Troubleshooting Rescue Console ACLs in Windows BMR

Bacula Enterprise Only

This solution is only available for Bacula Enterprise. For subscription inquiries, please reach out to sales@baculasystems.com.

Before modifying your ACLs you should ensure that the WindowsBMR procedure works for your setup using *All* for all your ACLs. When you are sure, then you can try to fine tune your ACLs.

Each step in the BMR process requires different ACLs. When you get your clients and the <rescue-fd> listed in the GUI, you know that your CatalogACL and ClientACL are correct. When the list of dates is the expected one, you know that FilesetACL and JobACL are correct, too. If WindowsBMR doesn’t show you the appropriate drive list, this is probably because the PoolACL or the StorageACL are misconfigured.

For finer troubleshooting, it is easier to test some commands in bconsole and look at the result. Before starting bconsole, ensure that you are connected to the director, which is the case if you can get the list of clients in the GUI. Use a command prompt, and type the command below to start bconsole.

X:\Bacula\rescue\executable\bconsole -c X:\Bacula\rescue\executable\bconsole.conf

You must use the full path for the configuration file, a relative path will not work.

Every time you change an ACL in the configuration file, you must reload the configuration from another console using the reload command and restart the bconsole on the rescue client. Don’t forget to re-run the command setip before trying a restore because every reload resets the IP address of the client.

First, test if you have access to the clients using the command ".clients". You must see your <rescue-fd> and all hosts that you want to be able to restore from this console.

Use ".jobs type=R" to list all restore jobs and verify that your <restore-job> is in the list.

Use "list job=<winbmr-job>" to see if you have access to the WindowsBMR job.

Use command "setip" without any argument to tell the director the current IP address of your console. The director will use this address as the one of the corresponding file daemon running on the same machine. If the command fails, check the CommandACL and make sure to use the same name for your console and the file daemon.

To test the PoolACL and the StorageACL, you have to try to restore at least one file. Before that you must be sure that your file daemon is running. Use "status client=<rescue-fd>" to get its status. The file that we will try to restore is the_bacula_rescue_for_windows, which is generated for every WindowsBMR-enabled backup. To list all BMR-enabled backups run "restore client=<host-fd>", in the menu select 2 to get a list of all jobs where a given file is saved, enter the name of the file and then select 13 to cancel the operation.

For example if my host is zwin2003-fd:

*restore client=zwin2003-fd

First you select one or more JobIds that contain files
to be restored. You will be presented several methods
of specifying the JobIds. Then you will be allowed to
select which files from those JobIds are to be restored.

To select the JobIds, you have the following choices:
     1: List last 20 Jobs run
     2: List Jobs where a given File is saved
     3: Enter list of comma separated JobIds to select
     4: Enter SQL list command
     5: Select the most recent backup for a client
     6: Select backup for a client before a specified time
     7: Enter a list of files to restore
     8: Enter a list of files to restore before a specified time
     9: Find the JobIds of the most recent backup for a client
    10: Find the JobIds for a backup for a client before a specified time
    11: Enter a list of directories to restore for found JobIds
    12: Select full restore to a specified Job date
    13: Cancel
Select item:  (1-13): 2
Enter Filename (no path):the_bacula_rescue_for_windows
+-------+-------------------+----------+------+------+-------+------------+
| JobId | Name              | Start    | Type | Stat | Files | Bytes      |
+-------+-------------------+----------+------+------+-------+------------+
| 7     | C:/...for_windows | 11:39:17 | B    | T    | 25250 | 5382372536 |
| 5     | C:/...for_windows | 23:05:07 | B    | T    | 21    | 372705     |
| 3     | C:/...for_windows | 21:14:30 | B    | T    | 25238 | 4853751303 |
+-------+-------------------+----------+------+------+-------+------------+

Here, the name has been truncated for display purposes. The full name is:

C:/Bacula/winbmr/data/the_bacula_rescue_for_windows

Take note of the JobId and the full path of the filename, taking care of the case of each characters. Then use the following command to start a restore :

restore client=<host-fd> restoreclient=<rescue-fd> jobid=<jobid> where=/Bacula/temp file=<full_path>

In a test environment, the full command is:

restore client=zwin2003-fd restoreclient=rescue-fd jobid=7 where=/Bacula/temp file=C:/Bacula/winbmr/data/the_bacula_rescue_for_windows

This last command should confirm that your Storage and Pool ACLs are correct.