Backup & DR : Impossible to add a GCE instance host running a database

[194050192]

Hello everyone,

I have been struggling for the past weeks with Backup & DR and I finally chose to ask for help.

I am currently new to Backup & DR and I am trying to backup a database running on a GCE Instance just for demo purposes. I deployed a management console and a backup appliance (for databases) through Terraform and everything runs smoothly. I then create a GCE Instance and add the firewall rules to both the appliance and the example instance hosting my database. Then, I install the Backup & DR agent on the instance, I copy the secret and add a host on the console using this secret.

And this is where my problem appears : when I try to add the host, the connection is made but I get this error even though my instance has its clock synchronized using NTP (see screenshot attached). Also, my console recognizes the instance (it shows me the Debian version it is running) but the certificate is "Uninitialized".

Has anyone got this issue before ? Please let me know !

Thanks to anyone willing to help

[kensan]

Hi @194050192 ,

Welcome to Google Cloud Community.

A "partial success" in a Compute Engine backup and disaster recovery (DR) operation in Google Cloud Platform indicates that some aspects of the backup or recovery were successful, while others failed. Based on your screenshot the warning reports are:

1. "be sure to provide the correct secret that was generated on this host within the last 2 hours."
2. "Also be sure the clock on the host is synchronized with a reliable NTP source."
3. The "Uninitialized" certificate is a symptom of the registration/handshake not completing successfully, which usually points back to the first two items.

Your Backup & DR host isn't registering correctly, most likely because of an issue with the security secret or a time synchronization problem. Here's how to troubleshoot it:

• Refresh the Secret key:
• On your GCE instance (database server), generate a brand new secret for the Backup & DR agent.
• Immediately copy this new secret and use it in the Management Console to add or update the host. Make sure you copy it perfectly. Old or mistyped secrets are a common problem.
• Sync Clocks Everywhere:
• Confirm that your GCE instance, the Backup & DR Management Console, AND the Backup Appliance all have their system clocks accurately synchronized using NTP. They all need to agree on the time.
• Check Agent & Firewalls:
• Agent Status: Make sure the Backup & DR agent software is running on your GCE instance.
• Firewall Ports: Double-check that all necessary network ports are open between your GCE instance, the Management Console, and the Backup Appliance. Consult the Backup & DR documentation for the correct port list.
• Examine Logs:
• Look at the log files from the agent (on the GCE instance), the Management Console, and potentially the Appliance. These logs often contain more specific error messages that can guide you.
• Restart (If Needed):
• Try restarting the agent service on the GCE instance. As a last resort, consider restarting the Management Console or Appliance.

The 'Uninitialized' certificate is a symptom that the host registration isn't completing. This is usually because the secret you're using is old or incorrect, or there's a time difference between your systems. You'll need to sort out the secret and time sync issues first.

You'll find this guide very helpful for understanding Backup and DR deployment.If you have further questions, please reach out to our Google Cloud Support.

Additional reference about backup and disaster recovery:

• Backup and DR Service for Compute Engine instance backups

Was this helpful? If so, please accept this answer as “Solution”. If you need additional assistance, reply here within 2 business days and I’ll be happy to help.

[194050192]

Hello,

Thank you very much for your very detailed answer !

I finally managed to make it work by using a Shared VPC and I finally have a 'Valid' certificate.

Best regards.

[kensan]

Welcome @194050192, Please accept my answer as "Solution", Thank you.