Backup Exec Deduplication Storage offline due to the logon account

Problem

Error Message

Backup Exec debug SGMON Log capture during Backup Exec services restart -

Note: SRV-DATA <- Backup Exec Server
          dedupadmin <- Dedupe user account
 

DeviceIo: beost: Critical: (Storage server: PureDisk:SRV-DATA) PdvfsRegisterOST: Failed to register with SPA on storage server SRV-DATA. Check to make sure the server is on and that the services are running. (Invalid argument) V-454-25

DeviceIo: sts_open_server PureDisk:SRV-DATA dedupadmin 2060001

DeviceIo: ostaspi: sts_open_server PureDisk:SRV-DATA as dedupadmin error 2060001

Log from MBES where the dedupe was offline - 

BackupExecDeduplicationStorageFolder\log\spad\CASO.tec.local\pvlsvr.exe\spad

INFO [229] [000000E7F3ED07B0]: task 229 [thread 000000E7F3ED07B0] for CASO.tec.local:62801: spad handler running
INFO [229] [000000E7F3ED07B0]: Got request: &request=7&login=not-dedupadmin&passwd=*&action=getSpaID
ERR [229] [000000E7F3ED07B0]: 25012: Authentication failed, No such user not-dedupadmin !
ERR [229] [000000E7F3ED07B0]: 25106: spaProcessing: Failed to authenticate, using not-dedupadmin
ERR [229] [000000E7F3ED07B0]: 25106: spaProcessing encountered an error.
 

Cause
 

1. The Dedupe username password in Backup Exec Logon account is not matching the one mentioned in the Deduplication storage folder.

2.The Logon account section in Dedupe properties should show the account name associated with Dedupe. If it shows blank, the storage can go offline as well.

Solution

Cause 1 Solution -

The Dedupe user password in BE logon account and within the Dedupe Folder should match.
Know more about the Deduplication user credential 100000666

Note: To update the password via below command after BE 20.3 disable Lockdown and enable it back after updating the password. Lockdown settings can be enabled or disabled from Backup Exec Global settings -> Network and Security. Lockdown settings are not required to be disabled to run the command in 20.3 and earlier versions as the feature was introduced in BE 20.4.

If the password is updated without disabling Lockdown, the following error is returned -
C:\Program Files\Veritas\Backup Exec>spauser.exe -c -u dedupddmin
Old password:
Reenter Old password:
New Password:
Reenter New Password:Error: 8: SpaDB::CTable::safe_save: failed to create record file R:\BackupExecDeduplicationStorageFolder\databases\spa\database\authentication\1.tmp (Access is denied. )
Error: 20: Error occur when saving record!
Error: -1: update record to database failed

Additionally Information - If the Dedupe user password is forgotten, BE 21 onwards a new password can be set by running the following command. Once set, this password needs to be updated for the Dedupe user in Backup Exec logon account section. Restart the BE service post this to re-discover the device.

spauser.exe -r -u <dedupeusername> -q <password> 

dedupeusername is the username for dedupe which is returned by command spauser.exe -l
password needs to be replaced by the password to be updated in Logon accounts of Backup Exec

Cause 2 Solution -

1) Open Backup Exec Management Command Line Interface (BEMCLI) -> Run as administrator

2) Execute the command to get the Deduplication Storage
Get-BEDeduplicationDiskStorageDevice | format-list

3) List of all Logon Accounts
Get-BELogonAccount

4) From command prompt BE Install Path, execute spauser -l to get the username used to 
configure Deduplication Storage in Backup Exec (The first account returned is the one used by Dedupe)

5) Create a New logon account if the original dedupe account is not listed (BEMCLI) in Step 3 output.
$user = Get-Credential ( enter username and password in dialog box)
New-belogonaccount –credential $user

6) Once above details are noted then map the logon account with the Deduplication Storage with help of below command.

Get-BEDeduplicationDiskStorageDevice "Deduplication storage name as per UI" | Set-BEDeduplicationDiskStorageDevice –logonaccount  <BEaccountname>

OR 

Example:- 

Set-BEDeduplicationDiskStorageDevice -InputObject BE-SRV-DATA-DEDUP-01 -LogonAccount dedupadmin

7) Restart the Backup Exec services and confirm the account is mapped and displayed in the Deduplication folder details section of the Backup Exec console.