Symptoms

An Azure subscription was previously added to the NetWorker server. The NetWorker Web Use Interface (NWUI) does not show any Azure Subscriptions: Attempting to add the Azure subscription back to NetWorker reports that it already exists: The NetWorker server's daemon.log may report: Linux: /nsr/logs/daemon.rawWindows (Default): C:\Program Files\EMC NetWorker\nsr\logs\daemon.raw NetWorker: How to use nsr_render_log to render .raw log files 66113 MM/DD/YYYY HH:mm:SS nsrd NSR critical Failed to retrieve item _azure_AZURE_SUBSCRIPTION_NAME_client secret from lockbox /nsr/lockbox/NETWORKER_SERVER_FQDN/clb.lb The Azure subscription can be seen from an nsradmin prompt on the NetWorker server: Open an elevated prompt on the NetWorker server.Run: nsradminFrom the nsradmin prompt, list the Azure subscriptions: print type: NSR Azure Subscription azure-nve:~ # nsradmin NetWorker administration program. Use the "help" command for help, "visual" for full-screen mode. nsradmin> p type: NSR Azure Subscription type: NSR Azure Subscription; name: SUBSCRIPTION-RESOURCE-NAME; comment: ; tenant id: AZURE-TENANT-ID; subscription id: AZURE-SUBSCRIPTION-ID; client id: AZURE-CLIENT-IDb; client secret: *******; endpoint: management.azure.com; command: nsrazure_discovery; administrator: "user=root,host=azure-nve.local", "user=administrator,host=azure-nve.local", "user=system,host=azure-nve.local", "user=nsrnmc,host=azure-nve.local", nsradmin> quit NOTE: If the Azure subscription is not listed in the NetWorker server resource database (NSRDB), this KB is not applicable. This KB only applies when the resource still exists in the NSRDB but is not shown in the NWUI or NMC.

Cause

There are multiple issues that may cause these symptoms. The NetWorker server's lockbox is corrupted.NetWorker is not able to decrypt the Azure subscription's client secret from the lockbox.The Azure client secret has an expiration period defined when it is created. The expiration date has passed and the client secret used in the NetWorker Azure Subscription resource in no longer valid.

Resolution

WARNING: Only follow this KB if Azure subscriptions exist on the NetWorker server but are not visible in NWUI. If the subscriptions are already visible in NWUI, do not apply this procedure — doing so will break the configuration and cause the subscriptions to disappear from NWUI. On the NetWorker server, create a file called clear_client_secret.txt in a location of your choosing.Add the following contents to the file and save it: . type: nsr azure subscription update client secret: ; y From a root shell (Linux) or Adminstrator command prompt (Windows), stop NetWorker server services: Linux: nsr_shutdownWindows: net stop nsrd Create a copy of the NetWorker server resource database (NSRDB): NOTE: If any issues arise, you can revert to this copy. Linux: cp -R /nsr/res/nsrdb /nsr/res/nsrdb.beforeclientsecretresetWindows: Use Windows File Explorer to create a copy of the resource database folder, default path: C:\Program Files\EMC NetWorker\nsr\res\nsrdb Use nsradmin to import the reset_passwords.txt into the nsrdb. Linux: nsradmin -i clear_client_secret.txt -d /nsr/res/nsrdbWindows: nsradmin -i clear_client_secret.txt -d "C:\Program Files\EMC NetWorker\nsr\res\nsrdb" NOTE: If the clear_client_secret.txt is not in the same directory you are running the command from, you must specify the full path to the file. You must also specify the full path to your nsrdb folder. Example: azure-nve:~ # nsradmin -i clear_client_secret.txt -d /nsr/res/nsrdb Current query set updated resource id 53.0.36.27.0.0.0.0.220.76.162.103.10.164.158.89(186) You will see a "updated resource" line for each Azure subscription configured on the NetWorker server. Open an nsradmin prompt to the nsrdb and update the client subscription for each Azure subscription. Linux: nsradmin -d /nsr/res/nsrdbWindows: nsradmin -d "C:\Program Files\EMC NetWorker\nsr\res\nsrdb" If all Azure subscriptions share the same Azure client secret, perform the following: nsradmin> . type: nsr azure subscription Current query set nsradmin> show name; client secret nsradmin> print client secret: ; name: Azure; nsradmin> update cleint secret: REPLACE_WITH_CLIENT_SECRET cleint secret: CLIENT_SECRET; Update? y updated resource id 53.0.36.27.0.0.0.0.220.76.162.103.10.164.158.89(187) *Repeat confirmation for each subscription* nsradmin> q If there are multiple Azure subscriptions, using different client secrets, perform the following for each Azure subscription: nsradmin> show name nsradmin> print type: nsr azure subscription name: AZURE_SUBSCRIPTION_NAME; nsradmin> . type: nsr azure subscription; name: AZURE_SUBSCRIPTION_NAME Current query set nsradmin> update client secret: REPLACE_WITH_CLIENT_SECRET client secret: CLIENT_SECRET; Update? y updated resource id 53.0.36.27.0.0.0.0.220.76.162.103.10.164.158.89(188) Repeat this for each Azure subscription resource, when done enter q or quit to exit nsradmin. Start NetWorker server services: Linux: systemctl start networker or /etc/init.d/networker startWindows: net start nsrd Monitor the server's daemon.raw for any new lockbox errors: Linux: /nsr/logs/daemon.rawWindows (Default): C:\Program Files\EMC NetWorker\nsr\logs\daemon.raw NetWorker: How to use nsr_render_log to render .raw log files If no lockbox errors are reported regarding the Azure subscriptions, validate that you can refresh the subscriptions from NWUI after service startup.

Support Cases