Netbackup

I recently ran into an issue with Netbackup 6.5.1 and wanted to make a mental note about this. I was perplexed as to why when I looked through the restore gui one of my systems was only displaying the weekly full backups but not the incremental ones.

While this caused some confusion, the backups always finished successfully and never once did I suspect that I would not be able to retrieve data. Upon looking in the /usr/openv/netbackup/db/images directory I found the directory that correlated to my system name but it was listed twice. Once with like this "Systemname" and then "systemname". Notice the capital letter? The java gui and for that matter, the client interface, ignores the capital letter and just pulls the information from the lower case.

In my incremental policy, the client name was listed with the capital and even though my backups were being accomplished, I still could not "view" the results.

I opened a case with Veritas (Symantec) and will post any results here.

Services for Unix "Network Error 53"

"Network Error 53", "The data area passed to a system call is too small" or "Unknown Error"

Client for NFS included with Windows Server 2003 R2 returns different errors when trying to access NFS shares on UNIX-based NFS servers. The exact error message may depend on your environment - you might get one or more from the ones mentioned above. And, at the same time, SFU 3.5 Client for NFS may work just fine.

Analyzing the network traffic may show MOUNT or NFS calls being "rejected for security reasons (5)".

The R2 Client for NFS uses high ports (>1024) to connect to NFS servers and that's known to cause the above errors. There are two ways to fix this -

Change how your NFS servers export the NFS shares and make them allow connections from high ports
OR
Add /UseReservedPorts /DWORD value under HKLM\Software\Microsoft\Client for NFS\CurrentVersion\Default and set it to 1.

Restart the Client for NFS service to allow the change to take effect.

Documentation to support running a program (application, script, etc) as a Windows Service:

Requirements:  There are two utilities needed to run a program as a NT
Service

srvany.exe and instsrv.exe

instsrv installs an instance of srvany as an NT Service and throughout the rest of the setup process that instance of srvany runs the program.


1. To install srvany, open a command shell by clicking Start, Run, cmd and in the console window type INSTSRV NAME_OF_SERVICE

C:\Windows\System32\SRVANY.EXE

(If srvany is not located in C:\Windows\System32\, this command needs to be changed accordingly.) This initializes an instance of srvany as an NT Service with NAME_OF_SERVICE as the Service name.  This name will appear under the Services application in the Control Panel.

2. The next step is to edit the Windows NT Registry using RegEdit - Click on Start, Run, regedit.

3. Now locate the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NAME_OF_SERVICE registry key.  The key can be found by either maneuvering through the registry tree, or by searching for NAME_OF_SERVICE (Edit->Find).  Right click on the key and choose New, then Key. This will create what looks like a new folder. Name the new key Parameters.

4. Right click on Parameters and select New, then String Value and in the space provided type Application.

5. Again, right click on Parameters and select New, then String Value and in the space provided type AppParameters.

6. Right click on Application and choose Modify, then type in the path to your Perl binary. For example c:\perl\bin\perl.exe.

7. Next, right click on AppParameters and select Modify then enter the path to the program you want run as a Service. There are no more required registry changes, so RegEdit can now be closed.

8. Now open the Control Panel and double-click the Services application.  There should now be a service listed with the name of the service you chose in step one. The Startup option should be set to Automatic by default, but if it is not, click Startup and then Automatic if you want the Service to be started automatically when the machine boots. If you do not want it to start automatically, choose Manual. It is also best to have it log in as the System Account (which should be the default) because this way it will run no matter who is logged on to the machine, and even if no user is logged on. If appropriate, choose a user with the proper permissions for the application for the Log On As option. To get a little more information on Services, choose Start->Help->Find, type in Services and select "To configure startup for a service."

9. Finally, choose the Service from the list of Services, and click the Start button to launch it. The program is now running as an NT Service.

Terminal Server License Error

I have several windows 2003 terminal servers that up until today, were working flawlessly. They have been in service for well over a year and well past the terminal server license grace period. The server that holds the license remained operational, however, the other two terminal servers were not accepting connections for either users or administrators. The downside to this were the terminal servers are virtual machines and there is no "real" console.

Following the Microsoft knowledge base article, http://support.microsoft.com/?kbid=279561, I was able to create the appropriate registry key and point to a specific license server instead of using the auto discovery method which at this point in time, fails.

To select a specific license server for use with various Windows Terminal Services servers in a domain or site, you can modify the registry to point to a particular license server. You can specify that all Terminal Services servers work with a particular license server for accounting purposes. A Terminal Services server and the license server can reside in different domains. Microsoft recommends that you use the LicenseServers registry key to reduce any issues with the Terminal Server licensing discovery process.

Microsoft Log Parser

Logs are an important part of daily administration however, getting the data out of the logs can be at times, painstaking!

Microsoft's Log Parser utility - http://www.microsoft.com/downloads/details.aspx?FamilyID=890cd06b-abf8-4c25-91b2-f8d975cf8c07&displaylang=en can help with extracting the data you want. While the tool is comprehensive enough, the command line queries can be difficult to create.

For example, after you download and install the tool and you wanted to examine all of the print activities from user name "test".

You would type the following command:

LogParser "SELECT TimeGenerated, SourceName, EventCategoryName, Message INTO report.txt FROM System WHERE EventID = 10 AND SID LIKE '%test%'" -resolveSIDs:ON

The report.txt file output will display, nicely formatted, all the particulars for that user. Of course, you can change the parameters to match the security log too!

Roaming Profiles and Active Desktop Error

If for some reason you get an Active Desktop Recovery error on any Windoes System (Noticeable by a white background and some verbiage about clicking this for recovery) - try this:

KEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Desktop\SafeMode\Components
Change the value of DeskHtmlVersion to zero instead of decimal 272 or whatever value is there.

Linux Network Time Protocol (NTP)

Time sync is important for both Windows and Unix computers and this is usually accomplished in an enterprise environment using an external NTP server. Both operating systems come with their own preferred servers, however, there are a slew of time servers available and the most popular ones can be found at the National Institute of Standards and Technology (NIST) - http://tf.nist.gov/service/time-servers.html

Your ntp.conf is located in the /etc directory on your *nix host. If you examine the file (vi, cat, more) it should look something like this:

Restrict default nomodify notrap noquery
restrict 127.0.0.1
driftfile /var/lib/ntp/drift
broadcastdelay 0.008
keys /etc/ntp/keys
server www.time.gov
restrict time mask 255.255.255.255 nomodify notrap noquery


If you cd to /usr/sbin and run ntpq -p you should see your NTP server listed and the status of the server.

remote            refid                  st t when poll    reach  delay   offset    jitter
==============================================================================
*www.time.gov 192.43.244.18     2 u  987 1024  377   10.471  3.530   1.369



If you don't see the * in front of your time server it signifies that the time is not in sync with the remote time server.  If the jitter is a really large number, that also is a clue that the NTP is not working.  You could have a firewall that is not allowing the time protocol to pass or perhaps that time server is not available.

My recommendation is to use a dedicated host inside your network as the time server, that utilizes a pool of time servers.  Point all your hosts to the local time server and create an alias called "time" that you reference in your ntp.conf file instead of using a specific time host.  This will allow time servers to come and go and you don't have to update the ntp.conf on every host.

Enjoy!

Windows AD dsquery command

If you are trying to bulk update lots of Active Directory users, try using the dsquery and dsmod commands.

For example, to update a users AD description, use the following command:

dsquery user -samid "username" -limit 0 | dsmod user -desc "New Description for User"

This works well for one or many users but may take some tweaking to get the information out of AD. To get the list of users from AD, use csvde.

Type csvde -r objectclass=user -f c:\userlist.csv

Once the file has been created, use excel to tweak the csv file into a useable format. I like using excel and notepad (utilizing the find/replace) to get rid of excess tabs, breaks and use this create the correct syntax.

Enjoy!