NetBackup™ Upgrade Guide

To upgrade Linux server software to 10.1.1

1. Log on as the root user on the server.
2. If the NetBackup Administration Console is open, you must close it now.
3. (Conditional) For clustered environments, perform the following tasks:

   • If necessary, edit the bp.conf and the vm.conf files as follows:

     If a REQUIRED_INTERFACE entry exists, replace it with a CLUSTER_NAME entry. Otherwise, add a new CLUSTER_NAME entry. This entry should be defined as the virtual server name.

     For a primary server, make sure that the first SERVER entry matches the CLUSTER_NAME entry for the bp.conf file.

   • Take the NetBackup Server Resource (ServerResource) offline. Use the command shown:

     /opt/VRTSvcs/bin/hares -offline ServerResource -sys $nodename

   • Freeze the NetBackup Group so that migrations do not occur while the inactive nodes are upgraded. Use the command shown:

     /opt/VRTSvcs/bin/hagrp -freeze group -persistent

   • If you have a VCS cluster configured, you can freeze the NetBackup Group by using the Cluster Manager interface or the command line.

   • Before you proceed with a cluster upgrade, refer to the NetBackup Clustered Primary Server Administrator's Guide for other cluster upgrade requirements.

     http://www.veritas.com/docs/DOC5332

4. NetBackup scripts that are not covered in Chapter 1 that you modified are removed when you run the upgrade script. More information about this topic is available.

   See About automatic file changes from an upgrade.

   Save any files that you have modified and want to keep.

5. Navigate to the location where the installation images reside. Enter the command that is shown to start the upgrade script:

   ./install

6. Follow the prompts in the installation script to install the NetBackup server binaries.
7. (Conditional: For primary servers only) If prompted, reply to the question regarding the infinite expiration conversion:

   NetBackup 9.0 and later versions support the retention periods that 
   extend beyond the year 2038. To ensure compatibility with previous 
   NetBackup versions, all items with an infinite expiration date are 
   updated to reflect the new infinite expiration date value. This 
   conversion may extend the time that is required to complete the upgrade. 
   Review the following article for more information:
   
   https://www.veritas.com/content/support/en_US/article.100048600
   
   Date of collection: date_time
   NetBackup state: online|offline
   Records found: records
   Conversion time estimate: time (hh:mm)
   
   Please see the linked article to obtain a more accurate estimate of how
   long the conversion may take.
   
   Would you like to continue with the upgrade? [y,n]

8. (Conditional: For primary server only) If prompted, provide the name of the service user account you want to use to start most of the daemons. This prompt is only shown if the installer cannot retrieve the service user value from the bp.conf file.

   Enter the name of the service user account to be used to start most of the daemons

   Please note:

   • The service username cannot exceed 32 characters and can only contain English characters.

   • Veritas does not recommend that you use the root user as the service user.

   • You cannot use the nbwebsvc user as the service user.

   • The nbwebgrp group must be a secondary group of the service user.

   • Ownership of the /usr/openv directory changes to the new service user account that you specified here.

   • Using a service account involves a one-time conversion that may significantly increase the upgrade time based on your catalog size.

   • If you want to change the service user account after the installation, use the nbserviceusercmd --changeUser command.

   For more details on the service user account, see: https://www.veritas.com/docs/100048220

9. (Conditional: For media servers only) If your environment uses an external certificate authority, provide the external certificate authority information at the prompts shown:

   Enter the certificate file path or q to skip security configuration: 
   /usr/eca/cert_chain.pem
   
   Enter the trust store location or q to skip security configuration: 
   /usr/eca/trusted/cacerts.pem
   
   Enter the private key path or q to skip security configuration: 
   /usr/eca/private/key.pem
   
   Enter the passphrase file path or q to skip security configuration 
   (default: NONE): /usr/eca/private/passphrase.txt

   Note:

   Be aware the passphrase file path is optional.

10. (Conditional: For media servers only) When prompted, provide the required information for the CRL configuration:

    Should a CRL be honored for the external certificate?
    1) Use the CRL defined in the certificate.
    2) Use the CRL from a file path.
    3) Do not use a CRL.
    q) skip security configuration
    CRL option (1): 

11. (Conditional: For media servers only) If you specified Use the CRL from a file path, you must enter the path to the CRL location:

    Enter the CRL location path or q to skip security configuration: 
    /usr/eca/crl

12. (Conditional: For media servers only) The installer echoes the configuration information you entered and attempts to retrieve details for the external certificate:

    External CA values entered:
    Certificate file path:  /usr/eca/cert_chain.pem
    Trust store file path:  /usr/eca/trusted/cacerts.pem
    Private key file path:  /usr/eca/private/key.pem
     Passphrase file path:  /usr/eca/private/passphrase.txt
          CRL check level:  Use the CRL from a file path.
        CRL location path:  /usr/eca/crl
    
    Getting external CA certificate details
             Issued By : CN=IITFRMNUSINT,O=Veritas,OU=iitf
          Subject Name : CN=cuomovm04,O=Veritas,OU=iitf
           Expiry Date : Oct 31 17:25:59 2019 GMT
      SHA1 Fingerprint : 62:B2:C3:31:D5:95:15:85:9D:C9:AE:C6:EA:C2:
                         DF:DF:6D:4B:92:5B
         Serial Number : 0x6c7fa2743072ec3eaae4fd60085d468464319a
      Certificate Path : /usr/eca/cert_chain.pem
    
    Validating host ECA certificate.
    NOTE: Depending on the network, this action may take a few minutes.
          To continue without setting up secure communication, press Ctrl+C.

13. (Conditional: For media servers only) If the external certificate enrollment pre-check finishes successfully, select 1 and press Enter to continue.

    The external certificate enrollment pre-check is successful.
    
    The external certificate is valid for use with primary server name
    How do you want to proceed?
    1) Continue the installation using this certificate.
    2) Modify the external CA values entered.
    3) Abort the installation.
    Default option (1): 

14. (Conditional: For media servers only) If the external certificate enrollment pre-check fails, select from the choices shown. The default is 2.

    The external certificate enrollment pre-check failed.
    
    The external certificate is not valid for use with primary server name
    How do you want to proceed?
    1) Continue the installation and set up external certificates later.
    2) Modify the external CA values entered.
    3) Abort the installation.
    Default option (2): 

15. (Conditional: For media servers only) When prompted, indicate how the upgrade should handle the Java GUI and JRE binaries.

    The Java GUI and JRE packages are currently install_state on this host.

    The Java GUI and JRE can be optionally included with NetBackup. The Java GUI and JRE enable the NetBackup Administration Console and the Backup, Archive and Restore (BAR) GUI. Choose an option from the list below.

    1) Update the Java GUI and JRE.

    2) Remove the Java GUI and JRE.

    If you specify 1, the Java and JRE binaries are installed or upgraded, based on the status of the server. If you specify 2, the Java and JRE binaries are removed or excluded, based on the status of the server.

16. When the script finishes, the binaries are successfully installed.

    Proceed to the post-installation procedure.

    More information is available.

    See Post-install procedure for upgrading to NetBackup 10.1.1.