====== Establishing a TSM Backup for Servers / VMs ====== \\ ===== Establishing a TSM Backup for Debian 11 / 10 / 9 (Bullseye / Buster / Stretch) ===== === (most likely also for other Debian based systems) === \\ Download the IBM Tivoli Client Software: * Version 8 branch: * Open https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86_DEB/BA/ * Navigate in the directory with the newest version and get the tarball file (e.g. ''8.1.27.0-TIV-TSMBAC-LinuxX86_DEB.tar'') \\ \\ * Version 7 branch: * Download tarball from here: ftp://ftp.software.ibm.com/storage/tivoli-storage-management/maintenance/client/v7r1/Linux/LinuxX86_DEB/BA/v718/7.1.8.0-TIV-TSMBAC-LinuxX86_DEB.tar * **or** from here: https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v7r1/Linux/LinuxX86_DEB/BA/v718/7.1.8.0-TIV-TSMBAC-LinuxX86_DEB.tar # Put the tarball in a spearate directory and extract it: # E.g., for version 8 branch: mkdir TSMinstall; mv 8.1.27.0-TIV-TSMBAC-LinuxX86_DEB.tar TSMinstall; cd TSMinstall tar xvf 8.1.27.0-TIV-TSMBAC-LinuxX86_DEB.tar # Install the packages in following order: # 1. gskcrypt64 # 2. gskssl64 # 3. tivsm-api64 # 4. tivsm-ba # E.g., for version 8 branch: dpkg -i gskcrypt64_8.0-60.4.linux.x86_64.deb dpkg -i gskssl64_8.0-60.4.linux.x86_64.deb dpkg -i tivsm-api64.amd64.deb dpkg -i tivsm-ba.amd64.deb # E.g., for version 7 branch: dpkg -i gskcrypt64_8.0-50.78.linux.x86_64.deb dpkg -i gskssl64_8.0-50.78.linux.x86_64.deb dpkg -i tivsm-api64.amd64.deb dpkg -i tivsm-ba.amd64.deb # Check if Global Security Kit (GSKit) libraries are recognized by the system: gsk8ver_64 # If you get an 'library not found' error, e.g. # 'gsk8ver_64: error while loading shared libraries: libgsk8cms_64.so: cannot open shared object file: No such file or directory' # you have to export Global Security Kit (GSKit) libraries by updating the LD_LIBRARY_PATH: export LD_LIBRARY_PATH=/usr/local/ibm/gsk8_64/lib64:$LD_LIBRARY_PATH # Test it again, now you should get some reasonable output with: gsk8ver_64 Now create the configuration files dms.sys, dsm.opt and inclexcl.def in ''/opt/tivoli/tsm/client/ba/bin/''. Here are templates, please modify them to your corresponding servername/directories/files you want to backup/exclude. SErvername ADSM NODENAME #####_PUT_HERE_YOUR_NODENAME_##### COMMMethod TCPip TCPPort 1500 TCPServeraddress adsm.uibk.ac.at TCPCLIENTADDRESS ########.uibk.ac.at passwordaccess generate * SCHEDMODE Polling MANAGEDServices schedule SCHEDLOGname /var/log/dsmsched.log ERRORLOGname /var/log/dsmerror.log Inclexcl /opt/tivoli/tsm/client/ba/bin/inclexcl.def schedlogmax 2047 The schedlogmax setting in dsm.sys sets the maximum logfile size for dsmsched.log and dsmwebcl.log to the entered value in MB and enables wrapping (similar to a ring buffer within the files). When not setting this variable or using 0 it allows the log file to grow indefinitely. To get to the point of the last entry in the log when wrapping is enabled search for **"END OF DATA"**. Use this option when you're low / limited on system storage. SErvername ADSM * In die DOMAIN sind natürlich nur tatsächlich vorhandene Mountpoints aufzunehmen DOMAIN / FOLlowsymbolic no In ''inclexcl.def'' you define which directories / files should be backuped or excluded: INclude /home/.../* INclude /etc/.../* INclude /usr/.../* INclude /var/.../* EXclude dsmsched.log EXclude.dir /bin EXclude.dir /boot EXclude.dir /dev EXclude.dir /lib EXclude.dir /lib64 EXclude.dir /lost+found EXclude.dir /media EXclude.dir /mnt EXclude.dir /tmp exclude.dir /.../lost+found exclude.dir /.../.snapshot exclude.dir /.../.cache exclude *~ Now enter the dsm shell with: dsmc Test to log in (press RETURN when asking for Nodename, after that enter your password), then do a first incremental backup: # !! These commands only work within the interactive dsmc console !! incr # Exit with quit After successfully testing and quitting dsmc, fix following startup script to work with Debian (10): # 1. At the beginning of the script, find these two lines: DSMCAD_DIR=/opt/tivoli/tsm/client/ba/bin DSMCAD_BIN=$DSMCAD_DIR/dsmcad # Only needed for Version 7: # Directly after these two lines, ADD following line to find the GSKit libraries: export LD_LIBRARY_PATH=/usr/local/ibm/gsk8_64/lib64:$LD_LIBRARY_PATH # Only needed for Version 7: # 2. Find the following line: if [ $NAME = "Ubuntu" ] # and REPLACE it with: if [ "$NAME" = "Ubuntu" -o "$NAME" = "Debian GNU/Linux" ] Start & check the status of the TSM scheduler (dsmcad): # In case you tried to start the scheduler before modifying the script, you have to reload units to reload the source configuration with: # systemctl daemon-reload systemctl start dsmcad systemctl status dsmcad # enable for autostart after a reboot systemctl enable dsmcad -------------------- ==== Error Debugging / Troubleshooting ==== === Error loading shared libraries === If you see an error on the dsmcad status and investigated via ''journalctl -xe'', like: dsmcad[7519]: /opt/tivoli/tsm/client/ba/bin/dsmcad: error while loading shared libraries: libgsk8ssl_64.so: cannot open shared object file: No such file or directory You can fix it by adding the location of the libgsk8ssl to the path in a file in the ''/etc/ld.so.conf.d'' directory: /usr/local/ibm/gsk8_64/lib64 Set it active with ldconfig You now should be able to successfully start up dsmcad without any error. -------------------- === Error with TSM accessing files with special characters / umlauts === If the ''dsm*.logs'' show errors while trying to backup files / directories with special characters, e.g. german umlauts, most likekely you have set your default system locale to UTF8. Unfortunately, TSM does not support UTF-8, so you have to change your locale in order to backup all files including those with umlauts / special characters. * Check your current system locale:localectlIf the output is similar to ''System Locale: LANG=en_US.UTF-8'', you have to change it. * Check installed locales:locale -a * If en_US (without UTF8) is missing, you have to install it - edit ''/etc/locale.gen'', uncomment ''en_US ISO-8859-1'' and save it. Then generate locale with locale-gen en_US Re-check again installed locales with ''locale -a'', now you should see en_US. * Change locale with localectl set-locale LANG="en_US" LC_CTYPE="en_US" and verify with localectl * Finally, restart dsmcad scheduler:systemctl restart dsmcad In the next run all files including those with special characters should be backed up. -------------------- === ANS1592E Failed to initialize SSL protocol. === :!: //UIBK only!// \\ \\ In some (rare) cases, you can experience this error when trying to connect with ''dsmc'' after a fresh install. \\ \\ Unlike the error may suggest, the problem lies on the server side. ZID has to do follwing steps to correct that: * (Re)set your node password to a different one * Correct the Node Registration (set session security to transitional) There are some ZID-Tickets addressing this issue, e.g. https://zid-ts.uibk.ac.at/browse/SYSOP-101605 -------------------- ==== Final Steps ==== You can go on and check, if the scheduler process is started: ps aux |grep dsm # Example Output: # root 68303 0.0 0.2 234384 25068 ? Sl 15:17 0:00 /usr/bin/dsmcad ls -la /var/log |grep dsm cat /var/log/dsmsched.log # Example Output: # 04/25/22 15:18:02 Session established with server ADSM: AIX # 04/25/22 15:18:02 Server Version 8, Release 1, Level 12.100 # 04/25/22 15:18:02 Server date/time: 04/25/22 13:18:02 Last access: 04/25/22 13:17:02 # # 04/25/22 15:18:02 --- SCHEDULEREC QUERY BEGIN # 04/25/22 15:18:02 --- SCHEDULEREC QUERY END # 04/25/22 15:18:02 Next operation scheduled: # 04/25/22 15:18:02 ------------------------------------------------------------ # 04/25/22 15:18:02 Schedule Name: CS_INC_STD # 04/25/22 15:18:02 Action: Incremental # 04/25/22 15:18:02 Objects: # 04/25/22 15:18:02 Options: # 04/25/22 15:18:02 Server Window Start: 22:00:00 on 04/25/22 # 04/25/22 15:18:02 ------------------------------------------------------------ # 04/25/22 15:18:02 Scheduler has been stopped. **(a bit outdated) Docu for installing on Debian:** \\ https://wiki.uibk.ac.at/display/~c102mr/2011/05/15/Ubuntu+TSM+Server+Sicherung ---- \\ ===== TSM Backup for systemd Red Hat based Linux Servers (e.g. RHEL / CentOS / Rocky Linux / Fedora) ===== For a backup via TSM please follow these steps: * Go to * for branch 7: https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v7r1/Linux/LinuxX86/BA/ * for branch 8: https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86/BA/ * Select the newest version and download the .tar file * Extract the files in a temporary folder * With __rpm -ivh__ install the packages in the **following** order: - gskcrypt - gskssl - TIVsm-API64 - TIVsm-APIcit - TIVsm-BA - TIVsm-BAcit Configuration and futher steps are details in the [[https://web.archive.org/web/20070824061029/http://unix-docu.uibk.ac.at/zid/systeme/adsm/workstations/v5.unix.install.html#HDR0003|ZID Unix-Docu, archived version]] :!: **//some parts there are outdated!//**:!:. The software does not support UTF-8. It will skip files that have german umlauts in their path. To solve this set you locale to something without utf-8. [[http://christian.weblog.heimdaheim.de/2009/03/02/tsm-client-backing-up-files-with-umlauts-on-sles/|source]] Changing the locale systemwide is possible with ''localectl set-locale LANG="en_US" LC_CTYPE="en_US"'' To (auto)start the scheduler:\\ ''systemctl enable dsmcad\\ systemctl start dsmcad'' If you are behind a firewall you should set the option webports to specific values and forward those ports on your firewall for the TSM server to be able to reach you. ==== Upgrading a working TSM instance to the latest package ==== Use ''rpm -Uvh'' to upgrade the packages. TIV packages need to be updated with one single command, e.g.: rpm -Uvh gskcrypt64-8.0.55.31.linux.x86_64.rpm gskssl64-8.0.55.31.linux.x86_64.rpm TIVsm-API64.x86_64.rpm TIVsm-APIcit.x86_64.rpm TIVsm-BA.x86_64.rpm TIVsm-BAcit.x86_64.rpm \\ === Upgrading on older/deprecated OS versions === Beginning with IBM Spectrum Protect backup-archive client level 8.1.19, the operating system RHEL 6 and SLES 11 are no longer supported, as stated here: \\ [[https://www.ibm.com/support/pages/apar/IT44180]] \\ \\ You can update to the latest supported version v8.1.17 : cat /etc/redhat-release wget https://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Linux/LinuxX86/BA/v8117/8.1.17.0-TIV-TSMBAC-LinuxX86.tar tar xvf 8.1.17.0-TIV-TSMBAC-LinuxX86.tar rpm -Uvh gskcrypt64-8.0.55.29.linux.x86_64.rpm gskssl64-8.0.55.29.linux.x86_64.rpm TIVsm-API64.x86_64.rpm TIVsm-APIcit.x86_64.rpm TIVsm-BA.x86_64.rpm TIVsm-BAcit.x86_64.rpm \\ === Debugging === On older RedHat based systems you may get some errors while updating, e.g. error: Failed dependencies: libc.so.6(GLIBC_2.14)(64bit) is needed by TIVsm-API64-8.1.20-0.x86_64 libstdc++.so.6(GLIBCXX_3.4.15)(64bit) is needed by TIVsm-API64-8.1.20-0.x86_64 libc.so.6(GLIBC_2.14)(64bit) is needed by TIVsm-BA-8.1.20-0.x86_64 libstdc++.so.6(GLIBCXX_3.4.15)(64bit) is needed by TIVsm-BA-8.1.20-0.x86_64 You have to update glibc to minimum version v2.14 AND libstdc (GLIBCXX) to minimum version v3.4.15. However, you can manually update the required libraries. This is not a clean way of updating, but tested working in several machines running CentOS 6: cd /tmp/TSMinstall mkdir glibc; cd glibc # Check installed version(s) of glibc ldconfig -p | grep libc.so strings /lib64/libc.so.6 | grep GLIBC # Download glibc v2.17 libraries compiled to work for CentOS 6 Systems # Source: https://gist.github.com/harv/f86690fcad94f655906ee9e37c85b174 wget http://copr-be.cloud.fedoraproject.org/results/mosquito/myrepo-el6/epel-6-x86_64/glibc-2.17-55.fc20/glibc-2.17-55.el6.x86_64.rpm wget http://copr-be.cloud.fedoraproject.org/results/mosquito/myrepo-el6/epel-6-x86_64/glibc-2.17-55.fc20/glibc-common-2.17-55.el6.x86_64.rpm wget http://copr-be.cloud.fedoraproject.org/results/mosquito/myrepo-el6/epel-6-x86_64/glibc-2.17-55.fc20/glibc-devel-2.17-55.el6.x86_64.rpm wget http://copr-be.cloud.fedoraproject.org/results/mosquito/myrepo-el6/epel-6-x86_64/glibc-2.17-55.fc20/glibc-headers-2.17-55.el6.x86_64.rpm # You might have to install missing packet glibc-common and/or remove i686 version of glibc on 64bit systems: # yum install glibc-common # yum remove glibc.i686 # Update glibc to v2.17 rpm -Uvh glibc-2.17-55.el6.x86_64.rpm glibc-common-2.17-55.el6.x86_64.rpm glibc-devel-2.17-55.el6.x86_64.rpm glibc-headers-2.17-55.el6.x86_64.rpm # Check again installed version(s) of glibc, you should now have v2.17 strings /lib64/libc.so.6 | grep GLIBC # now update libstdc++ (GLIBCXX): # check GLIBCXX-Version strings /usr/lib64/libstdc++.so.6 |grep LIBCXX # Download libstdc++ v4.8.5 libraries cd /tmp/TSMinstall mkdir libstdc; cd libstdc wget https://rpmfind.net/linux/centos/7.9.2009/os/x86_64/Packages/libstdc++-4.8.5-44.el7.x86_64.rpm # Update libstdc++ to v4.8.5 rpm -Uvh libstdc++-4.8.5-44.el7.x86_64.rpm # check GLIBCXX-Version again, should now be > the required GLIBCXX_3.4.15 strings /usr/lib64/libstdc++.so.6 |grep LIBCXX # all dependencies should now be fixed, so you can finally install TSM 8: cd .. rpm -Uvh gskssl64-8.0.55.31.linux.x86_64.rpm gskcrypt64-8.0.55.31.linux.x86_64.rpm TIVsm-API64.x86_64.rpm TIVsm-APIcit.x86_64.rpm TIVsm-BA.x86_64.rpm TIVsm-BAcit.x86_64.rpm \\ ==== Restore ==== I found useful [[https://help.it.ox.ac.uk/hfs/help/dsmc|documentation]] about that part. dsmc restore -latest ---- ===== Autostart & respawn the scheduler in RHEL / CentOS 6 & 7 ===== Add in ''/etc/inittab'' ad:2345:respawn:/bin/env LC_ALL=en_US /opt/tivoli/tsm/client/ba/bin/dsmc sched >/dev/null 2>&1 **Attention:** Beginning with RHEL/Centos 6 the /etc/inittab is deprecated in favor of new init system "Upstart"! Auto-Start & respawn TSM in RHEL/Centos 6: Go to ''/etc/init'' and create/edit a file ''dsmc-respawn.conf'': cd /etc/init/ vim dsmc-respawn.conf start on stopped rc RUNLEVEL=[2345] stop on runlevel [!2345] respawn exec /bin/env LANG=en_US /opt/tivoli/tsm/client/ba/bin/dsmc sched >/dev/null 2>&1 To autostart the dsm scheduler, use initctl start dsmc-respawn Check if the DSM scheduler is running: ps aux |grep dsm tail /var/log/dsmsched.log ---- ---- ==== [ALPHA] Quick & Dirty How-To: ==== * **von ZID-Operating**: Tivoli DSM-Sicherung TSM01C-serverseitig einrichten lassen (NODEname, username, System, Sicherungsart) * Config anpassen: in ''/opt/tivoli/tsm/client/ba/bin/dsm.sys'' * evtl. in TSM-Client Passwort ändern bzw. setzen (''dsmc set password'' → schreibt TSM-Paßwort verschlüsselt nach ''/etc/adsm/TSM.PWD'') * manuelles TSM Backup starten (''dsmc incr'') * nach yum-Updates von TSM über Repo uibk-zid-tools-rhel-6.4 TSM-Prozeß neu starten (stop tsm / start tsm / status tsm) newest v7 Client is here (v8 is not supported by the server): \\ ftp://ftp.software.ibm.com/storage/tivoli-storage-management/maintenance/client/v7r1/Linux/LinuxX86/BA/ \\ or here: \\ ftp://public.dhe.ibm.com/storage/tivoli-storage-management/maintenance/client/v7r1/Linux/LinuxX86/BA/ \\ \\ ====== Establishing a TSM Backup for Clients / PCs (Windows) ====== * Register your client PC at ZID-Operating. They will need information about: * NODEname (=Hostname) * Username (c703nnn) - will be set up with your initial password ("Anfangspasswort") * System * "Sicherungsart" * Download TSM-Client for Windows (Attention: TSM Client v8 doesn't work for Windows 7): \\ * for branch 7: [[http://ftp.software.ibm.com/storage/tivoli-storage-management/maintenance/client/v7r1/Windows/x64/]] * for branch 8: [[https://www3.software.ibm.com/storage/tivoli-storage-management/maintenance/client/v8r1/Windows/x64/]] * Go to the newest version, download the EXE file (e.g. 8.1.13.0-TIV-TSMBAC-WinX64.exe); run it to decompress the installation files * Install it and if needed, copy missing DLL files to ''%SystemRoot%\system32'' * Edit dsm.opt \\ \\ ===== TSM (ADSM) Knowledge Base ===== * TSM (ADSM) uses Ports 1500, 1501 - make sure these are not blocked.\\ * TSM (ADSM) Forum :https://adsm.org/forum/index.php \\ ==== TSM Node-Passwörter ==== === Passwort am Client-Node === wird für den jeweiligen Node erstellt, lokal obfuskiert (nicht verschlüsselt) gespeichert und übermittelt über Option ''passwordaccess generate'' in dsm.opt bzw. dsm.sys .\\ === Passwort-Speicherort am Client-Node === * Windows: in Registry unter ''HKLM\Software\IBK\ADSM\CurrentVersion\Nodes\{nodename}\{servername}'' \\ * Linux: ''/etc/adsm/TSM.PWD'' bzw. ''/etc/adsm/TSM.sth'' \\ === Passwort zurücksetzen lassen === auf Anfangspasswort des persönlichen c-Accounts des Admins kann Gregor Danler (507-23418) vom ZID-Operating machen.\\ (Als Login wird vom TSM-Client allerdings **nicht** die c-Benutzerkennung verwendet, sondern der Node-Name!) === Passwort ändern === dsmc set password === Security-Infos === Von nicht aktuellen TSM-Clients obfuskiert gespeichertes Passwort kann auf Windows-Rechnern problemlos von jedem User ausgelesen werden: \\ https://improsec.com/tech-blog/vulnerability-in-tsm \\ ==== TSM (ADSM) Commands ==== All TSM commands can be entered on the command line with ''/opt/tivoli/tsm/client/ba/bin/dsmc ''\\ Interactive commands can be entered directly inside the "tsm> " console (just enter ''/opt/tivoli/tsm/client/ba/bin/dsmc'' to get into TSMinteractive mode). \\ \\ === Query Backup (list backuped files/dirs) === Examples: query backup "/" q b "/home/" q b "/etc/*" q b "C:\*" === Create manual incremental backup: === incr === Restore single file (latest version) === Examples: restore /home/bla/test.txt -latest restore '/home/bla/!_crude_dir/Umlautää.txt' -latest === Deleting specific files in TSM backup === //Your node does not have permission to delete backup files// del backup /home/bla/test.txt \\ del backup /home/bla/*\\ del backup "/home/bla/*.bak" all \\ ==== ZID TSM-Server Infos ==== Installed TSM-Server-Version (Feb/2022): IBM Spectrum Protect Server for AIX - Version 8, Release 1, Level 12.100 \\ Supportmatrix (https://www.ibm.com/support/pages/ibm-spectrum-protect-server-client-compatibility-and-upgrade-considerations) : \\ ^ IBM SPECTRUM PROTECT CLIENT SUPPORT \\ \\ includes the Backup-Archive, API, UNIX HSM, and Web clients \\ that are compatible with, and currently supported with, \\ IBM Spectrum Protect Servers and Storage Agents. \\ --- ^^ ^ IBM Spectrum Protect Client Version ^ Supported IBM Spectrum Protect \\ Server and Storage Agent Versions ^ | 8.1.x where x>=2 | 8.1, 7.1 | | 8.1.0 | 8.1, 7.1 | | 7.1.x where x>=8 | 8.1, 7.1 | | 7.1.x where 6>=x>=0 | 8.1, 7.1 | \\ ==== Debugging ==== === Known Issue with unknown libraries === == DSMC not starting == /bin/env LC_ALL=en_US /opt/tivoli/tsm/client/ba/bin/dsmc sched /opt/tivoli/tsm/client/ba/bin/dsmc: error while loading shared libraries: libgsk8ssl_64.so: cannot open shared object file: No such file or directory Check if Library is found and installed: ldconfig -p | grep ssl libssl.so.1.1 (libc6,x86-64) => /lib/x86_64-linux-gnu/libssl.so.1.1 libssl.so (libc6,x86-64) => /lib/x86_64-linux-gnu/libssl.so dpkg -L gskssl64 /. /usr /usr/local /usr/local/ibm /usr/local/ibm/gsk8_64 ... Create /usr/local/ibm/gsk8_64/lib64 and rebuild the ld database: ldconfig