-11-2014 15:03:38 Error Saving configuration catalog (0% done)
Any idea what this error means, and maybe a solution?

Thanks.

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Nov 24, 2014 2:28 pm

Tristan, configuration backup should also be encrypted if configuration contains encryption keys. Haven't you seen the corresponding warning once you've added the first encryption key?

Also, please don't forget to add a case ID any time you post about technical issues. Thanks.

tfloor
Expert
Posts: 270
Liked: 14 times
Joined: Jan 03, 2012 2:02 pm
Full Name: Tristan Floor
Contact:

Re: Backup Configuration Failed Since v8

Post by tfloor » Nov 24, 2014 2:48 pm

I already have the tickbox "Encrypt Configuration backup" ticked.
And created a password.

So i don't see any other things that i could missed.

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Nov 24, 2014 2:57 pm

Than once more I encourage you to contact support directly, since this behavior doesn't look as expected. Thanks.

scott.lundberg
Novice
Posts: 5
Liked: never
Joined: Sep 05, 2012 4:55 pm
Full Name: Scott Lundberg
Contact:

Re: Backup Configuration Failed Since v8

Post by scott.lundberg » Nov 24, 2014 3:41 pm

I am having the same issue. Seems to be a problem with encrypting the backup specifically. In my case, it's choking on a saved root password for one of my linux servers.

tfloor
Expert
Posts: 270
Liked: 14 times
Joined: Jan 03, 2012 2:02 pm
Full Name: Tristan Floor
Contact:

Re: Backup Configuration Failed Since v8

Post by tfloor » Nov 25, 2014 8:35 am

foggy wrote:Than once more I encourage you to contact support directly, since this behavior doesn't look as expected. Thanks.
Alexander,

I will do that!
Thanks!

scott.lundberg
Novice
Posts: 5
Liked: never
Joined: Sep 05, 2012 4:55 pm
Full Name: Scott Lundberg
Contact:

Re: Backup Configuration Failed Since v8

Post by scott.lundberg » Nov 25, 2014 6:18 pm

My case has been escalated.... 00686341 I will post back the results once I have a resolution.

RGlintmeijer
Service Provider
Posts: 13
Liked: 3 times
Joined: Jul 20, 2011 10:22 pm
Full Name: Robert Glintmeijer
Contact:

Re: Backup Configuration Failed Since v8

Post by RGlintmeijer » Nov 25, 2014 7:56 pm

I had the same problem in my lab environment, after i had enabled encrypted config backup. I discovered there were some old (orphaned?) user accounts in the database, with encrypted passwords. After deleting the passwords of these accounts in the database, the config backup went succesful. So probably a support engineer can look at this and help you with it.

veremin
Product Manager
Posts: 16554
Liked: 1379 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Backup Configuration Failed Since v8

Post by veremin » Nov 26, 2014 8:01 am

I believe that all credentials, even orphaned ones, can be listed through Get-VBRCredentials and then deleted through Remove-VBRCredentials. Thanks.

TomR
Lurker
Posts: 1
Liked: never
Joined: Dec 02, 2014 4:50 am
Full Name: Tom Roberts
Contact:

Re: Backup Configuration Failed Since v8

Post by TomR » Dec 02, 2014 5:17 am

I'm having the same issue (Case # 00685623), I checked our user accounts using the Get-VBRCredentails and couldn't see any old/orphaned accounts.

RGlintmeijer
Service Provider
Posts: 13
Liked: 3 times
Joined: Jul 20, 2011 10:22 pm
Full Name: Robert Glintmeijer
Contact:

Re: Backup Configuration Failed Since v8

Post by RGlintmeijer » Dec 04, 2014 11:28 pm 2 people like this post

When i had the problem, i've first checked the logfiles for the exact error, and it gave some errors like this (don't know if you have the same):

Code: Select all

Cannot save database row (table: Ssh_creds, field: rootpassword, value: Veeam.Backup.Configuration.V80.PlainPasswordFieldValue). (System.Exception)
..
Key not valid for use in specified state
I assume the rootpassword field was encrypted on another installation of Veeam (and maybe an older version).

That's why i looked in the SQL database table dbo.Ssh_creds. There were some records with a filled rootpassword field, which didn't have a relation with a record in dbo.Credentials. (That's why i call them orphaned). I've cleared the rootpassword field for those records and the config backup was succesful.

The "orphaned" accounts do not show up in Get-VBRCredentials, that command seems to query dbo.Credentials.

Making changes to the database is not supported, so that's why i advise to let a support engineer help you with this.

smarteam
Lurker
Posts: 1
Liked: never
Joined: Jun 17, 2015 5:55 pm
Full Name: smarteam
Contact:

Re: Backup Configuration Failed Since v8

Post by smarteam » Jun 17, 2015 6:00 pm

I also received this error, so I went to the main options screen, Configuration Backup option, and selected to use my encryption password that I had already created for the backups themselves.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Jan 26, 2016 10:41 am

Hi, I also receive this error (Case #01304777), support engineer asks me to retype all backup job credentials (Menu > Manage Credentials).
My jobs work fine, I dont understant why I should retype their passwords... whereas it's only "configuration backup job" which fails...
I have so many passwords to retype and I'm not sure it will fix my issue...
What do you think about it ?
Thanks in advance.

veremin
Product Manager
Posts: 16554
Liked: 1379 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Backup Configuration Failed Since v8

Post by veremin » Jan 26, 2016 10:55 am

Did you get the said error after upgrade or it just happened all of a sudden? If you got the error after upgrade, was it an upgrade from v7 to v8 or from v8 to v9? Was it in-place upgrade or upgrade via backup/restore server configuration? Thanks.

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Jan 26, 2016 11:06 am

The error can be caused by the fact that some of the credentials were encrypted on another computer (for example, if configuration was previously backed up on another machine and then restored to the current one). In this case, when you enable encryption, those credentials cannot be decrypted using the current machine key. Support should be able to clean the DB of those records, if you do not want to re-type everything.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Jan 26, 2016 1:03 pm

It's not related to update.
I just selected "Encrypt configuration backup", created a password, ran a "backup now", it worked once.
When I click "Backup now", I get the error "Error Key not valid for use in specified state."
When I try to uncheck "Encrypt configuration backup" in order to backup configuration without password (as in the past), I get "Configuration backup encryption must be enabled because product configuration contains encryption keys".
All IDs in "creds" column of "Ssh_creds" exist in "Credentials" table... no orphaned password...

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Jan 26, 2016 1:29 pm

I'd let support engineers check the DB as well.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Jan 26, 2016 1:42 pm

As I said before, she asked me to retype all "backup job" passwords, but I dont understand why and it's a very boring task... :(

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Jan 26, 2016 2:07 pm

Those "problem" records are stored in the DB just like ordinary ones, so to identify them you need to try to decrypt every record with the current machine key. Support should be able to do this for you.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Jan 26, 2016 4:36 pm

Support engineer has checked all credentials and all have to be retyped.....
But I dont understand...
"Encryption password" is used to encrypt "job credentials" before to be written in "backup config file (.bco)". OK.
But "Job credentials" are also encrypted in database with the "encryption password" ?
If yes, when I enable "Encrypt configuration backup", existing "job credentials" get also automatically encrypted in the database ? or I have to retype them all in order them to get encrypted ?

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Jan 28, 2016 2:10 pm

Credentials are stored in database encrypted with the backup server machine key. Typically, you do not have to re-type anything when you enable encryption for configuration backup, however, in case configuration was migrated to another server, they cannot be decrypted and need to be re-typed.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Jan 28, 2016 2:46 pm

I didn't migrate backup server configuration... so backup server machine key is still the same, so credentials in database are correct and it's true because all my backups still works.
Why should I retype all my passwords ? Why shloud it fix my issue ?!

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Feb 04, 2016 2:45 pm

If I sum up:
- job credentials are encrypted in "SQL database" with static "server machine key"
- job credentials are encrypted in "configuration backup file" with custom "encryption password"

In my case, credentials in database are readable because they are working in VM jobs (VSS). Why shloud I retype them ?!

How can I tell Veeam to stop encrypting its "configuration backup file" ? It refuses to uncheck "Encrypt configuration backup"...

What a bug ?!

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Feb 04, 2016 3:20 pm

The fact that you cannot enable encryption on configuration backup tells that some of the credentials in the database cannot be decrypted using the current machine key (to be further encrypted with the password in configuration file). I suggest to escalate the case for deeper investigation.

To be able to disable configuration backup encryption, you need to disable encryption on all the jobs and delete all passwords using the Password Manager.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Feb 04, 2016 4:25 pm

How to "disable encryption on all the jobs" ? I cannot see this option in job parameters...

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Feb 04, 2016 4:37 pm

When you try to delete the password, it should tell you what jobs are currently using it, so you can open corresponding job settings and disable encryption.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Feb 04, 2016 6:24 pm

True but when I uncheck "Encrypt configuration backup" I get "Configuration backup encryption must be enabled because product configuration contains encryption keys"... infinite loop... :(

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Feb 04, 2016 9:06 pm

Please ask your engineer to take a closer look at that.

jp34
Enthusiast
Posts: 47
Liked: 1 time
Joined: Dec 22, 2009 8:31 am
Full Name: JP
Contact:

Re: Backup Configuration Failed Since v8

Post by jp34 » Feb 05, 2016 4:52 pm

Veeam engineer said it's a known issue, I have to retype all passwords. But nobody seems to understand why retyping job credentials will fix configuration backup job... :shock:

foggy
Veeam Software
Posts: 17931
Liked: 1512 times
Joined: Jul 11, 2011 10:22 am
Full Name: Alexander Fogelson
Contact:

Re: Backup Configuration Failed Since v8

Post by foggy » Feb 05, 2016 5:03 pm

Upon re-typing, credentials will be encrypted with the current machine key, which will give the ability to decrypt them prior to saving into encrypted configuration backup.

Post Reply

Who is online

Users browsing this forum: Google [Bot], Majestic-12 [Bot] and 25 guests