NetBackup status code: 5987
Message: Cannot fetch the host ID of the NetBackup master server. The master server does not have the certificate.
Explanation: The master server does not have the certificate or the NetBackup Service Layer (NBSL) on the master server is down.
Recommended Action: Ensure that the following occurs:
NBSL is running on the master server
If NBSL is running on the master server, ensure that the host ID-based certificate is deployed on the master server
If the host ID-based certificate is deployed and if you still see this error, refer to the Resolving the master server host name change issue procedure..
This error may occur if the master server host name is changed from a Fully Qualified Domain Name (FQDN) to a short name (or vice versa) in any of the following scenarios:
NetBackup installation after a disaster
Manual update in the NetBackup configuration file (bp.conf file on the UNIX or Windows registry).
In the following example, NetBackup is installed on a master server with a short name and the catalog backup is run. After a disaster, NetBackup is installed on the master server in a disaster recovery mode, but this time with FQDN. However, the identity of the master server (or disaster recovery package) is restored with the short name. This can cause failure when reissuing the client certificates, automatically renewing the client certificates and deploying new certificates on clients.
To resolve this issue, use the following steps:
Log on to the master server.
Run following command:
UNIX:
/usr/openv/netbackup/bin/nbcertcmd -ping
Windows:
Install_path\NetBackup\bin\nbcertcmd -ping
If the command is executed successfully, proceed to next step.
If it fails with the exist status code 8509 (The specified server name was not found in the web service certificate), then carry out the steps that are provided in the following technote:
https://www.veritas.com/support/en_US/article.100034092
Proceed to the next step.
Stop and start the NetBackup Web Management Console service on the master server. Use following the NetBackup command:
UNIX:
/usr/openv/netbackup/bin/nbwmc -terminate
/usr/openv/netbackup/bin/nbwmc -start
Windows:
install_path\NetBackup\wmc\bin\nbwmc.exe -stop -srvname "NetBackup Web Management Console"
install_path\NetBackup\wmc\bin\nbwmc.exe -start -srvname "NetBackup Web Management Console"
Perform the user login on the master server. Use the following command:
install_path/netbackup/bin/bpnbat -login -loginType WEB
For example:
install_path\netbackup\bin\bpnbat -login -loginType WEB Authentication Broker [abc.example.com is default]: Authentication port [0 is default]: Authentication type (NIS, NISPLUS, WINDOWS, vx, unixpwd, ldap)[WINDOWS is default]: Domain [abc.example.com is default]: Login Name [administrator is default]: Password: Operation completed successfully.Note the value of the key Client_Name for the master server. For a clustered master server, note the value of the key Cluster_Name This can be found at the following locations:
UNIX:/usr/openv/netbackup/bp.conf
Windows:HKEY_LOCAL_MACHINE\SOFTWARE\Veritas\NetBackup\CurrentVersion\Config
This value can either be the FQDN or the short name. For example, abc.example.com.
Note the host ID of the master server. You can obtain its value by using the following command:
install_path/netbackup/bin/nbcertcmd -listCertDetails
For a clustered master setup, use the following command:
install_path\netbackup\bin\nbcertcmd -listCertDetails -cluster
This command may return multiple records (if only one record is returned, select the host ID provided in that record).
If the host name obtained in step 5 is FQDN, then pick the record where the "Issued By" entry matches its short name.
If the host name obtained in step 5 is a short name, then pick the record where the "Issued By" entry matches its FQDN.
For example:
install_path\netbackup\bin\nbcertcmd -listCertDetails Master Server : abc Host ID : xxxxxx-4201-4c6a-xxxx-xxxxx Issued By : /CN=broker/OU=root@abc/O=vx Serial Number : 0x62e108c90000000c Expiry Date : Aug 21 08:42:54 2018 GMT SHA1 Fingerprint : 50:89:AE:66:12:9A:29:4A:66:E9:DB:71:37: C7:EA:94:8C:C6:0C:A0 Master Server : xyz Host ID : yyyyyy-4785-4252-yyyy-yyyyy Issued By : /CN=broker/OU=root@xyz.master1.com/O=vx Serial Number : 0x6ede87a70000000a Expiry Date : Aug 21 09:52:13 2018 GMT SHA1 Fingerprint : FE:08:C2:09:AC:5D:82:57:7A:96:5C:C1:4A: E6:EC:CA:CC:99:09:D2 Operation completed successfully.
Here, 2 records are returned. For the first record, the issuer name provided in the "Issued By" field matches the short name of the client_name obtained in step 5. Select the host ID that appears in the first record.
Add a host ID-to-host name mapping. Map the host ID of the master server that you have obtained in step 6 to the host name that you have obtained in step 5.
Use the following command:
install_path/netbackup/bin/admincmd/nbhostmgmt -a -i host_ID -hm host_name
For example:
install_path/netbackup/bin/admincmd/nbhostmgmt -a -i xxxxxx-4201-4c6a-xxxx-xxxxx -hm abc.example.com abc.example.com is successfully mapped to xxxxxx-4201-4c6a-xxxx-xxxxx.
You can also add this host ID-to-host name mapping using the NetBackup Administration Console. Use the tab.
Renew the host ID-based certificate of the master server by using the following command:
install_path/netbackup/bin/nbcertcmd -renewCertificate
For a clustered master server, use the following command:
install_path\netbackup\bin\nbcertcmd -renewCertificate -cluster
Continue with the certificate deployment on a client (this can be either a reissue certificate, the automatic renewal of a certificate, or a new certificate deployment).
Click here to view technical notes and other information on the Veritas Technical Support website about this status code.