Search <book_title>...

Veritas NetBackup™ Commands Reference Guide

Last Published: 2021-06-07

Product(s): NetBackup & Alta Data Protection (9.1)

Introduction
Appendix A. NetBackup Commands
1. acsd
2. add_media_server_on_clients
3. backupdbtrace
4. backuptrace
5. bmrc
6. bmrconfig
7. bmrepadm
8. bmrprep
9. bmrs
10. bmrsrtadm
11. bp
12. bparchive
13. bpbackup
14. bpbackupdb
15. bpcatarc
16. bpcatlist
17. bpcatres
18. bpcatrm
19. bpcd
20. bpchangeprimary
21. bpclient
22. bpclimagelist
23. bpclntcmd
24. bpclusterutil
25. bpcompatd
26. bpconfig
27. bpdbjobs
28. bpdbm
29. bpdgclone
30. bpdown
31. bpduplicate
32. bperror
33. bpexpdate
34. bpfis
35. bpflist
36. bpgetconfig
37. bpgetdebuglog
38. bpimage
39. bpimagelist
40. bpimmedia
41. bpimport
42. bpinst
43. bpkeyfile
44. bpkeyutil
45. bplabel
46. bplist
47. bpmedia
48. bpmedialist
49. bpminlicense
50. bpnbat
51. bpnbaz
52. bppficorr
53. bpplcatdrinfo
54. bpplclients
55. bppldelete
56. bpplinclude
57. bpplinfo
58. bppllist
59. bpplsched
60. bpplschedrep
61. bpplschedwin
62. bppolicynew
63. bpps
64. bprd
65. bprecover
66. bprestore
67. bpretlevel
68. bpschedule
69. bpschedulerep
70. bpsetconfig
71. bpstsinfo
72. bpstuadd
73. bpstudel
74. bpstulist
75. bpsturep
76. bptestbpcd
77. bptestnetconn
78. bptpcinfo
79. bpup
80. bpverify
81. cat_convert
82. cat_export
83. cat_import
84. configureCerts
85. configureCertsForPlugins
86. configureMQ
87. configurePorts
88. configureWebServerCerts
89. create_nbdb
90. csconfig cldinstance
91. csconfig cldprovider
92. csconfig meter
93. csconfig reinitialize
94. csconfig throttle
95. duplicatetrace
96. importtrace
97. jbpSA
98. jnbSA
99. ltid
100. manageClientCerts
101. mklogdir
102. nbauditreport
103. nbcallhomeproxyconfig
104. nbcatsync
105. NBCC
106. NBCCR
107. nbcertcmd
108. nbcertupdater
109. nbcldutil
110. nbcloudrestore
111. nbcomponentupdate
112. nbcplogs
113. nbcredkeyutil
114. nbdb_admin
115. nbdb_backup
116. nbdb_move
117. nbdb_ping
118. nbdb_restore
119. nbdb_unload
120. nbdb2adutl
121. nbdbms_start_server
122. nbdbms_start_stop
123. nbdc
124. nbdecommission
125. nbdelete
126. nbdeployutil
127. nbdevconfig
128. nbdevquery
129. nbdiscover
130. nbdna
131. nbemm
132. nbemmcmd
133. nbfindfile
134. nbfirescan
135. nbftadm
136. nbftconfig
137. nbgetconfig
138. nbhba
139. nbholdutil
140. nbhostidentity
141. nbhostmgmt
142. nbhypervtool
143. nbidpcmd
144. nbimageshare
145. nbinstallcmd
146. nbjm
147. nbkmiputil
148. nbkmscmd
149. nbkmsutil
150. nboraadm
151. nborair
152. nbpem
153. nbpemreq
154. nbmlb
155. nbperfchk
156. nbplupgrade
157. nbrb
158. nbrbutil
159. nbregopsc
160. nbreplicate
161. nbrepo
162. nbrestorevm
163. nbseccmd
164. nbserviceusercmd
165. nbsetconfig
166. nbsmartdiag
167. nbsnapimport
168. nbsnapreplicate
169. nbsqladm
170. nbstl
171. nbstlutil
172. nbstop
173. nbsu
174. nbsvrgrp
175. netbackup_deployment_insights
176. resilient_clients
177. restoretrace
178. stopltid
179. tldd
180. tldcd
181. tpautoconf
182. tpclean
183. tpconfig
184. tpext
185. tpreq
186. tpunmount
187. verifytrace
188. vltadm
189. vltcontainers
190. vlteject
191. vltinject
192. vltoffsitemedia
193. vltopmenu
194. vltrun
195. vmadd
196. vmchange
197. vmcheckxxx
198. vmd
199. vmdelete
200. vmoprcmd
201. vmphyinv
202. vmpool
203. vmquery
204. vmrule
205. vmupdate
206. vnetd
207. vssat
208. vwcp_manage
209. vxlogcfg
210. vxlogmgr
211. vxlogview
212. W2KOption
Index

Name

nbkmiputil — executes the various external KMS server operations.

SYNOPSIS

nbkmiputil -getKey -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID [-kadLength KAD_length] | -nbKeyGroup key_group_name [-kadLength KAD_length] | -kad key_associated_data [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-getDetails] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]

nbkmiputil -listKeyIDs -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-nbKeyGroup key_group_name] [-activeKey] [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-getDetails] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-maxItems number] [-offset number] [-jsonCompact]

nbkmiputil -setAttribute -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path -keyId key_ID -attributeName attribute_name -attributeValue attribute_value [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]

nbkmiputil -validate -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-connectTimeout time_in_seconds] [-requestTimeout time_in_seconds] [-kmipVersion version] [-jsonCompact]

nbkmiputil -ekmsCheckCompat -kmsServer kms_server_name -port kms_server_port -trustStorePath CA_certificate_file_path -certPath certificate_file_path -privateKeyPath private_key_file_path [-passphrasePath private_key_passphrase_file_path] [-crlCheckLevel LEAF | CHAIN | DISABLE] [-kmipVersion version] [-jsonCompact]

On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/goodies/

On Windows systems, the directory path to this command is install_path\NetBackup\bin\goodies\

DESCRIPTION

The nbkmiputil executes the various external KMS server operations like retrieving keys, listing key IDs, setting key attributes, and validating KMS servers.

The command supports the following operations:

-ekmsCheckCompat	Use -ekmsCheckCompat to determine if NetBackup is compatible with the specified external KMS server. You can also use this option to determine if the following KMIP operations are supported on the external KMS server: Discover supported versions; create, get, or locate keys; and get, set, modify, or delete attributes.
-getKey	Fetches the NetBackup keys from the external KMS server.
-listKeyIDs	Lists NetBackup key IDs that are present in the external KMS server as per the specified options.
-setAttribute	Sets the custom attribute for the given key in the external KMS server. Supported attribute names are x-application, x-keygroup, and x-comment.
-validate	Validates the related functionality with the external KMS server. The functionality that is validated includes: Connecting to the external KMS server. Listing NetBackup key IDs present in the external KMS server. Fetch the key for any active NetBackup key ID. Fetch and set the attributes on any NetBackup key ID.

OPTIONS

-activeKey

Specifies whether to list only active NetBackup keys.

-attributeName

Specifies the custom attribute name to be set. Supported attribute names are x-application, x-keygroup, and x-comment.

-attributeValue

Specifies the custom attribute value to be set. Supported attribute value for attribute x-application : NetBackup.

-certPath

Specifies the path of the PEM-encoded certificate that is to be used for authentication with the external KMS server.

-connectTimeout

Specifies the time-out value to connect to the external KMS server in seconds. The default value is 120 seconds.

-crlCheckLevel

Specifies the CRL check level. The possible values are: LEAF, CHAIN, and DISABLE. The default value is LEAF.

LEAF - Revocation status of peer's leaf certificate is checked.
CHAIN - Revocation status of full chain of peer certificate is checked.
DISABLE - Revocation status of peer certificate is not checked.

-getDetails

Displays the additional key attributes details for the NetBackup keys.

-jsonCompact

Specifies whether to display the output in JSON compact form.

-kad

Specifies the key associated data (KAD) of the NetBackup key to be fetched from the external KMS server.

-kadLength

Specifies the length up to which KAD of a NetBackup key is to be generated.

-keyId

If -keyId is used with the -getKey option, it specifies the key ID of the NetBackup key to be fetched from the external KMS server. If it is used with the -setAttribute option, it specifies the key ID of the key for which a custom attribute is to be set.

-kmsServer

Specifies the external KMS server name with which you want to connect.

-kmipVersion version

Specifies the KMIP version to be used. Supported KMIP versions: 1.0, 1.1, 1.2, 1.3, 1.4, and 2.0.

-maxItems

Specifies the maximum number of key IDs to be listed.

-nbKeyGroup

If it is used with the -getKey option, it specifies the key group name whose active and latest key is to be fetched from the external KMS server. If it is used with the -listKeyIDs option, it specifies the key group name for which keys are to be listed.

-offset

Specifies the offset number of the key ID from where the list of key IDs starts. The default value is 0.

-passphrasePath

Specifies the path of the file containing the passphrase that is required to access the keystore for authentication with the external KMS server.

-port

The port number in use by the external KMS server.

-privateKeyPath

Specifies the path of the private key that is to be used for authentication with the external KMS server.

-requestTimeout

Specifies the time-out value for the given request to external KMS server in seconds. Default value is 300 seconds.

-trustStorePath

Specifies the path of the PEM-encoded CA certificate that is to be used for authentication with the external KMS server.

EXAMPLES

Example 1: Set custom attributes for the external KMS.

nbkmiputil -setAttribute -kmsServer example.veritas.com -port 5696 
-certPath /usr/cert.pem -privateKeyPath /usr/key.pem -trustStorePath 
/usr/ca.pem -keyId EFF18E49-DBBF-4F84-BF94-13F4A6B6E32B 
-attributeName x-keygroup -attributeValue msdp