CentOS Data Protector agent unable to be installed

A customer asked me today for some help with a CentOS server that wouldn't install properly, despite everything looking OK.

The session went like this.

# ./omnisetup.sh -server cellmgr.ifost.org.au -install da,autodr
Cannot access the Cell Manager system (inet is not responding)....

As the cell manager was known to be working, we didn't need to check connectivity to 5555 on the cell manager. I suggested just running the installation (without the cell manager import first)

# ./omnisetup.sh -install da,autodr

This worked fine. Was the disk agent listening?

# netstat -an | grep 5555
tcp6   0   0   :::5555 :::*    LISTEN

That's odd: why IPv6? The cell manager had IPv6 disabled, so that would certainly have stopped things working.

# grep FLAGS /etc/xinet.d/omni
FLAGS = IPV6

That's that one explained... use your favourite editor (vi, nano, emacs, gedit...) to set FLAGS = IPV4 if you happen to encounter it. (Don't forget to run service xinetd restart )

But things still weren't working: CentOS has a host-based firewall. As we didn't have a media agent, the only relevant port is tcp 5555.

# firewall-cmd --add-port 5555/tcp --permanent
# firewall-cmd --reload

And then everything worked correctly.

Thanks to Glen Thompson for doing most of the work investigating this one!

Greg Baker is an independent consultant who happens to do a lot of work on HP DataProtector. He is the author of the only published books on HP Data Protector (http://www.ifost.org.au/books/#dp). He works with HP and HP partner companies to solve the hardest big-data problems (especially around backup). See more at IFOST's DataProtector pages at http://www.ifost.org.au/dataprotector

Linux iptables firewalling rules for use with Data Protector

Every client (and the cell manager) needs port 5555 open, unless you've changed the default port for the omniinet service.

Do you have a special "backup" network? If it's accessible on (say) eth1, then

iptables -I INPUT -p tcp -i eth1 --dport 5555 -j ACCEPT

Or, if you want to restrict a client so that it only receives connections from the cell manager (if the cell manager has an IP address of 192.168.200.100:

iptables -I INPUT -p tcp -s 192.168.200.100 --dport 5555 -j ACCEPT

You could get the same effect by adding an only_from parameter in /etc/xinetd.d/omni or by turning on cell security.

If the client also has tape drives (or the robotic control for a tape library) attached then you will need to open up a range of port numbers. Here I've allowed 10 concurrent connections, which would be appropriate for a 9-drive tape library with a robotic controller:

test -e /opt/omni/.omnirc || cp /opt/omni/.omnirc.TMPL /opt/omni/.omnirc
echo OB2PORTRANGESPEC=xMA-NET:18000-18009 >> /opt/omni/.omnirc
for port in 18000 18001 18002 18003 18004 18005 18006 18007 18008 18009
do
  iptables -I INPUT -p tcp --dport $port -j ACCEPT
done

And if you are running the StoreOnce software component on this Linux machine, then you will need ports 9387 and 9388 (unless you have changed them).

iptables -I INPUT -p tcp --dport 9387 -j ACCEPT
iptables -I INPUT -p tcp --dport 9388 -j ACCEPT

Finally, save it for the next reboot:

service iptables save

Greg Baker is an independent consultant who happens to do a lot of work on HP DataProtector. He is the author of the only published books on HP Data Protector (http://x.ifost.org.au/dp-book). He works with HP and HP partner companies to solve the hardest big-data problems (especially around backup). See more at IFOST's DataProtector pages at http://www.ifost.org.au/dataprotector