How to plan for an upgrade to NetBackup 10.0
Several factors must be considered when you prepare for an upgrade to NetBackup 10.0.
New to NetBackup 9.1, you can start most of the NetBackup daemons and services as a non-root user. Veritas recommends that you start the NetBackup services as a non-root user. If you decide to use a less privileged user, you must plan accordingly. Ensure that the user account has access to the paths of disaster recovery files, external certificate authority (ECA) files, and temporary files.
On UNIX and Linux, you see a new prompt during the upgrade. The new prompt asks you to provide a service user, preferably a non-root user. You must create this user in advance and the user must have nbwebgrp as the secondary group.
On Windows, you can use the Local Service built-in account as the service account. This option is available in the Custom upgrade path.
When a user upgrades from a pre-NetBackup 9.1 environment to a NetBackup 9.1 or later environment, changes are made to Cloud protection plans. If the pre-upgrade environment has one protection plan with multiple cloud assets from different cloud provider types, that plan is split into one protection plan per cloud provider type after upgrade. The assets are distributed among the new protection plans based on the cloud provider type. For example, if there was a WeeklyBackups protection plan that contained Amazon, Azure, and Google assets, it is split as shown:
WeeklyBackups: Contains only the Amazon assets.
WeeklyBackups_azure: Contains only the Azure assets.
WeeklyBackups_gcp: Contains only the Google assets.
The NetBackup 8.1 upgrade includes a rolling conversion of the Media Server Deduplication Pool (MSDP).
By default, the rolling conversion is performed when the system is not busy. In other words, the conversion runs when backups, restores, CRQP, CRC checks, compaction, etc. are not active. This conversion is not expected to affect normal system operations. After the rolling conversion is finished, there is no difference between the converted system and a new installation. More information about the rolling conversion is available.
See MSDP upgrade considerations for NetBackup 8.1.
See About MSDP rolling data conversion.
If you plan to use role-based access control (RBAC), you must designate a security administrator. More information is available:
See About the NetBackup web user interface.
See NetBackup Web UI Administrator's Guide.
Beginning with NetBackup 8.0, the NetBackup primary server includes a configured Tomcat web server to support critical backup operations. This web server operates under user account elements with limited privileges. These user account elements must be available on each primary server (or each node of a clustered primary server). More information is available:
See NetBackup master server web server user and group creation.
Note:
It is recommended that you save the details of the user account that you use for the NetBackup Web Services. A primary server recovery requires the same NetBackup Web Services user account and credentials that were used when the NetBackup catalog was backed up.
Caution:
If the NetBackup PBX is running in secure mode, please add the web service user as authorized user in PBX. More information about determining PBX mode and how to correctly add users is available.
Upgrades of NetBackup 8.2 Linux clusters with NAT enabled incorrectly identify the NAT state. As a result, NAT is disabled after the upgrade to 10.0. After you complete the NetBackup 10.0 upgrade, you must turn NAT on again. More information is included in the post-upgrade procedure.
See Post-install procedure for upgrading to NetBackup 10.0.
btrfs file systemsVeritas does not support the installation or upgrade of the NetBackup database on a btrfs file system. If the NetBackup database resides on a btrfs file system, move the database to a supported file system (such as ext4 or xfs) before you start the upgrade. The database files reside on the primary server in the directories under /usr/openv/db. More information about moving the database before an upgrade is available. See Preinstall procedure for upgrading to NetBackup 10.0.
NetBackup uses security certificates to authenticate NetBackup hosts for secure communication. The security certificates conform to the X.509 Public Key Infrastructure (PKI) standard. A NetBackup primary server acts as the certificate authority (CA) and issues digital certificates to hosts. NetBackup now supports the following certificate key sizes: 2048 bits, 3072 bits, 4096 bits, 8192 bits, and 16384 bits.
With a NetBackup 9.1 upgrade, new root CA with 2048 bit key strength is deployed. To use a certificate key size larger than 2048 bits, set the NB_KEYSIZE environment variable on the primary server before you start the installation.
For example:
NB_KEYSIZE = 4096
The NB_KEYSIZE can only have the following values: 2048, 3072, 4096, 8192, and 16384.
Note:
If the FIPS mode is enabled on the master server, you can only specify 2048 bits or 3072 bits as a value for the NB_KEYSIZE environment variable.
Caution:
You should carefully choose the key size for your environment. Choosing a large key size may reduce performance. You should consider all factors to determine the correct key size for your environment.
For more information about CA migration and certificate key sizes, see the NetBackup Security and Encryption Guide.
Table: Overview of the upgrade process shows the overview of the upgrade procedure.
Table: Overview of the upgrade process
Step | Details | More information |
|---|---|---|
1 | Review operating system requirements and confirm the computer meets all requirements. | See Upgrade requirements for UNIX and Linux. See Installation and upgrade requirements for Windows and Windows clusters. See Requirements for Windows cluster installations and upgrades. |
2 | Confirm that the web server user account and group account are created and enabled. | More information is available: See NetBackup master server web server user and group creation. |
3 | Begin the upgrade process |