Did you know your VCSA backups have expiration date!!!? OK, same here . I say you more, not all VMware GSS engineers know about this issue!
- Actually what is expiring is a root password in OVF template within VCSA installation ISO! I was also surprised, but VMware terms it “known issue” in their KB51124.
- As a result, you won’t be able to restore your VCSA backups after your release expired!
- The restore procedure will have stuck forever at 80% in the
Restore - Stage 1.
- At the same time if you open the VCSA console, you will see the following errors:
Root password is not set. RPM Installation failed.
- If you will try to restore with any recent ISO (not expired yet) you will get an error message in the
Stage 2stating about version mismatch . Surprised again? Yes, same here .
- The requirement: you must restore with the same ISO build you have backed up!!!
How to prevent?
- How to foresee the VCSA backups expiration? Very simple, just use the updated
Get-VAMISummaryfunction from my VAMI PowerCLi module.
Connect-CisServer VC1, VC2, PSC1, PSC2, VCSA Get-VAMISummary
- At the time of writing, two first VCSA 6.5 releases (
6.5.0a) have already expired .
- The next “Friday 13” will occur at 03-Feb-2018. This is very soon. Four!!! releases will expire – all pre U1 releases.
What am I to do?
- First things of first, foresee the expiration and timely upgrade/patch your appliances. No patch – no VCSA restore!
- In production environments always make one more backup in addition to the free API backup. It may be 3-d party backup solution of your choice or storage based backup.
- There is one solution if your backups nevertheless have expired.
- To work around this issue, we need to backdate the target ESXi host to a time prior to the root expiry date:
- Isolate an ESXi host by vMotioning/migrating all of the VMs off. The best thing is temporarily to remove it from a cluster.
- Change the time on the host to a time prior to the expiry date, for example to 10th April 2014, 10:18 (AM)
esxcli system time set -d 10 -H 10 -m 18 -M 04 -y 2014
- Also, make sure to also set the hardware clock time as the system time will revert to this on a reboot.
esxcli hardware clock set -d 10 -H 10 -m 18 -M 04 -y 2014
- To check the hardware and system time use the following commands.
esxcli hardware clock get esxcli system time get
- Now perform restore of your VCSA expired backup to this ESXi host.
- Change date back to the correct date. You can use previously mentioned
esxcli … getcommands to retrieve correct time from another ESXi host in a cluster.
- I will try to keep my
Get-VAMISummaryfunction updated with every new VCSA release. Just remember periodically to check and download the latest
VAMImodule from my PowerCLi GitHub repo.
Get-Command Get-VAMISummary | Get-FunctionVersion
- The backup expiration related properties are:
Get-Command Get-VAMISummary | Get-Member
- Another tip. You must not, but always add the VCSA release number to the backup folder name, this will save your time at restore.