SAP/Oracle Backup via HP DataProtector using BRTOOLS

[tobias_ptz]

Hi folks,

Hope I'm right in this Forum, the new structure is a bit confusing

We've changed our software environment from Symantec Backup Exec to HP Data Protector, and got now some strange behaviors.

I don't change software before I don't give it some tests and all my tests, on some sandbox systems, were pretty fine. (Windows 2008 R2/nonR2 SP2 - DP 7.01)

Now I've changed every single SAP server from Backup Exec to use HP Data Protector and run some tests.

All Windows Server 2008 running fine, without any issues. From SAP using BRTOOLS (DB13) and vice versa from Data Protector (INET Service).

But on Windows Server 2003, the BRBACKUP and BACKINT starts and after 5 seconds the processes stops immediately.

On Data Protector side, I get only System error: [10054] Connection reset by peer nothing more, neither in the debug files.

On the HP DP integration guide, every Server 2k3 should change the HP DP INET service from local system account to domain SAPServiceSID account.

Found under x:\usr\sap\<SID>\DVEBMGS00\work a debug.log file which says:

1/29/2013 1:18:34 PM  OB2BAR_BACKINT.3512.7644 ["/integ/sap/optmgr.c $Rev: 16794 $ $Date:: 2011-01-11 14:36:00":664] A.07.00 b100
[SapOptParseCfgOpts] Can not get configuration from Cell Server "backupserver.domain.com" with barlist "SID"
1/29/2013 1:18:34 PM  OB2BAR_BACKINT.3512.7644 ["/integ/sap/sap_common.c $Rev: 32486 $ $Date:: 2012-07-17 17:46:16":126] A.07.00 b100
[CheckFreeSpace] OpenFile("x:\oracle\SID\sapbackup\.bekkxqig.lst",&openFileStruc,OF_READ) failed. Error: [32] The process cannot access the file because it is being used by another process.
1/29/2013 1:18:34 PM  OB2BAR_BACKINT.3512.7644 ["/integ/sap/backint.c $Rev: 32540 $ $Date:: 2012-07-19 20:17:08":863] A.07.00 b100
[SapBackupFiles] fopen("C:/Program Files/OmniBack/tmp/sapb1359461914351276440.tmp", "w") failed. Error: [13] The data is invalid.

SAP starts with the SAPServiceSID (disp+work), and if I start a backup via DB13 brbackup/brarchive starts with the user SAPServiceSID and BACKINT too.

So using SysInternals Process Monitor, I found out that the ".bekkxqig.lst" file created by the user SIDadm, maybe because of that, the SAPServiceSID cannot view the *.lst file. Starting brbackup via command line, the backup starts immediately. To make it short, I gave SAPServiceSID local admin rights and restarted windows, oracle and sap. After that, the backup works also.

Now I'm a bit confused, on Backup Exec everything works with the standard permission that SAP Inst is given. Now on HP DP there are some problems.

From my HP Support:

Customer can easily look to the .lst file’s properties and examine what users can / cannot read it.
It would not be the first time, that brbackup / SAP frontend runs under changed effective rights.

Permissions on x:\oracle\SID\sapbackup:

Administrators                     (local group)

SIDadm                                (domain user)

SAP_SID_GlobalAdmin     (domain group)

SAPServiceSID                    (domain user)

SYSTEM                                (local group)

Users                                    (local group) 

If I change the INET service from SAPServiceSID to SIDadm, DataProtector cannot start the backup, because the SAPServiceSID user is on Oracle the known OPS$ user with the needed rights.

Question: why is the *.lst file is created by SIDadm while SAP is starting brbackup with the SAPServiceSID user? Is that right?

I can live with the new granted local admin rights, but I wanna know why they are needed.

Next point, I start every night an online backup with the archive option -cds (copy delete save).

brbackup -jid ALLOG20121127031500 -u / -c force -t online -m all -p initpu1.sap -v SCRATCH -a -c force -p initpu1.sap -cds

With Backup Exec brarchive saved the offline redo logs and unset the attributes flag on windows file system. On the next run, brarchive saved (copy) all redo logs without the attributes (A) flag, after that all copied redo logs will be deleted and the redo logs with an active attributes flag will be saved and the flag (A) will be unset.

With HP Data Protector the mechanism is the same, but the flag (A) still persists.

So now, I don't now at the first look, which redo logs are saved (without A) and which are not (with A).

Question: can someone explain that to me? Doesn't set the flag brarchive but BACKINT?

This is on Windows Server 2003 and 2008 / R2

Thanks for any advise.

Best regards,

Tobias

[tobias_ptz · Accepted solution]

It was an error in the HP Data Protector Guide:

Var: OB2BARHOSTNAME

It should have the FQDN of the client host, not the SID!

OB2BARHOSTNAME=<hostname>.<domain>.com

[volker_borowski2]

Hi,

strange error. Guess this might require a HP backint patch.

Only thing what is always worth trying when strange execution stuff happens

on windows is to crosscheck the MS C runtime environment.

It might not even be a problem for your SAP systems yet but only for

recently patches brtools. Check note 1375495 plus the attachment

and get the correct vcredist_x64 for your system and apply it (yeah, this is a weak guess).

Hope this helps

Volker

[tobias_ptz]

Hi,

got the named note transposed numbers?

Don't know, how this note should help me.

Thanks

Tobias

[volker_borowski2]

Hi,

wurks... ja, i mixed up note numbers, sorry ...

Problem is, I do not find the new note again... ;-(

only the old one which is 684106 which is aout MS runtime DLLs.

The new one is related to vcredist_64.exe

Unfortunately I am in a hurry now,

but may be you can try to search with "vcredist_x64.exe"

Volker

Sorry

[volker_borowski2]

Found it again,

Note 1375494 - SAP system does not start after applying SAP kernel patch

It had to be close with the numbers.

Anyway, I am not sure if it helps, but this is always one thing I like to rule out.

Volker

[tobias_ptz]

Hi Volker,

thank's for the right note.

I'll give it a try, come back later again to update you.

Tobias

[tobias_ptz]

Bad news, the note doesn't helped ..

Thanks anyway!

Tobias

[volker_borowski2]

Sorry to hear that.

Since it has been a while since I configured DP and never did on DP 7.x :

How do you configure the Integration when connecting to the client.

I mind to remember, that on earlier releases you needed to specify orasid

as OS User for unix. If this is still the case, it might be that this is the place,

where your sidadm ownership comes from.

As you are telling, it seems that the inet service does not need to tun under

SAPServiceSID on W2K8 anymore. If this is the case it needs to have a built in

switch to sidadm, otherwise, you would not be able to connect as sysoper.

So may be the way out is to simply run the inet Servcie as sidadm

instead of SAPServiceSID on W2K3 for DP 7.x?

Volker