COH-285 Cohesity Certified Protection Professional – NetBackup Appliances Questions and Answers

The correct log is the vnetd proxy log. NetBackup secure host communication uses host ID-based certificates and certificate revocation lists (CRLs). When communication fails between the primary/master server and a client because a certificate is revoked, unavailable, missing, or affected by CRL validation, the relevant troubleshooting path is the vnetd proxy process log files. Cohesity’s NetBackup Troubleshooting Guide states that for host-certificate troubleshooting, administrators should examine job details for certificate, revocation, and CRL messages, and “may need to examine the vnetd proxy process log files” for related messages and status codes. The same guide notes that NetBackup hosts must have a valid host ID-based security certificate and a valid CRL to communicate; otherwise, communication fails. For a revoked primary server certificate, Cohesity specifically identifies that the vnetd proxy process log files on hosts show that the primary server certificate is revoked. Therefore, nbemm is for Enterprise Media Manager functions, bprd is request processing, and nbrb is resource brokering; none is the primary diagnostic log for certificate revocation analysis. Reference topics: Troubleshooting security certificate revocation, Viewing vnetd proxy log files, and Test the vnetd proxy connections.

( The Staging Schedule option in the Change Storage Units dialog allows you to define a schedule for moving backup data from the staging area to secondary storage, enabling you to optimize your backup storage utilization and reduce storage costs.)

The correct answer is C because the failure is an authorization problem on the NetBackup client, not a basic network-connectivity failure. The job output explicitly states that nbumaster8 “is not an authorized server for host nbclient1,” followed by status 59: access to the client was not allowed. Cohesity NetBackup documentation maps status code 59 to “Access to the client was not allowed.” The controlling configuration is the client’s SERVER list. Cohesity states that the SERVER entry defines the list of NetBackup primary and media servers that can access the NetBackup client, and that media servers or other primary servers must be added for that client. Cohesity also explains that on UNIX servers and clients, the SERVER entries in bp.conf define the NetBackup servers that are allowed access, with additional entries identifying servers that can initiate scheduled backups. Therefore, the client rejected the backup request because the requesting server name was missing from the client’s server list or did not match the expected resolved name. References/topics: Status code 59, SERVER option for NetBackup clients, bp.conf, Host Properties > Clients > Servers, and NetBackup host-name authorization.

The default summary interval is 24 hours. In NetBackup Appliance AutoSupport/Call Home behavior, when Call Home is enabled and a monitored hardware or software failure occurs, the appliance uploads diagnostic and monitoring information to the AutoSupport server and also generates email notifications to the configured recipient list. The official Appliance AutoSupport Reference Guide describes three email notification types: an initial error notification when the failure is detected, a resolved notification when the failure clears, and “a 24-hour summary by email” for unresolved errors. The NetBackup Appliance Security Guide states the same operational sequence: the appliance sends an error email, a resolved email, and a 24-hour summary of currently unresolved errors. Therefore, 15 minutes, 1 hour, and 12 hours are not the documented default intervals for unresolved-error summary notification. Those values may resemble polling or alerting intervals in other monitoring systems, but NetBackup Appliance Call Home uses the daily summary model to reduce repeated notifications while keeping administrators informed of unresolved conditions. Reference topics: Appliance AutoSupport Reference Guide – About Call Home, Settings > Notification > Alert Configuration, and NetBackup Appliance Security Guide – Call Home alert behavior.

The required step is to verify that the third-party OST target supports Accelerator with VMware-type policies in the Hardware Compatibility List. Cohesity NetBackup documentation states that Accelerator for virtual machines uses VMware Changed Block Tracking (CBT) to identify changes inside the virtual machine, not the Windows NTFS or ReFS change journal. The same VMware Accelerator requirements topic lists supported disk storage destinations and includes qualified third-party OpenStorage devices, then specifically instructs administrators to verify Accelerator support for the storage unit in the NetBackup hardware compatibility list for supported OST vendors. It also warns that if the storage unit does not support Accelerator, the backup can fail with messages such as the storage server type not supporting accelerator backup. The HCL further identifies Accelerator with VMware-type policies as a distinct OpenStorage supported-functionality entry, meaning generic OST support is not sufficient; the vendor/device must support the VMware Accelerator capability. (Veritas Download) Option A applies to file-system Accelerator behavior for Windows clients, not VMware image-level backups. Option C is not mandatory for the first successful VMware backup. Option D is incorrect because VMware Accelerator does not require manually creating a client track log.

The correct procedure is to delete the incorrectly discovered tape entry, configure the Media ID generation rule correctly, re-inventory the library, and then run the recovery. The catalog recovery request requires MediaID GBP847 for barcode GBP847S1, but the new server inventoried the tape as P847S1. Cohesity NetBackup documentation explains that, by default, NetBackup generates a media ID from the last six characters of a tape barcode. For barcode GBP847S1, the last six characters are P847S1, which exactly matches the incorrect media ID shown in the Administration Console. Cohesity further states that media ID generation rules override this default and define which barcode characters NetBackup uses to create the media ID. In this case, the rule must generate the media ID from the first six characters, producing GBP847. The rule is configured from the robot inventory advanced options under Media ID Generation. A barcode rule is not sufficient because barcode rules assign media attributes such as media type or volume pool, whereas media ID generation controls the actual media ID. bplabel is also inappropriate because it can relabel media and risks invalidating existing backup data. References/topics: Catalog recovery, robot inventory, media ID generation rules, and tape barcode handling.

The unavailable feature is Spanning volumes. In NetBackup cloud storage, disk-volume spanning is not supported by cloud vendors for backup images. The official NetBackup Cloud Administrator’s Guide lists cloud-storage limitations and explicitly states that cloud vendors do not support disk volume spanning of backup images. This makes option C the only correct answer. The other options are valid cloud-storage configuration capabilities. Compression is available in the Cloud Storage Server Configuration Wizard; the wizard provides a setting to compress backup data before writing to cloud storage. Encryption is also a supported wizard function, including AES-256 encryption and KMS-related configuration for data written to cloud storage. Secure Sockets Layer is likewise a supported connection property: NetBackup cloud storage server properties include USE_SSL and USE_SSL_RW, with SSL enabled by default for control APIs and read/write operations. Therefore, because encryption, SSL, and compression are configurable cloud features, while disk-volume spanning is a documented cloud-storage limitation, the correct selection is C. Spanning volumes. Reference topics: NetBackup Cloud Administrator’s Guide, “Configuring cloud storage,” “Cloud storage server connection properties,” and “Support limitations for NetBackup cloud storage.”

The correct command is nbstlutil. In NetBackup, lifecycle-managed images are controlled by Storage Lifecycle Policies (SLPs), and the dedicated command-line utility for inspecting and intervening in SLP processing is nbstlutil. Cohesity’s NetBackup Commands Reference defines nbstlutil as the command used to “run the NetBackup storage lifecycle policies utility,” and its description states that it provides a way for users to intervene in storage lifecycle policy operations. Most directly, the same official command reference lists the report function under nbstlutil and states that report shows a rollup of incomplete copies of lifecycle-managed images. Therefore, the practical command would be nbstlutil report, with optional filters such as lifecycle name, client, media ID, media server, storage server, or SLP version.

The other commands do not target this SLP-specific view. bpimage is associated with backup image operations, bpimmedia reports media/image relationships, and bpimagelist lists backup image catalog information. They do not provide the SLP incomplete-copy rollup requested in the question. Reference topics: NetBackup Commands Reference Guide, nbstlutil, Storage Lifecycle Policy operations, and lifecycle-managed image status reporting.

The correct action is to increase the Maximum I/O Streams for the MSDP disk pool. In NetBackup disk storage, the disk pool stream limit is the effective gate for concurrent read/write activity against that pool. Cohesity documentation identifies Limit I/O streams as the disk-pool property that controls read and write streams, and notes that if the limit is reached, NetBackup queues jobs until a volume becomes available. The storage-unit Maximum concurrent jobs setting controls how many jobs NetBackup sends to a disk storage unit, but Cohesity also states that this setting is not the only concurrency limiter and depends on disk-pool and media-server factors. NetBackup performance guidance is more explicit for this scenario: the disk pool Max I/O Streams value sets concurrent read/write operations, while the storage unit concurrent-jobs value addresses backup/restore jobs and does not control secondary operations such as duplications and replications; those are usually dictated by Max I/O Streams. Therefore, increasing storage-unit jobs or SLP priority does not guarantee that AIR replications can run while backups consume all available disk-pool streams. The correct tuning point is the disk pool’s Maximum I/O Streams.

The required prerequisite is to set an encryption passphrase for disaster recovery packages. In a NetBackup catalog backup workflow, the catalog backup creates disaster recovery information that is required during catalog recovery. Cohesity NetBackup documentation places the passphrase step before the catalog policy is configured. In the manual catalog backup procedure, after creating the DRPackages directory and setting ownership, the guide instructs the administrator to “set the passphrase to be used at time of catalog recovery,” then open the NetBackup Administrator Console and navigate to Security Management > Global Security Setting > Disaster Recovery. In the Encryption for Disaster Recovery section, the administrator must add, confirm, and save the passphrase. Only after these steps does the documented procedure proceed to “Configure NetBackup catalog backup policy.”

This makes option D correct. A universal share is not required; the DR package path can be a configured persistent directory. An email address is optional and only used to send DR packages when email is configured. Logging in as Systems Administrator is not the specific prerequisite identified by the catalog backup procedure. Reference topics: Performing catalog backup and recovery, Backing up a catalog, and Disaster Recovery encryption settings.

The correct command is vxlogview -o 118 -d D,T,x. Status code 96 commonly indicates that NetBackup could not allocate required media or storage resources, so troubleshooting should focus on the NetBackup Resource Broker, also known as nbrb. Cohesity NetBackup documentation identifies originator ID 118 as nbrb, the NetBackup Resource Broker, which maintains available resource information and locates the physical and logical resources needed for backup and tape restore operations. The vxlogview command is the supported utility for reading unified logs, because unified log files are binary and must be assembled by vxlogview. The -o 118 option filters log records for the Resource Broker originator, while -d D,T,x displays the required fields: date, timestamp, and actual log message text. The command reference defines D as display date, T as display timestamp, and x as display actual log message text. Option C is incorrect because w displays who logged diagnostic/debug messages, not the actual message text. References/topics: NetBackup unified logging, vxlogview, originator IDs, nbrb Resource Broker logging, and status 96 resource allocation troubleshooting.

The correct options are A and E. The warning indicates that the catalog disaster recovery file is being written to a location that would likely be lost with the NetBackup catalog during a disk or server failure. Cohesity NetBackup documentation for the NBU-Catalog policy’s Disaster Recovery tab states that the DR path is where disaster recovery information is saved, and explicitly recommends not saving that information to the local computer; instead, it should be saved to a network share or removable device. It also states that, on UNIX, the path cannot be on the same partition as /usr/openv/netbackup; it must be changed to a directory on a different partition. Therefore, placing the DR file on a volume other than the NetBackup volume resolves the warning. Cohesity also documents the Send disaster recovery email option, where one or more administrator email addresses can be entered so NetBackup sends DR information after every catalog backup. The disaster recovery email includes recovery instructions and the image file/package attachments needed for catalog recovery. References/topics: NBU-Catalog policy, Disaster Recovery tab, DR file path, and disaster recovery email configuration.

The correct log to review is nbpem, the NetBackup Policy Execution Manager log. Cohesity NetBackup documentation states that nbpem creates policy and client tasks and determines when jobs are run, and its logging location is install_path\NetBackup\logs\nbpem on Windows and /usr/openv/logs/nbpem on UNIX/Linux. In the scheduled backup workflow, nbpem initiates a backup when the job becomes due. It determines whether the policy, schedule, and backup window are valid, retrieves policy information through nbproxy, and then submits the due job to nbjm to obtain a job ID.

Therefore, when an automatic schedule does not launch a backup at the expected time, the first diagnostic focus is the scheduler and policy-evaluation component, not the later job-control or resource-allocation components. nbjm manages submitted jobs after nbpem hands them off, nbrb brokers resources, and nbemm manages media and device/resource database functions. Since the failure occurs before the job launches automatically, nbpem is the authoritative debug log for determining why the policy schedule did not trigger. Reference topics: Backup process, nbpem logging, and Policy Execution Manager scheduling behavior.

With ALL_LOCAL_DRIVES and Allow multiple data streams enabled, NetBackup can split each client backup into separate streams per drive or file system; Cohesity documentation states that NetBackup backs up the client and “splits the data from each drive” into its own stream when multiple data streams are enabled. However, the number of streams that can run concurrently is still constrained by job limits. Cohesity’s policy documentation states that concurrent stream count is affected by Maximum jobs per client, Limit jobs per policy, and related storage limits; when Maximum data streams is not explicitly set, NetBackup uses the lower of Maximum jobs per client or Limit jobs per policy. The default Maximum jobs per client is one job, so only one backup stream per client can run. With five clients, that means 5 active backup jobs, not 15.

The storage unit’s Maximum concurrent jobs = 15 does not restrict restores, because Cohesity states this setting controls backup and duplication traffic, not restore jobs. The disk pool’s Maximum I/O Streams = 20 limits read and write streams; restores read backup images and backups write them. Five backups plus ten restores equals 15 total streams, so all 10 restores can run.

The replication job starts when the force interval for small replication jobs is reached. NetBackup SLP settings control how Storage Lifecycle Policy jobs are maintained and executed for the selected primary server. Cohesity documentation identifies these as SLP settings used to customize how SLP jobs run. For AIR replication batching, the controlling parameter here is SLP.MIN_SIZE_PER_REPLICATION_JOB. Official NetBackup documentation defines it as the smallest batch size that can run as a single replication job and states that the job does not run until enough images accumulate to reach that size, or until the force interval for small replication jobs is reached. (veritas.com)

In this scenario, three backups of 5GB each create only 15GB of eligible replication data. That is below the configured 20GB threshold, so NetBackup does not start the replication job based on size. Because the backup window has closed and no additional backup images will arrive, the batch cannot reach 20GB. NetBackup therefore submits the small replication batch when the oldest image reaches the configured 60-minute force interval. The force interval is specifically designed to prevent NetBackup from waiting too long before submitting a small replication job. (veritas.com)

The correct answer is A. The DISALLOW_SERVER_FILE_WRITES client configuration entry controls whether NetBackup servers are allowed to write files on the client host. Cohesity NetBackup documentation states that this entry “prevents the NetBackup server from creating files on the NetBackup server or client” and further explains that it prevents NetBackup servers from remotely performing restores or remotely changing client configurations. In practical administration terms, this disables server-directed restores to that client. Cohesity also maps the related Windows Backup, Archive, and Restore interface setting to File > NetBackup Client Properties > Allow server-directed restores, confirming that the function is specifically about whether restores can be initiated from the NetBackup server side toward the client. This is why option A is the best match. Option B refers to redirected restores, which are governed by alternate-client restore permissions and client authorization behavior, not this setting alone. Option C is too broad because client-initiated restore capability is controlled separately, such as by DISALLOW_CLIENT_RESTORE. Option D is unrelated to backup write permission. References/topics: Client configuration options, DISALLOW_SERVER_FILE_WRITES, Allow server-directed restores, and NetBackup host security controls.