108.bz » Backup http://www.108.bz Wandering futilities... Fri, 27 May 2011 09:08:43 +0000 en hourly 1 http://wordpress.org/?v=3.1.1 Recovering NTBackup Tapes http://www.108.bz/posts/it/recovering-ntbackup-tapes/ http://www.108.bz/posts/it/recovering-ntbackup-tapes/#comments Wed, 25 Aug 2010 10:36:43 +0000 Giuliano http://www.108.bz/?p=539 This article will show you how to handle tape backups generated by NTBackup, turn them into a .BKF file (using Linux) and extract specific files (using Linux/Windows). Some of the stuff explained here may also be useful when dealing with corrupt tapes/files, and may work for any backup software that generates MTF (Microsoft Tape Format) output, such as maybe Symantec Backup Exec1.

The scenario: an old machine (hosting a not so important app) crashes badly due to multiple disk failures. O.S. (Windows 2000 Server) won’t boot anymore. Backups were directed to a local DDS tape drive, the only one of its kind surviving in the whole Company. While reinstalling the app to another server, I need to recover some files and have access to the pre-crash registry.

And here’s the plan:

  • Boot the half-dead server with the invaluable SystemRescueCd.
  • Put the last available tape backup in the drive.
  • Save an image of the tape somewhere.
  • Extract stuff from the image.

When SystemRescueCd is running and network connected, make available a shared folder:

root@sysresccd /root % mkdir /mnt/storagespace
root@sysresccd /root % mount -t cifs //fileserver/e$ /mnt/storagespace -o username=administrator,workgroup=domain.local

Then, generate the image. NTBackup tape backups are spread across multiple “tape files”. If you read the tape from the beginning, sooner or later you will hit EOF (an end-of-file condition). Don’t rewind it: go on to the next file instead. Repeat until there are no more files to read.
On Unix, the first SCSI tape device is mapped to /dev/st0 and /dev/nst0. When a process finishes reading from /dev/st0, the tape is implicitly rewound. Viceversa, using /dev/nst0 doesn’t cause any rewind; tape will stay positioned right after the last block read.

Just in case, perform a manual rewind:

root@sysresccd /mnt/storagespace/temp % mt -f /dev/st0 rewind

Then, try to guess the right block size. It seems to be set at 16K. Should this method fail, check the “How do I find out tape block size?” method here.

root@sysresccd /mnt/storagespace/temp % mt -f /dev/st0 status
SCSI 2 tape drive:                          
File number=0, block number=0, partition=0.
Tape block size 16384 bytes. Density code 0x26 (DDS-4 or QIC-4GB).
Soft error count since last status=0
General status bits on (41010000):
 BOT ONLINE IM_REP_EN

Start reading (by means of dd) with the specified block size. See? We’re using the non-rewinding tape device /dev/nst0.

root@sysresccd /mnt/storagespace/temp % for f in `seq 1 10`; do echo dd if=/dev/nst0 of=tapeblock`printf "%
06g" $f`.bin ibs=16384; done
dd if=/dev/nst0 of=tapeblock000001.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000002.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000003.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000004.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000005.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000006.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000007.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000008.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000009.bin ibs=16384
dd if=/dev/nst0 of=tapeblock000010.bin ibs=16384
root@sysresccd /mnt/storagespace/temp % dd if=/dev/nst0 of=tapeblock000001.bin ibs=16384
1+0 records in
32+0 records out
16384 bytes (16 kB) copied, 0.0341089 s, 480 kB/s
root@sysresccd /mnt/storagespace/temp % dd if=/dev/nst0 of=tapeblock000002.bin ibs=16384
270540+0 records in
8657280+0 records out
4432527360 bytes (4.4 GB) copied, 7666.22 s, 578 kB/s
[..]
root@sysresccd /mnt/storagespace/temp % dd if=/dev/nst0 of=tapeblock000007.bin ibs=16384
4+0 records in
128+0 records out
65536 bytes (66 kB) copied, 0.1176 s, 557 kB/s
root@sysresccd /mnt/storagespace/temp % dd if=/dev/nst0 of=tapeblock000008.bin ibs=16384
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.00461986 s, 0.0 kB/s
root@sysresccd /mnt/storagespace/temp % dd if=/dev/nst0 of=tapeblock000009.bin ibs=16384
dd: reading `/dev/nst0': Input/output error
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.00356835 s, 0.0 kB/s

Reads beyond the last file will result in an “Input/output error”.

Tape image chunks

It’s time to join the .bin files into a single one: the tape image (maybe using HJSplit for the task). You could’ve been more clever than me and appended dd‘s output to a single file, thus skipping the join step and saving space. I didn’t do it because I wanted to see if any tape file was corrupted (and be able to re-read it, if needed).

I called the tape image “backup.bkf”, even though it’s not a true .BKF file… As we said, it’s a tape image. NTBackup is not able to read it, whereas the abundance of “BKF recovery” software can. Before going on, let me polemicize a bit. There are many, almost identical, software of this kind. I’ve got the feeling that they all “borrow” from this open source BKF reader2. Looks like different commercial developers grabbed the same source, embellished the GUI just a bit, and made a product to sell. How lame. But it turns out that you don’t need to pay a cent to extract files from a .BKF or tape image, on Linux or Windows as well.

On windows, get ntbkup by William T. Kranz . I use the (optional) -s3 switch to target set 3 which I know holds the System State.

C:\temp\x>..\ntbkup.exe ..\backup.bkf -s3 -l"\Registry:"

NTBKUP Ver 1.07c compiled for WIN32 with MAX_PATH = 100
   compiled for 64 bit file offsets
Copyright (C) 2003 William T. Kranz
NTBKUP comes with ABSOLUTELY NO WARRANTY
Free software distributed under the terms of the GNU General Public license
See http://www.gnu.org/licenses/gpl.html for license information
Check http://www.fpns.net/willy/msbackup.htm for Updates & Documentation

resrict operations to backup set 3
device name: C:
volume name: Local disk
device name: D:
volume name: Volume
Set 3:
Name: Company lun-29-06-2009-23.04
Description:
User: DOMAIN\administrator

device name: System state data from 0x36113d956 to 0x3611ec956
length 716800  atrib 0x20  05/14/2008  03:10:38 PM
extracing: default:
 data from 0x3611ecd4e to 0x3611f2d4e
length  24576  atrib 0x20  06/29/2009  09:42:50 PM
extracing: SAM:
 data from 0x3611f3156 to 0x3611fe156
length  45056  atrib 0x20  06/29/2009  11:00:07 PM
extracing: SECURITY:
 data from 0x3611fe556 to 0x3621cb556
length 16568320  atrib 0x20  06/30/2009  01:35:59 AM
extracing: software:
 data from 0x3621cb952 to 0x362487952
length 2867200  atrib 0x20  06/29/2009  10:42:23 PM
extracing: system:
 data from 0x362487d2e to 0x3624aad2e
length 143360  atrib 0x20  06/04/2003  01:24:14 PM
extracing: userdiff:

Bingo, I can load the software hive with “reg load” (see here) and extract the keys I need.

Should you prefer so, download mtftar on your Linux box, compile it and run something like:

./mtftar -f /mnt/storagespace/temp/backup.bkf | tar xvf - "Registry"

Extract the other files you need and voilà…

  1. ex Veritas Backup Exec ↩
  2. There’s no executable in the archive. You need Visual Studio and compile it for yourself. ↩
]]> http://www.108.bz/posts/it/recovering-ntbackup-tapes/feed/ 0 Abusing Backup Exec’s internal database http://www.108.bz/posts/it/abusing-backup-exec-internal-database/ http://www.108.bz/posts/it/abusing-backup-exec-internal-database/#comments Mon, 15 Mar 2010 23:18:35 +0000 Giuliano http://www.108.bz/?p=348 What’s the point of having data stored somewhere if you can’t access it and turn it into useful information? Of course the means to do so should be safe, supported, non destructive and flexible if not easy. But usually all you’re left with is some kind of “reporting” feature that necessarily doesn’t do exactly what you need, doesn’t output in a convenient format and so on.

But enough squabbling: in this article I’ll deal with Backup Exec’s internal database.
Here’s what I’m trying to do:

  • Look up all the “Duplicate” Jobs. Show when they started, how long they took to complete, the rate, …
  • For each one of them, try and find the relevant tapes.

I will use the generated report to know which media I should eject out of the library for safe storage. The report will also allow me to quickly and easily update the Excel worksheets where we keep track of how backup’s going.

Our BE database runs on Microsoft SQL Server Express. First thing to do is configure the instance to allow remote TCP/IP connections. Refer to this post, and KB914277.

Then I’m able to point SQL Server Management Studio at it1, and see how the BEDB database is organized.

The view named vwJobHistorySummary is the equivalent of what is seen in BE’s GUI, under Job Monitor → Job List → Job History. Easy enough to find out.

What’s not that immediate to guess is how Media IDs relate to Job IDs: skimming through the database tables doesn’t help… How could you reverse engineer BE GUI and discover what SQL queries it’s doing to carry out its job? In fact, there’s a way to “sniff” SQL queries while they’re running:

  • open up BE GUI and select (but don’t open) a completed Job in Job History.
  • run SQL Server Profiler.
  • create a New Trace.
  • Under the Event Selection tab, deselect everything except SQL:BatchStarting. This is not a particularly crowded database, hence no need for filters.
  • Double click on the previously selected Job; SQL Profiler should capture a query similar to:
SELECT * FROM dbo.vwJobHistory WHERE
JobHistoryID='8507cfa9-8417-44ae-88e6-9ac19a0333a9' ORDER BY [JHD.StartTime]
FOR XML AUTO

Looks like Job details are fetched as globs of XML data, perfect to throw our beloved Regular Expressions at.

You can find the script I made at the end of the post. The obligatory notes are:

  • By convention, in our scenario, Policies used to create Duplicate jobs bear a name ending with “-D”. I’m SELECting the last Job IDs with a similar pattern; change it according to your needs, for instance if you’re interested in all the tape directed Jobs (and not just the Duplicate ones).
  • Columns are as follow:
    • Job name. In case you wonder, “FSIWDTH” means: Full Saturday, Incremental Weekdays, Duplicate on Thursday.
    • Actual start timestamp.
    • End timestamp.
    • Elapsed time (seconds).
    • Total bytes written. No bytes written? I skip this Job.
    • Rate (MBytes/minute). Oddly, BE doesn’t seem to always get this value right.
  • The “convert( varchar(” stuff in the main query is needed to fetch dates in a non driver-dependent format (see FreeTDS FAQ).
  • Dates are stored in UTC timezone. I make sure of adding the local TZ offset before printing them out.

Example output:

./be_job_media_report.pl
Sel SERVER03-FSIWDTH-D;20100311 09:15;20100312 11:26;94239;602103130444;405
AK8008L3
AK8011L3
Sel SERVER07-FSIWDTH-D;20100311 09:00;20100311 09:15;921;5133161638;452
AK8011L3
Sel SERVER16-FSIWDWE-D;20100310 10:35;20100310 17:34;25155;5352;0
AK8011L3
Sel SERVER13-FSIWDWE-D;20100310 09:00;20100310 17:29;30572;230425324573;515
AK7140L1
AK8011L3

And the script itself:

#!/usr/bin/perl
# Giuliano - http://www.108.bz
use strict;
use DBI;
use List::Uniq qw(uniq);
use Time::Piece;

sub pretty_time($) {
    my $time;
    $time = Time::Piece->strptime(shift, "%Y-%m-%d %H:%M:%S"); # 2010-03-10 16:34:19
    $time += $time->localtime->tzoffset;
    return $time->strftime('%Y%m%d %H:%M');
}

sub print_last_jobids($$;$) {
    my ($dbh, $number, $jobname_like) = @_;

    my $q = <<EOQ;
SELECT TOP 20 JobHistoryID, JobName,
              convert( varchar(30), OriginalStartTime, 120),
              convert( varchar(30), ActualStartTime, 120),
              convert( varchar(30), EndTime, 120),
              ElapsedTimeSeconds,
              FinalJobStatus, FinalErrorCode, TotalDataSizeBytes, TotalRateMBMin
FROM vwJobHistorySummary
-- WHERE
-- Jobname LIKE '$jobname_like'
ORDER BY ActualStartTime DESC
EOQ
    $q =~ s/-- (WHERE)/$1/ if $jobname_like;
    $q =~ s/-- (Jobname LIKE)/$1/ if $jobname_like;
    my $sth = $dbh->prepare($q);
    $sth->execute();
    my $row;
    while ( $row = $sth->fetchrow_arrayref ) {
        if ($row->[8]) { # TotalDataSizeBytes > 0
            $row->[3] = pretty_time($row->[3]);
            $row->[4] = pretty_time($row->[4]);
            printf "%s;%.f\n", (join ';', @{$row}[1,3,4,5,8]), $row->[9];
        }
        print_media_by_jobhistoryid($dbh, $row->[0]);
    }
}

sub print_media_by_jobhistoryid($$) {
    my ($dbh, $jobid) = @_;

    my $sth = $dbh->prepare(<<EOQ
SELECT * FROM dbo.vwJobHistory where
JobHistoryID='$jobid' ORDER BY [JHD.StartTime]
FOR XML AUTO
EOQ
    );
    $sth->execute();
    my @media;
    my $row;
    while ( $row = $sth->fetchrow_arrayref ) {
        my $record = join ';', @$row;
        push @media, $1 if $record =~ /Data="(.*?)"/;
    }
    print +(join "\n", uniq({sort => 1},@media)), "\n" if @media;
}

### Main

my $dbh = DBI->connect('dbi:Sybase:server=bedbdatasource;database=BEDB','DOMAIN\username','password') or die;
print_last_jobids($dbh, 10, '%-D');

exit;
  1. No need to enable TCP/IP on the instance, if Management Studio is installed on BE server itself ↩
]]> http://www.108.bz/posts/it/abusing-backup-exec-internal-database/feed/ 4 Installing HP Data Protector Disk Agent on Linux http://www.108.bz/posts/it/installing-hp-data-protector-disk-agent-on-linux/ http://www.108.bz/posts/it/installing-hp-data-protector-disk-agent-on-linux/#comments Tue, 16 Feb 2010 14:15:13 +0000 Giuliano http://www.108.bz/?p=308 The backup server (Cell Manager) runs on Windows, while the client is an x86-64 Red Hat Enterprise Linux 5.3 . Turns out that you’ll need the CD image labeled “Installation Server 2 of 2″ – B6960-10020.iso – for HP-UX (?) IA-64 (??). Of course it took me a while to figure it out…

Head towards HP Data Protector v6.0 software depot, press “Receive for Trial”, select the stuff you’d like to download and fill in the form.

First (silly me!), I tried the obvious:

[root@lnxsrv01 ~]# mount -o loop "/mnt/temp/temp/HP Data Protector for Linux x86-64 - Installation Server - 1 of 2 B6960-10011.iso" /mnt/iso1
[root@lnxsrv01 ~]# cd /mnt/iso1/LOCAL_INSTALL/
[root@lnxsrv01 LOCAL_INSTALL]# ./omnisetup.sh -server bcksrv.domain.lan -install da
  No Data Protector/OmniBack software detected on the target system.

  Setup cannot continue, please insert the HP-UX installation CD (CD2)
  and run the installation script again, without options, it will continue.

Ok then, let’s try with the CD it’s suggesting:

[root@lnxsrv01 ~]# umount /mnt/iso1
[root@lnxsrv01 ~]# mount -o loop "/mnt/temp/temp/HP Data Protector for HP-UX IA-64 - Installation Server 2 of 2 B6960-10021.iso" /mnt/iso1
[root@lnxsrv01 ~]# cd /mnt/iso1/LOCAL_INSTALL/
[root@lnxsrv01 LOCAL_INSTALL]# ./omnisetup.sh -server bcksrv.domain.lan -install da

  The omnisetup.sh script didn't finish last time
  Client still has to be installed. (omnicf da)

  The omnisetup.sh script can now continue the unfinished installation
  or it can ignore the saved state and start a new one.
  If you choose to ignore, the script will erase the saved state
  and will process only the command line options
  Do you want to continue the unfinished installation? (Y/n)
 
  Resuming (using possible CLI options)...
 
  No Data Protector/OmniBack software detected on the target system.



  Packets going to be (re)installed: omnicf  da
 
  Unpacking selected packets from CD, please wait (5-10 minutes)...
  Unpacking complete!
 
  Installing Core (omnicf)...

./omni_rinst.sh: line 494: uncompress: command not found
64778 blocks
/
Data Protector Software package successfully installed
  Installing Disk Agent (da)...
    The packet file for this component does not exist
    Either it is not supported on this unix platform
    or some error occurred and the system cannot find
    the file /tmp/omni_tmp/packet.Z or installation
    is not started from appropriate CD
 
  Importing client to bcksrv.domain.lan...
[12:1625] Import host failed.
 
  Current state was saved.  Running the setup again without options
  will make the script to retry the failed operation
  Exiting...

Looks like something’s amiss. It seems that the “uncompress” error (judging on the install script source code) can be safely ignored (the script falls back on using gunzip), while the “Installing Disk Agent” error is bad. Some parts of the software have been installed correctly (telnet on agent’s TCP port 5555 works) but the Client can’t be imported on Cell Manager.

Let’s try with HP-UX CD 1:

[root@lnxsrv01 ~]# umount /mnt/iso1
[root@lnxsrv01 ~]# mount -o loop "/mnt/temp/temp/HP Data Protector for HP-UX IA-64 - Installation Server 1 of 2 B6960-10020.iso" /mnt/iso1/
[root@lnxsrv01 ~]# cd /mnt/iso1/LOCAL_INSTALL/
[root@lnxsrv01 LOCAL_INSTALL]# ./omnisetup.sh -server bcksrv.domain.lan -install da

  The omnisetup.sh script didn't finish last time
  Client still has to be installed. (omnicf da)

  The omnisetup.sh script can now continue the unfinished installation
  or it can ignore the saved state and start a new one.
  If you choose to ignore, the script will erase the saved state
  and will process only the command line options
  Do you want to continue the unfinished installation? (Y/n)

  Resuming (using possible CLI options)...


  Data Protector version A.06.00 found



  Packets going to be (re)installed: omnicf  da

  Unpacking selected packets from CD, please wait (5-10 minutes)...
  Unpacking complete!

  Installing Core (omnicf)...

./omni_rinst.sh: line 494: uncompress: command not found
64778 blocks
/
Data Protector Software package successfully installed
  Installing Disk Agent (da)...

./omni_rinst.sh: line 494: uncompress: command not found
Data Protector Software package successfully installed
  Importing client to bcksrv.domain.lan...
Import host successful.
 
  Installation/Upgrade session finished.

Ok, the Client is indeed visible on Cell Manager.
I guess that the three steps process I went through by “subsequent approximation” isn’t really necessary. You could have just as much luck by downloading B6960-10020.iso and running the installer…

]]> http://www.108.bz/posts/it/installing-hp-data-protector-disk-agent-on-linux/feed/ 4