Performing the KEK rotation
This process may run concurrently with normal NetBackup operations such as backups and restores. However, best practice is to perform KEK rotation during a maintenance window. Rotation may take a very long time to complete since it depends on the amount of data that needs KEK rotation.
To perform the KEK rotation
- Reset the encryption crawler if it was used previously.
/usr/openv/pdde/pdcr/bin/crcontrol --encconvertreset
- Run the following command to start the KEK rotation process in MSDP.
/usr/openv/pdde/pdcr/bin/crcontrol --kekconverton
- Monitor the KEK rotation.
/usr/openv/pdde/pdcr/bin/crcontrol --encconvertstate 2