NetBackup™ Commands Reference Guide

DESCRIPTION

Use the msdpcldutil command to create, update, and list cloud immutable volume for AWS S3 storage, S3-compatible cloud storage, and Azure blob storage.

This utility is only supported on Red Hat Linux.

Set the following environment variables before you use msdpcldutil for AWS S3 immutable storage:

export MSDPC_ACCESS_KEY=your_access_key_id
export MSDPC_SECRET_KEY=your_secret_key
export MSDPC_REGION=your_region
export MSDPC_PROVIDER=amazon

MSDPC_ACCESS_KEY is the AWS access key associated with an IAM user. MSDPC_SECRET_KEY is the secret key associated with the access key. MSDPC_REGION is the AWS region where the bucket is created or accessed. MSDPC_PROVIDER is the name of the S3-compatible cloud storage provider.

Set the following environment variables before you use msdpcldutil for S3-compatible cloud storage:

export MSDPC_ACCESS_KEY=your_access_key_id
export MSDPC_SECRET_KEY=your_secret_key
export MSDPC_REGION=your_region
export MSDPC_PROVIDER=s3-compatible
export MSDPC_ENDPOINT=your_s3_endpoint_url

In addition to the parameters shown, you can now provide MSDPC_CMS_CRED_NAME to run the msdpcldutil commands for AWS as shown:

export MSDPC_PROVIDER=vamazon
export MSDPC_REGION=your_region
export MSDPC_CMS_CRED_NAME=your_credential_name
export MSDPC_MASTER_SERVER=your_primary server_name
export MSDPC_ALIAS=your_storage_server_name_your_alias_name

MSDPC_CMS_CRED_NAME is the credential name provided that stores the credentials.

MSDPC_ALIAS is the cloud alias created using csconfig.

Set the following environment variables before you use msdpcldutil for Azure blob immutable storage:

export MSDPC_ACCESS_KEY=your_storage_account
export MSDPC_SECRET_KEY=your_access_key
export MSDPC_REGION=your_region
export MSDPC_PROVIDER=azure
export MSDPC_ENDPOINT=https://your_storage_account.blob.core.windows.net/

Similar to Amazon, for Azure storage, you can use MSDPC_CMS_CRED_NAME.

export MSDPC_CMS_CRED_NAME=your_credential_name

Set the following environment variables before you use msdpcldutil for Google Cloud Platform bucket retention storage:

export MSDPC_ACCESS_KEY=your_storage_account
export MSDPC_SECRET_KEY=your_access_key
export MSDPC_REGION=your_region
export MSDPC_PROVIDER=google
export MSDPC_ENDPOINT=your_gcp_endpoint_url
export MSDPC_GCP_SAKEY=gcp_service_account_key_file_path

Set the following environment variables to configure the proxy settings. The settings include HTTP, HTTPS, SOCKS, and NTLM authentication:

MSDPC_PROXY_URL=[http/https/socks/socks4/socks5/socks4a]://ProxyHost:
ProxyPort
MSDPC_PROXY_AUTH=NTLM or none
MSDPC_PROXY_DOMAIN=$NTLM domain name
MSDPC_PROXY_USER=$proxy_user
MSDPC_PROXY_PASSWD=$proxy_password

You are not required to set the environment variables if the NetBackup media server is deployed on Amazon EC2 instance. You can use IAM role-based authentication. An access key, secret key, region, endpoint, and the provider are set automatically.

export MSDPC_ACCESS_KEY=
export MSDPC_SECRET_KEY=
export MSDPC_REGION=
export MSDPC_ENDPOINT=
export MSDPC_PROVIDER=

Use the - enable_sas option with Recovery Vault Azure and AzureGov storage. When you provide this option, the environment variables are used as follows:

Use the -enable_sts option with Recovery Vault Amazon and Amazon Gov storage.

MSDPC_ACCESS_KEY is the credential name, not the account name.

MSDPC_ALIAS is the alias of the storage volume that is associated with the credential. MSDPC_MASTER_SERVER is the master server. When you provide these two environment variables, they are used to query the NetBackup CMS for the credentials. In this case, MSDPC_SECRET_KEY is ignored.

If you do not provide MSDPC_ALIAS and MSDPC_MASTER_SERVER, provide MSDPC_ACCESS_TOKEN. It is used to query Recovery Vault directly for the credentials. You can optionally provide MSDPC_RVLT_SERVICE_URI to specify Recovery Vault service endpoint. It is nrv.veritas.com by default.

If MSDPC_ALIAS, MSDPC_MASTER_SERVER, and MSDPC_ACCESS_TOKEN environment variables are not provided for Recovery Vault that results in an error.

Besides these parameters, you can provide MSDPC_CMS_CRED_NAME directly, which is the credential name.

If you do not set the environment variables and IAM role-based authentication does not exist, msdpcldutil enters interactive mode. You can enter the parameters at the command-line prompt as follows:

Enter Provider id: amazon
Enter region: us-east-2
Enter Access key: xxxxxxxxx
Enter secret key:
Enter Credential Name: primary_server_name
Enter alias: primary_server_name_cloud-lsu

Ensure that you previously created the alias with the csconfig command, otherwise this action fails.

Use the -enable_sp option for Service Principal with Azure blob and AzureGov storage. When you provide this option, the environment variables are used as follows:

export MSDPC_CMS_CRED_NAME=your_cms_credential_name
export MSDPC_ALIAS=your_alias_name
export MSDPC_REGION=your_region
export MSDPC_PROVIDER=azure
export MSDPC_ENDPOINT=https://your_storage_account.blob.core.windows.net/

MSDPC_CMS_CRED_NAME is the Service Principal credential NetBackup stores in the Credential Management Service.

MSDPC_ALIAS is the name of the alias in the CloudStore. The alias must have the authorization type CREDS_SERVICE_PRINCIPAL. You can view or add aliases using csconfig -instance where the authorization type shows up under creds_broker.

Use the -enable_iama option for IAM Role Anywhere with Amazon and AmazonGov storage. When you provide this option, the environment variables are used as follows:

export MSDPC_CMS_CRED_NAME=your_cms_credential_name
export MSDPC_ALIAS=your_alias_name
export MSDPC_REGION=your_region
export MSDPC_PROVIDER=amazon

MSDPC_CMS_CRED_NAME is the Iam Role Anywhere credential NetBackup stores in the Credential Management Service.

MSDPC_ALIAS is the name of the alias in the CloudStore. The alias must have the authorization type CREDS_IAM_ROLE_ANYWHERE. You can view or add aliases using csconfig -instance where the authorization type shows up under creds_broker.

OPTIONS

EXAMPLES

Example 1: Create a cloud immutable volume.

/usr/openv/pdde/pdcr/bin/msdpcldutil create -b bucketname -v volumename --mode ENTERPRISE --min 1D --max 30D --live 2021-12-31

Example 2: Update the cloud immutable volume mode.

/usr/openv/pdde/pdcr/bin/msdpcldutil update mode -b bucketname -v volumename --mode COMPLIANCE --live 2021-12-31 --inherit enable

Example 3: Update the cloud immutable volume minimum and maximum retention periods.

/usr/openv/pdde/pdcr/bin/msdpcldutil update range -b bucketname -v volumename --min 1D --max 90D

Example 4: Update the cloud immutable volume live duration.

/usr/openv/pdde/pdcr/bin/msdpcldutil update live -b bucketname -v volumename -l 2022-01-31

Example 5: Create GCP bucket with the bucket level retention.

/usr/openv/pdde/pdcr/bin/msdpcldutil bucket create -b bucketname -m ENTERPRISE -p 100D

Example 6: Check Amazon permissions of the current user.

/usr/openv/pdde/pdcr/bin/msdpcldutil platform checkperm --role 
backup-admin --bucket bucketname

/usr/openv/pdde/pdcr/bin/msdpcldutil platform checkperm --role 
cloud_admin