samba_backup error and restoring old backup files

[Andrew Bartlett]

On Wed, 2014-02-19 at 08:55 +0330, elyad alaei wrote:
> (as there were no answer I sent it for second time)

I'm sorry, there really isn't much more to day. 

> I'll give more details below:
> 
> On Sun, Feb 16, 2014 at 10:47 PM, Andrew Bartlett <abartlet at samba.org>wrote:
> 
> > On Sun, 2014-02-16 at 12:15 +0330, elyad alaei wrote:
> > > To backup the samba database, I stop samba service at 2:00 AM every night
> > > and backup using samba_backup script and re-run samba4 service with the
> > > help of crontab.
> >
> > BTW, the design of the script is to use tdbbackup so as to avoid needing
> > to stop Samba.
> >
> 
> So is it safe to take backup online? as much as I remember, it often failed
> to create "sysvol" and "etc" when I didn't stop samba before running
> samba_backup!

If it failed to create these files, it is because it failed.  Check the
output of the script, you now see errors - these are almost certainly
why it 'missed' these directories, it existed early, but you never
noticed the error code.

> > This implies to me that the script did not run to conclusion, because of
> > an error such as the below:
> >
> 
> But these errors appear after 31 DEC! Before that date, we didn't get such
> errors, the only problem was: sometimes it didn't create "sysvol" and "etc"
> we run samba_backup (either manually or using crontab).
> 
> Isn't there any way to check their (the  "samba4_private" file's)
> integrity?

dbcheck might help, but if tdbbackup fails, then it implies some pretty
serious low level corruption, or some other serious error that needs to
be investigated. 

> > > 2.What if I restore (abit old) backup files of 31 DEC 2013?! Can it couse
> > > any malfunctioning in our existing clients?!
> >
> > Yes, it will cause a roll-back of all domain data, including machine
> > account passwords.
> >
> 
> > > 3.How can I mix old "sysvol" and "etc" backup files with latest
> > > "samba4_private" if it is not curropt?!
> >
> > The main issue would be that any group policy changes would be out of
> > sync between the files and the Active Directory.  If you did not use
> > group policy, then this is less of an issue.
> >
> >
> We have not changed any GP settings since then, so it would not be the
> issue, but our users may have been changed their passwords so we would like
> to use the latest backups, if possible.
> 
> 
> > At this point to assist further I need to understand what the state is
> > of your main database.  Do you still have it?  Does it pass a
> > 'samba-tool dbcheck --cross-ncs'?  Does running the backup script
> > manually work?
> >
> 
> Our domain still is under production and the output of 'samba-tool dbcheck
> --cross-ncs' is:
> Checking 5156 objects
> Checked 5156 objects (0 errors)
> 
> I couldn't understand what do you mean by "Does running the backup script
> manually work"? If you mean, running samba_backup from shell, then yes, the
> errors I mentioned, are given when I run it via shell after stopping samba4
> deamon.

Those errors are a genuine concern.  We need to better understand why
they occur. 

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba