®

Tivoli Directory Server v6.3 – Part03 of 06

Backup and Recovery

By: Nishant Singhai & Nilesh Patel

Tuesday 31 May 2011 1

 IBM Software Group | Tivoli software

Introduction
Abstract
This STE will cover the backup and recovery of ITDS, using both
command line and GUI methods. In addition we will cover
common errors encountered as well as general debug methods
for analysing issues.

Objectives
Understand the available support resources
Understand how to take backup and recover
Best debugging practices

2
 IBM Software Group | Tivoli software

Agenda
 Before we begin
Important Links
Previous STE’s
Planned STE’s
Overview of Backup and Recovery

 ITDS Backup Utilities

Online/Offline Backup
Full backup

 ITDS Recovery
 ITDS Backup/Recovery Gotchas

3
 IBM Software Group | Tivoli software

Agenda

 ITDS Data Import/Export

 Basic Debugging
Backup/ Recovery Issues

 Maintenance Tasks
ITDS fixpacks
 IBM Software Group | Tivoli software

Important Links

ITDS v6.3 Package information:

https://www-304.ibm.com/support/docview.wss?
rs=767&uid=swg27009778#ver63

6.3 System Requirements:

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?
topic=/com.ibm.IBMDS.doc/sysreq.htm

6.3 Product Documentation:

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?
topic=/com.ibm.IBMDS.doc/welcome.htm

5
 IBM Software Group | Tivoli software

Important Links

Google Newsgroup:
http://groups.google.com/group/ibm.software.ldap/topics?
lnk=gschg&hl=en
Support Site:
http://www-
306.ibm.com/software/sysmgmt/products/support/IBMDirectoryServe
r.html
Tivoli Product Lifecycle Site:
http://www-
306.ibm.com/software/sysmgmt/products/support/lifecycle/
Tivoli Software Global User Group Community:
http://www.tivoli-ug.org/

6
 IBM Software Group | Tivoli software

STE Links

Previous STE’s

 Introduction to IBM Tivoli Directory Server:

https://www-304.ibm.com/support/docview.wss?
uid=swg27021610

 TDS - Schema,ACLs, Password Policy and Secure

Socket Layer
http://www-01.ibm.com/support/docview.wss?uid=swg27021610
 IBM Software Group | Tivoli software

STE Links
Upcoming STE’s

 TDS- Replication:
http://www-
01.ibm.com/software/sysmgmt/products/support/TE/techex_W5175
31B55309Q11.html
 TDS – Proxy, Performance tuning and Troubleshooting:
http://www-
01.ibm.com/software/sysmgmt/products/support/TE/techex_X90032
8J53343I07.html
 TDS Best practices , Ask the experts
http://www-
01.ibm.com/software/sysmgmt/products/support/TE/techex_A38875
5F84976D77.html
 IBM Software Group | Tivoli software

ITDS Backup and Restore

 Tivoli Directory Server provides methods for backing up and
restoring directory server instance information. There are
methods that back up the complete information for a directory
server instance, and methods that back up only the data in the
database.
 Tivoli Directory Server provides two mechanisms for backing up
and restoring complete directory server instance information:
Basic (idsdbback/idsxinst )
Enhanced (ldapexop/WebAdmin)
 These mechanisms can back up not only the directory server
instance data (stored in a DB2 database), but also the
associated configuration and schema files for the directory server
instance.
 Both methods provide the option to perform online or offline
backups.
9
 IBM Software Group | Tivoli software

ITDS Backup and Restore

 Online backups can be performed while the server is running or

stopped; offline backups must be performed while the server is
stopped.

 With either of these two methods, the backups do not back up the
following files, which you must back up separately:
-- idsinstances.ldif
-- SSL related files: keys, key stash files, CRL files
-- Tivoli Directory Integrator solution files

10
 IBM Software Group | Tivoli software

ITDS Backup and Restore

 Basic Backup / Restore Commands:

- Idsdbback
- Idsdbrestore
 Enhanced Backup / Restore Commands:
- ldapexop utility with the extended operations option -op
backuprestore -action backup
- ldapexop utility with the extended operations option -op
backuprestore -action restore
 IBM Software Group | Tivoli software

ITDS Backup and Restore

Basic Vs Enhanced
Feature Basic Method Enhanced Method
Request from Local server Remote or local server
Interface used Instance Administration Tool Web Administration Tool
or the idsdbback and or
idsdbrestore commands ldapexop utility
Backup location Can be taken to a different Provides a way to
location each time; overwrites configure the backup
the previous backup only if location and method that
the backup is performed to will be used for all the
the same location. backups requested
through this mechanism.
Store one or Multiple backups Stores only one backup
multiple at a time and overwrites
backups previous backups when
the new backup is
successfully taken
12
 IBM Software Group | Tivoli software

ITDS Backup and Restore

Basic Vs Enhanced
Feature Basic Method Enhanced Method
Restores Administrator can choose Allows a restore only
from any backup location on from the most current
the disk backup taken
Scheduling One time request that backs Provides the option to
up or restores to a specific schedule backups one
location specified at the time time, daily or weekly.
of the backup
Administrator More required. Administrators Less required. Only one
management must better manage their disk backup location.
space.
Backs up and Backs up and restores DB2 Backs up and restores
restores DB2 configuration parameters and DB2 configuration
parameters database optimization parameters parameters and
database optimization
parameters
13
 IBM Software Group | Tivoli software

Performing ITDS Backup

14
 IBM Software Group | Tivoli software

Performing ITDS Backup

 Depending on how often your data changes it’s advised to do this
form of backup often (for example: changes frequently – daily, or
fairly static – monthly). When the ldif completes it a good idea to
view the data to make sure its valid. It's important to have a test
system to test out the resulting backups.
 An ITDS admin would regularly check the ldif files resulting from
the idsdb2ldif:
 To make sure ldif files are valid (have the right format etc)
 To make sure the ldif files have the complete data set.
 It's important to have a test environment to test out the resulting
backups.
 Please note: you will still need to manually back up all files in
 /<ldap instance home>/idsslapd-<instance name>/etc
(ibmslapd.conf, ibmslapddir.ksf, schema files, etc)
15
 IBM Software Group | Tivoli software

Performing ITDS Backup

 The most important element to a Directory is the data which is

stored within its structure. Regularly backing up this data can be
achieved through a couple of options:
Option 1: Full backup of the data can be achieved with the
idsdb2ldif command.
 This command has two advantages:
- This command can be run while IBMSLAPD is running
- The file can be transferred to any other ITDS 6.3 server which
is cryptographically synced to receive the data.
 idsdb2ldif –I inst_name –o /filesystem/full_backup.date.ldif

16
 IBM Software Group | Tivoli software

Performing ITDS Backup

 Option 2: Included with ITDS is an ITDS utility called: idsdbback.

 Its important to note this utility will back up:

- The instance ibmslapd.conf (The “config” file)
- The instance ibmslapddir.ksf (Key Stash File)
- The database instance.
 To run this you must have ibmslapd stopped:
 idsdbback –I inst_name –k /filesystem/dbbackup

17
 IBM Software Group | Tivoli software

Performing ITDS Backup

 We can verify the idstools.log for success or failure of backup

command.
 Location : <instance_home>/idsslapd-<instance>/<logs>
 For example we can see below message in the log after
executing the command:
 GLPDBB009I Backed up directory server instance 'dsrdbm01'.

18
 IBM Software Group | Tivoli software

Performing ITDS Backup

 To take the online backup with Basic Method (i.e. Using commands
idsdb2ldif and idsdbback), we first need to configure the database for
online backup.
 We can configure database for online backup using below command:
 # idscfgdb -I instance_name -w db_admin_pw -a db_admin_id -t
db_name -l db_location -k backup_dir
 To unconfigure the database for online backup we can use below
command:
 # idscfgdb -I instance_name -c
 Note:
– ‘-c’ is supported only if the online configuration was done through
GUI tools (idsxinst or WebAdmin).
– The -c option must not be used along with the -a, -t, and -l options,
since the database is already configured. However, it can be used
with the -w option.
19
 IBM Software Group | Tivoli software

Performing ITDS Backup

 Configure database for online backup using Instance Administration Tool:
– Open ITDS Instance Administration Tool
– Click on Manage
– Navigate to Backup/Restore => Backup Database
– Browse the Backup Directory
– Check “Update database configuration to support online backup”
– Click on “Backup” to start the online backup for ITDS.

20
 IBM Software Group | Tivoli software

Performing ITDS Backup

21
 IBM Software Group | Tivoli software

Performing ITDS Backup

 We can use below command to verify the backup status:
idsldapsearch –p <admin port> -D cn=admin -w password -s
base -b cn=backup,cn=monitor objectclass=*

 Note: backuponlinedatabaseconfigured will be FALSE until the first

backup is completed successfully.
22
 IBM Software Group | Tivoli software

Performing ITDS Backup

 Backup Using Web Administration Tool

Log on to Web Administration Tool
Navigate to Server administration => Manage
backup/restore
 Using Web Administration Tool we can do following backup
tasks:
1. Check Backup/Restore status
2. Configure directory server backup
3. Schedule directory server backup
4. Perform directory server backup
5. Restore directory server using existing backup files.

23
 IBM Software Group | Tivoli software

Performing ITDS Backup

Check Backup/Restore status

24
 IBM Software Group | Tivoli software

Performing ITDS Backup

Configure directory server backup

25
 IBM Software Group | Tivoli software

Performing ITDS Backup

Schedule directory server backup

26
 IBM Software Group | Tivoli software

Performing ITDS Backup

Perform directory server backup

27
 IBM Software Group | Tivoli software

Performing ITDS Backup

Restore directory server using existing backup files

28
 IBM Software Group | Tivoli software

Performing ITDS Backup

Using idsdbback command:

29
 IBM Software Group | Tivoli software

Performing ITDS Backup

Using ldapexop command:

30
 IBM Software Group | Tivoli software

Performing ITDS Restore

 We have following options to restore ITDS :
Using idsdbrestore command
Using ldapexop command
Using Web Administration Tool
 To perform restore operation ITDS instance must be stopped.
 The restore operation can only be performed by the following
users:
Primary directory administrator
Local administration group member having all of the following
roles: DirDataAdmin, ServerStartStopAdmin,
ServerConfigGroupMember, and SchemaAdmin

31
 IBM Software Group | Tivoli software

Performing ITDS Restore

ITDS restore using idsdbrestore command

32
 IBM Software Group | Tivoli software

Performing ITDS Restore

ITDS restore using ldapexop command

33
 IBM Software Group | Tivoli software

Performing ITDS Restore

 Restore Using Web Administration Tool

1. Log on to Web Administration Tool

2. Navigate to Server administration => Manage
backup/restore => Perform directory server restore
3. Click on “stop server and restore now”
4. Restore status shows the status of restore request.

34
 IBM Software Group | Tivoli software

Performing ITDS Restore

35
 IBM Software Group | Tivoli software

Performing ITDS Restore

 ITDS restore using Instance Administration Tool:

– Open ITDS Instance Administration Tool
– Click on “Manage”
– Navigate to Backup/Restore => Restore Database
– Select the Restore Directory by clicking “Browse button”
– Click on Restore to perform ITDS restore

36
 IBM Software Group | Tivoli software

Performing ITDS Restore

37
 IBM Software Group | Tivoli software

ITDS Backup/Restore Gotchas

 Backups can be online or offline, but a restore requires the server
to be offline.
 The very first backup even for a server configured to use online
backups requires the directory server to be offline.
 Database can be configured for online backup during idscfgdb itself
(-k switch).
 Backup configuration can’t be made on a Proxy Server. Hence, it
won’t be possible to do a remote backup/restore of a proxy server,
through exops or the web admin, and you cannot schedule proxy
server backups.
 A restore will act upon the details provided in dbback.dat. Hence, it
is recommended that if restore is to be used, the backup should be
taken such that it updates dbback.dat.

38
 IBM Software Group | Tivoli software

ITDS Backup/Restore Gotchas

 A restore will replace the server configuration and changed settings

we recommend that the admin server to be restarted.
 Changes to the backup configuration are made to the directory server
but you must request a readconfig extended operation to the admin
server to have the changes take effect.
 Online backups should be scheduled periodically to remove the
inactive log files from DB2.
 Backup paths should be writeable by the instance owners.
 If dbback.dat is not accessible and directory server down, it is
assumed that the database is not configured for online backup.

39
 IBM Software Group | Tivoli software

ITDS Backup/Restore Gotchas

 idsdbback will take an offline backup if –u is specified and it’s the very
first instance of online backup. The directory server needs to be down at
this point of time.
 The –r switch is not used by Admin Server while firing a restore request.
Hence, ibmslapd.conf will always be restored.
 idsideploy won’t copy backup configuration to a newly deployed
instance.
 idsinstances.ldif, ssl files and TDI solution files need a manual backup.
The backup/restore tools won’t act on these files.
 idscfgdb can be used to disable online backup. This is possible only if
the online backup configuration was done through the GUI. It’s
recommended that for better management of online backup/restore
functionality, the GUI be used rather than the command line tools.
Command line tools can be used to fire the backup/restore requests.

40
 IBM Software Group | Tivoli software

ITDS Data Import/Export

 ITDS provides utilities to import or export directory entries.

 We can import/export directory entries in LDIF format i.e. LDAP
Data Interchange Format.
 To export directory entries we can use idsdb2ldif / db2ldif
command.
 To import directory entries from ldif file we can use either idsldif2db
/ ldif2db or idsbulkload / bulkload command.
 Idsbulkload is a faster alternative to idsldif2db.

41
 IBM Software Group | Tivoli software

ITDS Data Import/Export

 Exporting data using command line:

idsdb2ldif -I <instance_name> -o output.ldif
 Below are some common switches that can be used with
idsdb2ldif:
 -s : Allows to export specific subtree
 -j : Indicates that the operational attributes are not to be exported
 -n <filter_DN>: Specifies the DN of filter entry used to filter entries
before adding into output LDIF file

42
 IBM Software Group | Tivoli software

ITDS Data Import/Export

 Exporting data using Instance Administration Tool:

 Launch Instance Administration Tool
 Click on Manage
 Navigate to LDIF tasks >> Export LDIF data

43
 IBM Software Group | Tivoli software

ITDS Data Import/Export

44
 IBM Software Group | Tivoli software

ITDS Data Import/Export

 Importing data using command line:

idsldif2db -i inputfile -I instancename
 Below are some common switches that can be used with
idsldif2db:
 -r [yes|no] : Specifies whether to replicate. The default is yes which
means entries are put into the Change table and are replicated
when the server restarts.
 -g : Specifies not to strip the trailing spaces on attribute values.

45
 IBM Software Group | Tivoli software

ITDS Data Import/Export

 Exporting data using Instance Administration Tool:

 Launch Instance Administration Tool
 Click on Manage
 Navigate to LDIF tasks >> Import LDIF data

46
 IBM Software Group | Tivoli software

ITDS Data Import/Export

47
 IBM Software Group | Tivoli software

ITDS Basic Debugging

 When performing ITDS Backup/Restore or Import/Export, make

sure the command executed without any error message.
 Following logs can be useful to get more details for ITDS
Backup/Restore or Import/Export:
1 ibmslapd.log
2 ibmdiradm.log
3 idstools.log
4 db2cli.log
5 db2diag.log, in case of any database errors.
6 bulkload.log
7 audit.log
8 Backup status file (dbback.dat)
48
 IBM Software Group | Tivoli software

ITDS Basic Debugging

 Enable the trace facility. From the command line, issue the
following command:
ldtrc on
 We can use -d <debug level> option with different utilities.
 This option causes the utility to generate debug output to stdout.
 The <debuglevel> is a bit mask that controls which output is
generated with values up to 65535.
 This parameter is for use by IBM service personnel.
 While performing online backup make sure that offline backup is
already taken for given LDAP instance.

49
 IBM Software Group | Tivoli software

ITDS Basic Debugging

 idsbulkload appears to hang during parsing phase

 For example, if an LDIF file contains 50,000 nested groups with
100 membergroups in each of the nested groups, idsbulkload
might need about 1 to 2 seconds to process each one of the
nested groups during the parsing phase.
 Before executing bulkload make sure that the user has appropriate
permissions.
 In case bulkload fails for some reason, we need to reconfigure the
database as it is in inconsistence state.
 Bulkload fails on AIX 6.1, it need AIX FP1 for successful
completion.
 The idsdbrestore utility displays error messages if the
ldapdb.properties file is modified.
50
 IBM Software Group | Tivoli software

ITDS Basic Debugging

 Bulkload on windows fails with below error message:

GLPBLK030E Run DB2CMD.EXE first, and then run bulkload
within the "DB2 CLP" command interpreter.
 In order to run the command we should do following
> Logon to windows with TDS instance owner.
> Open IBM DB2 Command Window.
> Make sure that current database instance is correct using
command "db2 get instance" from db2 command window. If
current database instance is different then set appropriate db2
instance using command
"set DB2INSTANCE=<instance_name>"
> Execute db2 bulkload command.
51
 IBM Software Group | Tivoli software

Maintenance Tasks

Check existing APARs and apply the latest fix pack

accordingly.
ITDS fixes:
http://www-01.ibm.com/support/docview.wss?
rs=767&uid=swg27009778

52
IBM Software Group | Tivoli software

53
IBM Software Group | Tivoli software

54