SCA Book

Part I: Introduction

SEP sesam Release Versions

Release	Version	Release date	Release notes	Specific extension versions	End of support
5.1.0 Apollon V2	5.1.0.14 SP2	April 18, 2024	Apollon V2 Release Notes
	5.1.0.14 SP1	March 27, 2024
	5.1.0.14	March 6, 2024
5.1.0 Apollon	5.1.0.7	July 25, 2023	Apollon Release Notes
	5.1.0.6	June 20, 2023
	5.1.0.5	May 24, 2023
5.0.0 Jaglion V2	5.0.0.15 SP1	March 6, 2023	Release Notes 5.0.0 Jaglion V2 & Service Packs
	5.0.0.15	February 8, 2023
	5.0.0.12 SP1	November 4, 2022
	5.0.0.11	August 22, 2022
	5.0.0.9 SP3	August 4, 2022
	5.0.0.9 SP2	July 21, 2022
	5.0.0.9 SP1	June 30, 2022
5.0.0 Jaglion	5.0.0.4 SP1	March 28, 2022	Release Notes 5.0.0 Jaglion	BSR Pro for Windows 15.4.196 Exchange Recovery Pro 7.6	April 2024
	5.0.0.4	February 28, 2022
	5.0.0.3	December 29, 2021
4.4.3 Beefalo V2	4.4.3.86	July 5, 2021	4.4.3.86 Beefalo V2 Release	BSR Pro for Windows 15.4.196 Exchange Recovery Pro 7.6	August 2023
	4.4.3.84 SP2	December 16, 2020	Beefalo V2 Service Pack Releases (SP1 and SP2)
	4.4.3.84 SP1	October 14, 2020	Beefalo V2 Service Pack Releases (SP1 and SP2)
	4.4.3.79-.84	May 11, 2020 - August 3, 2020	Release Notes 4.4.3 Beefalo V2
4.4.3 Beefalo	4.4.3.70-.72	July 25, 2019	Release Notes 4.4.3 Beefalo	BSR Pro for Windows 5.2 (build 378) Exchange Recovery Pro 7.6	August 2022
4.4.3 Grolar	4.4.3.60-.64	July 23, 2018 - October 29, 2018	Release Notes 4.4.3 Grolar	BSR Pro for Windows 3.1/3.3 Exchange Recovery Pro 7.5	October 2021
4.4.3 Tigon V2	4.4.3.48	December 5, 2017	Release Notes 4.4.3 Tigon V2	BSR Pro for Windows 2.1 Exchange Recovery Pro 7.5	December 2020
4.4.3 Tigon V1	4.4.3.42	August 10, 2017	Release Notes 4.4.3 Tigon	BSR Pro for Windows 2.1 Exchange Recovery Pro 7.5	September 2020
4.4.3	4.4.3.22-.29	September 21, 2016 - April 4, 2017	Release Notes 4.4.3	BSR Pro for Windows 1.5 Exchange Recovery Pro 7.5	January 2020
4.4.2	4.4.2.66-.88	August 6, 2015 - April 27, 2016	Release Notes 4.4.2	BSR Pro for Windows 1.0 Exchange Recovery Pro 7.5	January 2020
4.4.1	4.4.1.14-.48	July 16, 2014 - March 11, 2015	Release Notes 4.4.1	Exchange Recovery Pro 7.5	January 2020
4.2.2	4.2.2.1-.40	June 25, 2013 - August 4, 2014	Release Notes 4.2.2		September 2016
4.2.1	4.2.1.5-.41	July 16, 2012 - January 18, 2013	Release Notes 4.2.1		December 2014
4.0.5	4.0.5.26, 4.0.5.28	February 24, 2012	Release Notes 4.0.5		July 2013
4.0.3	4.0.3.30	July 13, 2011 / September 29, 2011	Release Notes 4.0.3		July 2013
4.0.2	4.0.2.13, 4.0.2.30	June 2011	Release Notes 4.0.2		July 2013
4.0.1	4.0.1.19	November 2010 / May 2011	Release Notes 4.0.1		July 2013
3.6	3.6.4.x	October 2009 / August 2010	Release Notes 3.6		June 2012
3.4	3.4.1.x	August 2008 / October 2009	Release Notes 3.4		December 2010
3.0	3.0.1.xx	2006/2007	Release Notes 3.0		December 2009

Part II: Architecture Overview

SEP sesam Requirements

SEP sesam Requirements/en

Directory layout

Directory Layout/en

Part III: SEP sesam Installation and Configuration

Licensing

Licensing/en==About Installation and Update== 4 4 3 Beefalo:About Installation and Update/en==SEP sesam Quick Install Guide==

The complete SEP sesam environment consists of different modules, which can be combined as needed to implement an optimized backup. The nodules interact with each other via SEP API,s which are also used for interaction with other software.

Essential modules

The essential modules of any SEP sesam environment are: SEP sesam Server, SEP sesam GUI, SEP sesam Remote Device Server (RDS), and SEP sesam Client(s). Each module is installed separately. The SEP sesam environment is managed centrally by the SEP sesam GUI.

Additional modules

SEP sesam also provides additional modules and functionality that enable consistent backup of databases (Oracle, MS SQL, IBM DB2, Informix SAP R/3, etc.), applications (such as SAP), groupware systems, and virtualization environments. Some of these extensions are already part of a Client package, others require a separate license to work. For details on licenses, see Licensing.

General requirements

Use the following checklist before installing SEP sesam to ensure a successful installation.

• Check the latest Release Notes and look for important installation information.
• Ensure that the target computer is running a supported version of Windows or Linux with the latest updates. Check the SEP sesam OS and Database Support Matrix for details. For a list of all supported extensions and their configuration, see Extensions.
• The SEP sesam GUI requires a screen resolution of at least 1920x1080 (full HD). In order to adjust SEP sesam for HiDPI displays, make sure that you use the relevant Java version. To adjust your SEP sesam for high-resolution display, refer to HiDPI Display Support.
• SEP sesam uses name resolution for communication between server and client. You should test the DNS name resolution by simply sending a ping (with long and short name) from the server to the client and back. For details on DNS resolution check, see How to check DNS configuration.
• Make sure that all SCSI devices used are recognised by the operating system on which you install SEP sesam. SEP sesam checks the storage devices connected to the SCSI bus during installation and adds their data to the database. SEP sesam can only see devices that are recognised by the operating system.
• Deactivate or remove the antivirus software before installing SEP sesam components on each computer. Failure to disable active antivirus software may result in a failed, corrupt or incomplete installation. If antivirus software is installed, it is strongly recommended to turn off any on-demand scanning while a backup is running. For more details, see Antivirus Exclusions for SEP sesam.
• It is recommended to disable the firewall to avoid problems during the SEP sesam installation. Once SEP sesam is installed, you can enable the firewall with exceptions for the SEP sesam services.
• For details on the SEP sesam default ports, see List of Ports Used by SEP sesam.
• Check the Windows or Linux specific requirements.

Note

Once you have determined how you want to set up your SEP sesam environment, you can install the necessary components. Note that the installation procedure depends on the platform on which you are installing a SEP sesam package and that Java is required on all systems that serve as SEP sesam Server, SEP sesam GUI Client or SEP sesam Remote Device Server (RDS) when Si3 deduplication is used. For details, see Installing and Managing Java.

After you have installed and configured your SEP sesam components according to your environment, SEP sesam provides free updates from previous versions of SEP sesam to new versions and new features within the maintenance period. During this period you can download patches and bug fixes as well as the latest SEP sesam versions, provided you have a valid license. For details, see Updating SEP sesam.

Microsoft Windows installation

Prerequisites

• Before you start with SEP sesam installation, check the general requirements above.
• Make sure you are logged in as the local administrator or domain administrator.
• For remote access via remote desktop connection (RDC), the RDC administrator needs the same access rights as the local administrator.
• To install any of the SEP sesam components (SEP sesam Server, RDS, Client or GUI), you need an installation file, which you can download from SEP Download Center. Make sure you download the correct file for your processor type.
  • The .Net Framework 4 is required for the SEP sesam Server installation and can be deselected for all other SEP sesam components during installation.
• A SEP sesam Server (including the GUI) and the GUI installation require a Java Runtime Environment (JRE) installed on the system, see Installing and Managing Java and check Java versions.

	Note
	SEP sesam RDS does not have its own installation package. To install RDS, use the SEP sesam Server package.

Installation

SEP sesam provides four installation packages: SEP sesam Client, SEP sesam GUI, SEP sesam RDS and SEP sesam Server (contains the Client and GUI components). You also have the option to install the Server Disaster Recovery feature. In the following installation example, we use the SEP sesam Server installation package without the Server Disaster Recovery feature.

1. Locate the download folder where you saved the SEP sesam installation package and double-click the sesam-srv-<Version_ID>-windows.x<SysType>.exe file to start the installation. Select your installation language and click Next.
2. You can select to install the Server Disaster Recovery feature. In this case the installation procedure is slightly different than described. Click Next.
   
3. Accept the license agreement terms and click Next again.
4. Choose whether you want the SEP sesam services to run under the Standard system account or a Custom user account. It is recommended to give the SEP sesam Server services a Domain user account belonging to the Domain admins and Local administrators groups. After you have selected a user account, click Next.
   
5. Select an installation directory for the program files (including the folders <SESAM_ROOT>\bin and <SESAM_ROOT>\skel) and the application data (including the folder <SESAM_ROOT>\var. This folder requires considerable storage space if you are installing a server). Click Next.
   
   
6. In the next window, select which of the four SEP sesam components you want to install (SEP sesam Server, SEP sesam Remote Device, SEP sesam GUI or SEP sesam Client). After selecting the component to be installed, a pop-up window may appear asking whether available service packs should be installed automatically after successful installation. You can also select additional features, such as SEP sesam BSR Pro or PostgreSQL.

   	Note
   	SEP sesam recommends using PostgreSQL for complex enterprise environments with many tasks, high performance expectations (due to PostgreSQL's ability to support multiple concurrent writers and read/write at fast speeds), and security and authentication requirements. Upgrading from SQLite to PostgreSQL is currently not supported, except with the help of SEP support.

   
   

   	Tip
   	The SEP sesam Server package already includes all other components. If you install a Remote Device Server (RDS), you can also include a GUI. If you install a GUI, you can also include the Client.

   After you have selected a component, click Next.
7. Choose if you want to download and install SEP sesam Service Packs (if available) after the installatation is completed.
   
8. Depending on which components you install, proceed accordingly:
   • If you are installing the SEP sesam Server, click Install and then Finish to complete the installation.
   • If you are installing the Server Disaster Recovery feature, select the external database file that will be used for Disaster Recovery.
     
   
   • If you are installing the SEP sesam RDS, the SEP sesam GUI or the SEP sesam Client, enter the name of the SEP sesam Server (in the example below, the name of the server is Informatix).

   	Note
   	You must enter the hostname and not the IP address of the SEP sesam Server. The server name may not contain underscores.

   
   

9. Click Next. The firewall information dialog is for informational purposes only. Take note of the information and click OK. Click Install to install the selected SEP sesam component and then click Finish to complete the installation.

If you have problems or questions about the installation, also see FAQ: Installation and configuration.

Linux

SEP sesam provides RPM packages for the most common Linux distributions (for example, SuSE and RedHat) and DEB files for Debian Linux distributions. The latter run on most Debian-based distributions, such as Ubuntu. For details on SUSE- and RedHat-based distributions, see RPM Repository. For more information on Debian packages, see Debian Repository.

Prerequisites

• Before you start with SEP sesam installation, check the general requirements above.
• Make sure you are logged in as the root user.
• To install any of the SEP sesam components (SEP sesam Server, RDS, Client or GUI), you need an installation file, which you can download from SEP Download Center. Make sure you download the correct file for your processor type.
• SEP sesam packages do not include PostgreSQL and Java Runtime Environment; you have to install PostgreSQL and Java manually prior to installing SEP sesam. For details, see Installing PostgreSQL, Installing and Managing Java and Java Compatibility Matrix.

SEP sesam Server installation

SLES-based distributions

SLES includes the standard tool zypper, which is common for package management. With this tool packages can be installed (and uninstalled) via the command line. Before you install any of the SEP sesam components (e.g., Server, Client or GUI), make sure you have properly configured the RPM repository for SLES-based distributions. For details, see RPM Repository.

The SEP sesam Server package includes all dependencies needed for the standard SEP sesam Server installation. For details on the supported SLES versions, see SEP sesam OS and Database Support Matrix.

On SLES 15 (SP1 through SP4) it may be required to activate the following package modules prior to SEP sesam installation to meet all required dependencies for the SEP sesam Client packages:

Module-Basesystem
Module-Server-Applications
Module-Legacy

These modules are part of the installation DVD; in case no online subscription is available, they can be added via:

zypper ar dvd:/Module-Server-Applications DVD-Server 
zypper ar dvd:/Module-Basesystem DVD-BASE
zypper ar dvd:/Module-Legacy DVD-Legacy 

On SLES12 it is recommended to install the required Java packages before installing SEP sesam Server to avoid possible installation errors. Use the following command sequence:

zypper install java-11-openjdk

To install or update the SEP sesam Server, use the following command:

# zypper install sesam_srv<version.OS.system_type>

	Tip
	To perform a simple update without adjusting the dependencies of the installed SEP sesam version, e.g., on SLES11, you can use the command rpm -Uvh (only recommended for advanced administrators!). Alternatively, update the server with the above zypper command.

RHEL/CentOS-based distributions

All RHEL- and CentOS-based distributions include the standard yum tool, which is common for package management. This tool can be used to install (and uninstall) packages from the command line. Before you install any of the SEP sesam components (e.g., Server, Client or GUI), make sure you have properly configured the RPM repository for RHEL-based distributions. For details, see RPM Repository.

The SEP sesam Server package includes all dependencies needed for the standard SEP sesam Server installation. For details on the supported RHEL/CentOS-based versions, see SEP sesam OS and Database Support Matrix.

To install the SEP sesam Server, use the following command:

# yum install sesam_srv<version.OS.system_type>

	Note
	On RHEL, the SEP sesam installation changes the permissions of /var/run/postgresql to grant PostgreSQL access rights to SEP sesam users.

Debian-based distributions

The Debian-based distribution (Debian/Ubuntu/UCS) includes the standard tool apt-get which is common for package management. With this tool packages can be installed (and uninstalled) via the command line. Before you install any of the SEP sesam components (e.g., Server, Client or GUI), make sure that you have properly configured the Debian repository. For details, see Debian Repository.

The SEP sesam Server package includes all dependencies needed for the standard SEP sesam Server installation. For details on the supported Debian-based versions, see SEP sesam OS and Database Support Matrix.

To install the SEP sesam Server, use the following command:

root@hostname#: apt-get install sesam-srv

Use the following command to install *.deb files:

dpkg -i sesam-srv<version.system_type>.deb

	Note
	Installing SEP sesam on Debian and Ubuntu requires additional steps. For details, see Debian Repository.

SEP sesam Client installation

	Note
	As the SEP sesam GUI already contains the client components, the SEP sesam Client package cannot be installed in addition to the GUI.

To install the SEP sesam Client, select the download folder where you have saved the SEP sesam Client installation package.

• For SLES-based distributions, use the following command:

# zypper install sesam_cli<version.OS.system_type>

• For RHEL (Red Hat Enterprise Linux), use the following command:

# yum install sesam_cli<version.OS.system_type>

• For Debian-based distributions, use the following command:

root@hostname#: apt-get install sesam-cli

Use the following command to install *.deb files:

dpkg -i sesam-cli<version.system_type>.deb

	Note
	Installing SEP sesam on Debian and Ubuntu requires additional steps. For details, see Debian Repository.

Run the following command on the SEP sesam Client to grant access rights to the SEP sesam Server and allow it to contact and back up the client:

/opt/sesam/bin/sesam/sm_setup set_client <SEP sesam Server Name>

If you have problems or questions about the installation, see FAQ: Installation and configuration.

SEP sesam GUI installation

The SEP sesam GUI package is intended for managing the SEP sesam Server from another computer.
Note: As the GUI component is already included in the SEP sesam Server package, it cannot be installed additionally on the SEP sesam Server.

To install the SEP sesam GUI, select the download folder where you have saved the SEP sesam GUI installation package.

• For SLES-based distributions, use the following command:

# zypper install sesam_gui<version.OS.system_type>

• For RHEL (Red Hat Enterprise Linux), use the following command:

# yum install sesam_gui<version.OS.system_type>

• For Debian-based distributions, use the following command:

root@hostname#: apt-get install sesam-gui

Use the following command to install *.deb files:

dpkg -i sesam-gui<version.system_type>.deb

	Note
	Installing SEP sesam on Debian and Ubuntu requires additional steps. For details, see Debian Repository.

On KDE and Gnome, the installation creates a link on the root user's desktop to start the GUI. This link must point to the correct SEP sesam Server. Open the link properties and add the following parameter to the command line:

-S <SEP sesam Server Name>

If you have problems or questions about the installation, see FAQ: Installation and configuration.

To start the SEP sesam GUI, use the following command:

/opt/sesam/bin/gui/sesam_gui -S <hostname_backup_server>

AIX

For information on supported AIX versions and AIX-related available components, see SEP sesam OS and Database Support Matrix.

Prerequisites

• To install any of the SEP sesam components (SEP sesam Server, RDS, Client or GUI), you need an installation file, which you can download from SEP Download Center. Make sure you download the correct file for your processor type.

• SEP sesam packages do not include PostgreSQL and Java Runtime Environment; you have to install PostgreSQL and Java manually prior to installing SEP sesam. For details, see Installing PostgreSQL, Installing and Managing Java and Java Compatibility Matrix.

• Before you start with SEP sesam installation, check the general requirements above.
• Make sure you are logged in as the root user.
• The installation of the SEP sesam component for AIX (either the SEP sesam Client or the Remote Tape Server can be installed, depending on availability) requires special RPM packages to be installed using the standard RPM package manager (part of the AIX standard installation). You can download the SEP sesam RPM packages from SEP Download Center and the required prerequisites from: http://www.oss4aix.org/download/ (openssl and readline) and copy them to the AIX system to /tmp/rpm-packages/. Then install the package via RPM:

cd /tmp/rpm-packages/
rpm -i *

	Note
	For AIX version 7.02, the following folder must be created for sm_ssh to work: mkdir -p /opt/freeware/lib/gcc/powerpc-ibm-aix7.1.0.0/4.8.3/

• The SEP sesam GUI requires Java Runtime Environment to be installed on the system. For details on the required Java version, see the Java Compatibility Matrix.

SEP sesam Remote Tape Server or Client installation

1. Download the relevant SEP sesam package from SEP Download Center and copy it to the /tmp directory on your AIX system. The following example shows the installation of the sesam_rts package. The procedure for installing the SEP sesam Client is slightly different; the name of the package is substituted with sesam_cli.
2. Unzip the archive by using the following commands:

    gunzip sesam-rts-<version>-aix_powerpc.tgz
    tar -xvf sesam-rts-<version>-aix_powerpc.tar

   A new directory sesam_rts_<version> is created:

    # tar -xvf sesam-rts-4.4.2.58-aix_powerpc.tar 
    x sesam_rts_4.4.2.58
    x sesam_rts_4.4.2.58/aix_rts.4.4.2.58.tgz, 22440192 bytes, 43829 media blocks.
    x sesam_rts_4.4.2.58/sm_setup, 2168068 bytes, 4235 media blocks.

3. Change to the unzipped directory

   cd sesam_rts_<version>

4. Execute the setup executable sm_setup as root user:

    # cd sesam_rts_<version>
    # ./sm_setup

5. Follow the wizard and select the relevant components you want to install, tapeserver or client, respectively:

    # ./sm_setup
    Found 1 valid archive(s): 'aix_rts.4.4.2.58.tgz,'.
    What do you want to install? (tapeserver,client)
    tapeserver

6. Set the installation directory; the recommended location for installing sesam is /opt/sesam. Make sure that there is at least 10 GB of free disk space available. Optionally, choose another installation directory that has enough free space:

    In which directory do you want to install (If not existing it will be created): 
    /opt/sesam/
    In which directory do you want to install (Read-Write): 
    /opt/sesam/

7. Specify the SEP sesam Server hostname in your environment; you must provide the DNS hostname of your backup server. The DNS Server must be correctly resolved on the AIX system. For details, see How to check DNS configuration.

    To which SEP sesam Server should be connected?
    backupserver.hostname

Once you specify all the required information, the SEP sesam software installation and configuration start. If you have problems starting the SEP sesam services, check the Troubleshooting Guide.

Mac OS X

Prerequisites

• Before you start with SEP sesam installation, check the general requirements above.

• Make sure you are logged in as a local administrator or domain administrator.

• If you want to install a GUI, the Java Runtime Environment must be installed on the system. For details on the required Java version, see the Java Compatibility Matrix.

Steps

SEP sesam does not provide a dedicated MAC OS package. You should download the latest SEP sesam Linux GUI package from SEP Download Center, copy it to your MAC system and extract it with the command:

 ar x <sesam-gui_4.4.3-xx.lenny_i386.deb> && tar xfz data.tar.gz

Copy the extracted directory to your program files directory; then use the <SESAM_BIN>/gui directory:

/opt/sesam/bin/gui/sesam_gui -S <hostname_backup_server>

Or, if your backup server is a Linux system, you can connect via the command line (X must be enabled) and start the GUI:

/opt/sesam/bin/gui/sesam_gui -S <hostname_backup_server>  

The SEP sesam for Mac OS X supports standard file backups with ACLs. Disaster recovery is not supported!

If you have problems or questions about the installation, see FAQ: Installation and configuration.

Univention UCS

For the list of supported Univention UCS versions and available SEP sesam components for UCS, check SEP sesam OS and Database Support Matrix.

Prerequisites

• Before you start with SEP sesam installation, check the general requirements above.

Installing SEP sesam on UCS

You can install SEP sesam on UCS by using any of the following options:

Option 1: Installing via the Univention App Center (only the SEP sesam Server and Client)

1. Open the Univention Management Console in your browser.
2. Go to Software -> App Center.
3. Search for SEP sesam.
4. Install either SEP sesam Server or SEP sesam Client.

Option 2: Installing via the SEP Debian Repository

1. Open a terminal session as root user.
2. Enable Univention unmaintained repositories with the following command (this enables the UCS system to install the dependencies for SEP sesam):

   ucr set repository/online/unmaintained=yes

3. Add the SEP Debian Repository as described in Debian Repository:
   • UCS 4.2 is based on Debian 8 Jessie.
   • UCS 4.3 is based on Debian 9 Stretch.
4. Update the repositories by using:

   apt update

5. Install the SEP sesam package via apt: For example, to install the SEP sesam Server package, use

   apt install sesam-srv

   Other options are listed here: Debian Repository.

Option 3: Installing manually

1. Open a terminal session as root user.
2. Enable Univention unmaintained repositories with the following command (this enables the UCS system to install the dependencies for SEP sesam):

   ucr set repository/online/unmaintained=yes

3. Download the desired installation package from the SEP Download Center.
   • UCS 4.2 is based on Debian 8 Jessie.
   • UCS 4.3 is based on Debian 9 Stretch.
4. Update the repositories by using:

   apt update

5. Install the SEP sesam package via apt:

   apt install /path/to/downloadedpackage

Configuring UCS firewall

By default, the Univention firewall is included in all UCS installations, with all incoming ports blocked. You have to enable access to certain ports for SEP sesam to work.

	Note
	Installing a SEP sesam App Center package automatically opens the required ports for SEP sesam, except for Si3 Replication and REST API.

Disable UCS firewall

You may consider disabling the UCS firewall completely by setting the Univention Configuration Registry variable security/packetfilter/disabled to true:

ucr set security/packetfilter/disabled=yes
service univention-firewall restart

Use SEP sesam with enabled UCS firewall

Check the list of required ports for SEP sesam: List of Ports Used by SEP sesam.

To open a port or a range of ports, use the following commands:

ucr set security/packetfilter/tcp/portnumber_or_portrange/all=ACCEPT
service univention-firewall restart

Client firewall settings

If you want to back up a client behind a firewall using STPD, you have to specify an open port range in the client's STPD Options as follows:

• Open SEP sesam client Properties and switch to the Options tab. If you have installed a client from the App Center, the port range is 11002-11007.

For more information on client configuration, see Configuring Clients.

Updates

After you have installed and configured your SEP sesam components according to your environment, SEP sesam provides free updates from previous to new versions and features of SEP sesam within the maintenance period. During this period, you can download bug fixes, patches, service packs, and the latest SEP sesam version(s) if you have a valid license.

SEP generally recommends upgrading the SEP sesam Server and Client components to the latest version as part of the regular upgrade process. For the complete list of releases, see SEP sesam release versions.

	Note
	You always have to update the SEP sesam Server first before updating the client software. For more information about SEP sesam software updates, see Updating SEP sesam.

• Installing either Windows or Linux-specific distributions is pretty straightforward. For Linux systems, SEP provides special service pack executables that ease the installation of service packs and patches; see Applying Service Packs on Linux.
• The update of SEP sesam extensions, e.g., BSR Pro for Windows, can be done automatically during the SEP sesam update process.
• SEP may ask you to install a specific update (i.e. fix, patch or service pack) to address a specific issue. To get instantly notified about SEP sesam vulnerabilities and updates, click to subscribe to the SEP sesam RSS feed.

Updating methods and settings

There are a number of options available for updating SEP sesam software.

Install/Update options in GUI

You can set up your server to automatically check, download and install updates or decide to do it manually, you can update all clients within the location at once or select to update only OS-specific clients (Windows/Linux update), you can exclude a particular client from being updated, etc. For details, see Updating SEP sesam.

CLI command sm_update_client

You can perform all of the mentioned options above by using sm_update_client. The sm_update_client command implements all the features of the sm_update_client, as well as the previously used sm_remote_installer and sm_config_client commands that have been deprecated. For details, see Updating SEP sesam Using CLI.

SEP sesam release cycle

The approximate release frequency of SEP sesam software is once a year for a major release, followed by a minor release that includes all previous fixes and also introduces new features and functionality.

SEP sesam provides executable service packs that ease the installation of service packs and patches. Service packs are cumulative and contain all released bug fixes for the corresponding SEP sesam version. Download and installation of service packs are pretty straightforward on Windows and Linux. For Linux, SEP provides special executable service packs that ease the installation of service packs and patches, see Applying Service Packs on Linux.

Remote Installation of Windows Clients

4 4 3 Beefalo:Remote Installation of Windows Clients/en==Applying Service Packs on Linux== Applying Service Packs on Linux/en==Checking Access State== 4 4 3 Beefalo:Checking Access State/en

How to check DNS configuration

How to check DNS configuration/en

Part IV: SEP sesam Processes and Commands

How to start and stop SEP sesam

Useful SEP sesam Commands/en

Part V: Using Storage Devices

Configuring Loaders and Drives

4 4 3:Configuring a Loader/en==Configuring a Data Store== Configuring a Data Store/en==Configuring Si3 Deduplication Store== SEP sesam v. 5.0.0 Jaglion has introduced a new generation Si3 data store. It offers significantly increased performance for backup, restore and migration, as well as direct backup to S3, resulting in improved performance, scaling and resource savings.

• The new Si3 can detect duplicate data fragments, optimizing the recovery process.

• It enables you to back up your data to S3 cloud storage and Azure (≥ Jaglion V2), and restore the items you want directly from there.

• Si3 supports any direct attached disk (except NSS and MooseFS volumes, see Restrictions), provides global deduplication with source-side (Si3S) and target-side (Si3T) deduplication, replication and encryption, and enables single file restore (SFR) and instant recovery.

• When configuring deduplication, you should consider the performance factors of deduplication. These include infrastructure (storage types), network speed, storage disk set up, achievable deduplication ratio, etc. For details, see Deduplication.

• The new immutable storage feature (introduced in Jaglion V2) is also based on Si3 store (set up on a dedicated Linux server). SiS is SEP Immutable Storage, based on the File Protection Service (FPS), which scans the file system and sets the immutable bit for all new objects. This means that all data stored in SiS is marked immutable at the time of storage. Even with full admin access to the SEP sesam backup server, attackers cannot delete, modify, or encrypt data stored on SiS. For details, see SEP Immutable Storage – SiS.

Seeding Si3 deduplication store is currently not supported (see the Si3 V1 and Si3 comparison section below).

How to upgrade from the old Si3 V1 to the new Si3?

SEP sesam does not support a direct upgrade from the old Si3 V1 to Si3. However, to use the new Si3 you can:

• Back up all data again to the newly configured Si3 deduplication store.

• You can create a replication job to replicate from the Si3 V1 to the Si3 store. Replication reads all data from the source-side store on the source-side RDS and sends it to the target store using the source-side deduplication function. For details, see the section Replicating from Si3 V1 to Si3.

	Tip
	You can also configure a new Si3 and an old Si3 V1 in parallel on the same host by enabling the key enable_gui_allow_multi_dedup.

Deduplication types

SEP sesam provides target-based (Si3T) and source-based deduplication (Si3S). For details on the deduplication concept and recommendations, see Deduplication.

• Both Si3T and Si3S require a configured Si3 deduplication store.

• In general, only one Si3 V1 or Si3 deduplication store can be configured on a server. There is only one exception to this rule: You can use the enable_gui_allow_multi_dedup key to configure both Si3 deduplication store types on the same backup server or RDS to perform a smooth upgrade from Si3 V1 to Si3.
• A valid licence is required for each Si3 deduplication store.
• You can also configure an Si3 deduplication store via a command line. For details, see Configuring and Administering Si3 Deduplication Store with CLI.

SEP sesam support for S3-compatible cloud and Blob storage

With SEP sesam Si3, you can back up your data directly to the S3 cloud and to Azure Blob storage (≥ Jaglion V2). As S3 is an open API standard and AWS Simple Storage Service is a sample implementation of the standard, SEP sesam Si3 can also be used with other S3-compatible cloud implementations. The configuration and management of Si3 in an S3-compatible cloud implementation is similar to the example shown in Backup to S3 Cloud Storage and must follow the same process and rules provided for using Si3 with S3. For more details, see Backup to S3 Cloud Storage. For the list of supported object storage, see the support matrix.

	Warning
	In Azure, read access carries higher costs. Tasks such as housekeeping, consistency checks, and restores will incur higher expenses. Consider this when planning your operations.

Updating Si3 on S3 from 5.0.0.4 to the new version

If you use Si3 on S3 and update from 5.0.0.4 to the new version, the structure of the existing stores will change as the structure of Si3 on S3 is automatically recreated (this includes recreating the index after the renaming). Example:

• The S3 bucket is called seps3, the Si3 deduplication store name is newNG. The S3 structure with version 5.0.0.4 of NG is: seps3/pages; seps3/pages-trash; seps3/objects-trash.
• When updating to the next version of NG, the structure changes to: seps3/newNG/pages; seps3/newNG/pages-trash; seps3/newNG/objects-trash. During this renaming, the Si3 service is not available.

Prerequisites

• For the minimum Si3 hardware requirements that apply to SEP sesam Si3 deduplication server, see Hardware requirements.

• For details on the required Java version, see Java Compatibility Matrix. Si3 is not mandatory, so there is no dependency rule for it in the RPM/DEB packages.

• When estimating the maximum size of a deduplication store, you have to ensure that there is enough space available for dedup trash, otherwise the deduplication store will run out of space. You should calculate the required disk space based on a representative sample of your full backup and add the additional storage space equal to approximately 50% of the representative full backup.

Required additional amount of RAM

The following table shows the required additional amount of RAM for the Si3-NG data store. The TB value corresponds to the capacity of the Si3-NG data store.

	Note
	These requirements relate solely to the need for deduplication. In addition to these requirements, the amount of memory for the operating system and other services should be taken into account.

Si3-NG data store capacity (check initial size limit)	RAM
<20 TB	16 GiB
20-40 TB	32 GiB

You can use the following command (from the admin command line) to find out how much RAM is needed at what capacity of Si3. Note that you need to set the sesam profile to run the command: sm_dedup_interface -T dedup2 propose jvmconfig <Si3-CAPACITY>

Required additional amount of CPU cores

The following table shows the number of CPU cores required for a Si3 data store. The TB value is the amount of data backed up (before deduplication)!

Backed up data (before dedup)	CPU cores
10 TB	4
20 TB	4
40 TB	8

Performance tip

Applies to Windows only: SEP AG recommends using the High performance power plan to increase the performance of your backup. Note that Windows sets all computers to the Balanced power plan by default and you must manually switch to the High Performance power plan. This way, your Windows computer will use more power, but the systems with Si3 will always operate at the highest performance level.

• From the Start menu, go to Control Panel -> System and Security -> Power Options and change the setting to High performance.

Restrictions

• Si3 deduplication store is not supported for NSS and MooseFS volumes.
• To avoid problems resulting from the combination of excessively large Si3 deduplication stores and inefficient hardware, the maximum initial Si3/Si3-NG deduplication store size is currently limited to 40 TB. Please contact SEP sesam support if your specific requirements are different.
This limitation applies to the creation of a new Si3 deduplication store in the GUI.

Note

It is recommended to run Si3 deduplication (SEP sesam Server or RDS) on the physical host. It is also possible to run it on a virtual machine. In this case, take into account that deduplication consumes a lot of server resources for reading, processing and writing the deduplicated data, as well as for some other deduplication tasks such as housekeeping and various checks. These tasks require a large amount of IO and a large amount of memory. Si3 performance can be affected by other VMs running on the same host. Therefore, if you are running Si3 on a VM, you should be aware of possible bottlenecks and shortcomings.

Configuration procedure

The SEP sesam data store is a disk based storage that allows savesets (backed-up data) to be backed up directly to configured storage locations, including S3 cloud storage and Azure. Note that configuration procedure for the latter differs from the one described below. For details, see Backup to S3 Cloud Storage and Backup to Azure Storage.

Enable Si3 setup on the same host

To make the upgrade from Si3 V1 to Si3 smoother, you can configure a new Si3 and an old Si3 V1 on the same backup server or RDS by using the enable_gui_allow_multi_dedup key.

1. Open the global settings in the GUI: In the menu bar, click Configuration -> Defaults -> Settings.
2. Set the key value of enable_gui_allow_multi_dedup to 1.

Configure Si3

SEP Si3 target deduplication is easy to configure and ready to use by selecting the Si3 deduplication data store type. Note that Si3 deduplication store is not supported for NSS and MooseFS volumes. For other limitations, see Restrictions.

	Tip
	Si3 store can also be used to back up your data directly to S3 cloud or Azure. In this case, the configuration is slightly different depending on the type of storage cloud. For more information, see Backup to S3 Cloud Storage and Backup to Azure Storage.

1. In the Main selection -> Components, click Data Stores to display the data store contents frame.
2. From the Data Stores menu, select New Data Store. A New Data Store dialog appears.
3. Under Data store properties, enter a meaningful name for the Si3 deduplication store in the Name field. Entering the name also creates the name of the drive group for your Si3 deduplication store in the Create new drive group field.
4. From the Store type drop-down list, select SEP Si3 NG Deduplication Store.


5. Ensure that the Create drive option is enabled under the Drive parameter properties. The predefined value for the drive is automatically entered in the Drive number field.
It is recommended to also activate the option Create second drive. Without this option, SEP sesam can only assign one drive for either reading or writing, with one job on the same drive at a time. If you use the additional dedicated drive for restore, you can perform a backup on the first drive and restore your data from the second drive simultaneously. You can also add a third drive for migration. (See section Drive access mode.)
6. The name in the Create new drive group is already created. You can change it by simply entering a new name.
7. The predefined number of channels is already available in the Max. channels drop-down list. The number of available channels depends on your SEP sesam Server package. For details on licensing, see Licensing.
8. From the Device server drop-down list, select the device server for your data store.
9. In the Path field, enter the location of your data store or use the Browse button to select it. Click OK.
   If you use the Browse button, the New Data Store information window appears with predefined recommended values for the size of your Si3 deduplication store. Click OK to confirm the selected location and recommended size values. You can change the size of your Si3 deduplication store later under Size properties (see section Size properties).

After configuring the Si3 deduplication store, configure the media pools first then set up your backup strategy. Make sure to test your newly created Si3 store by running a test backup on it.

Run a test backup on Si3

1. Create a new backup task: In the Main Selection -> Tasks -> By clients, select your RDS client and then click New Backup Task. Configure your backup task and save it. For details, see Creating a Backup Task.
2. Test the backup on the newly created Si3 store: From the menu bar, select Activities -> Immediate start -> Backup. In the Immediate start: Backup dialog, select the previously created media pool for Si3 as the target media pool for the backup. Click Start and check if your backup was successful by viewing the status of your backup job in the GUI (Monitoring -> Last Backup State or Job State -> Backups) or SEP sesam Web UI – Last backup state.

Now you can create different backup tasks to apply deduplication and enable the best possible scenarios for efficient backup in different environments. For details on how to select your deduplication method, see Deduplication. For details on how to configure a backup job, see Standard Backup Procedure.

Replicating from Si3 V1 to Si3

As SEP sesam does not support a direct upgrade from the old Si3 V1 to the new Si3, you can create a replication task to replicate from Si3 V1 to the Si3 store. Replication reads all data from the source-side store on the source-side RDS and sends it to the target store using the source-side deduplication function. Once your new Si3 is set up, you should configure regular replication.

Configure a replication task

To configure a replication from Si3 V1 to Si3, proceed as follows.

1. Create a replication task: In the Main selection -> Tasks -> Replication Tasks, click New Replication Task. The New Replication Task window is displayed.
2. In the Name field, enter a name for the replication task, e.g., Si3-2-Si3NG.
3. Enter the following information under Parameters:
   • Media pool
   • Pool: Select the name of the source media pool of the Si3 deduplication store from which the data will be replicated.
   • Drive: Select the drive number of the drive to be used to read the data.
   • Interface: Optionally, specify the network interface of the RDS to be used for data transfer.
   • Destination
     • Pool: Select the name of the target media pool you previously created for the new Si3 and to which the data will be replicated.
     • Drive: Select the drive number of the drive that will be used to write the data.
     • Interface: Optionally, enter the network interface of the RDS to be used for data transfer, e.g., the name of the RDS.
   • Leave the Relative backup date (From) set to -99,999 and To set to 0.
   • In the drop-down list based on, the Sesam days option is selected by default.
   
   
4. Click Save to save your replication task.

After you have configured a replication task, start replication as follows.

Start replication

Note that any initial replication requires a large amount of CPU, network bandwidth and time to complete successfully.

Start replication manually as follows:

1. In the GUI menu, select Activities -> Immediate start -> Replication.
2. In the Immediate Start: Replication window, from the Task name drop-down list select the replication task you created earlier, e.g., Si3-2-Si3NG, and click Start.

Si3 data encryption

To configure Si3 data encryption, you have to create a security password for deduplication:
Main selection -> Components -> click Data Stores -> select your Si3 deduplication store and double-click it, then double-click the first drive of your Si3 deduplication store.
In the Encryption password field, specify the encryption password and repeat it.

For details, see Encrypting Si3 Deduplication Store.

Si3 deduplication store size properties

To change data store size properties, go to Main selection -> Components -> click Data Stores -> select your Si3 deduplication store and double-click it. Then under Size properties specify or modify the following:

• Capacity: Specify the size (in GiB) of the partition for backups.
• High watermark: Specify the value (in GiB) for the high watermark (HWM). The HWM defines the upper value for the used storage space. When this value is reached, the status of a datastore changes from OK to Warning, but backups continue to be performed. Make sure that you provide enough storage space for your backed up data.
• Si3 repair area: Specify the value (in GiB) for the Si3 repair area. The Si3 repair area (subdirectory trash) defines the space for Si3 files that were identified by a garbage collection job and are no longer used. These files are still kept in the repair area to allow for a possible repair of Si3 in case of structural problems (which may be caused by a file system error or an operating system crash). The files in the repair area are automatically removed after the specified period of time (SEP sesam default: 4 days) or when the disk usage threshold is reached. The Si3 repair function is disabled when the value is set to 0.

	Note
	The Si3 repair area for managing the disk space allocated for Si3 files is available only in advanced UI mode (formerly expert GUI mode). To see the Si3 repair area field, make sure your UI mode is set to advanced. For details, see Selecting UI mode.

The Disk space usage properties are used by SEP sesam to report the following:

• Used: Total used space (in GiB) on the partition.
• Total: Maximum available space (in GiB) on the partition as reported by the operating system.
• Free: Available disk space (in GiB) for SEP sesam.
• Deduplication rate: Deduplication takes place as soon as the backup process has started. SEP sesam analyses blocks of data and determines whether the data is unique or has already been copied to the Si3 data store. Only single instances of unique data are sent to the data store and replace each deduplicated file with a stub file. The deduplication ratio indicates the extent of data reduction achieved by Si3 deduplication, i.e. the ratio between the protected size of data and the actual physical data size stored. A ratio of 10:1 means that 10 times more data is protected than the physical capacity needed to store it. The deduplication ratio depends greatly on the deduplication method used (si3T or Si3S), the type of data, the backup level used (the deduplication ratio is higher when there are copy and full backups and when there is a larger amount of data), etc. For details, see Deduplication.

Monitoring deduplication status

You can view the status of your of your Si3 deduplication in the GUI (Si3 deduplication store properties -> Si3 State tab) or SEP sesam Web UI. The data store status overview provides detailed information about consistency, utilization, sanity status, size, disk space usage as well as related media pools, media and drives, dependencies, data size before/after deduplication, etc.

Note

If fsck (file system consistency check) detects irregularity in the Si3 file system, the affected pages and chunks are recorded in the recovery.log. The Si3 deduplication store in GUI and Web UI is marked red and the Si3 purge is no longer executed. The purge is stopped to prevent the files in the Si3 repair area to be deleted as they may be required to repair Si3 in case of problems. Once the errors are fixed and the recovery.log is empty, the Si3 data store is no longer marked red and the Si3 purge is working again.

Comparison of Si3 V1 and Si3

SEP sesam v. 5.0.0 Jaglion has introduced a new generation Si3 deduplication store. Si3 offers significantly higher performance for backup, restore and migration, as well as backup to S3 cloud and backup to Azure, the new immutable storage feature SiS, resulting in improved performance, scaling, and resource savings.

Function	Si3	Si3 NG
Si3 backup	Y	Y
Si3 deduplication (source-side and target-side)	Y	Y
Si3 replication: local to remote store Notea	Y Si3 V1 to Si3 V1	Y Si3 V1 to Si3; Si3 to Si3
Si3 replication: to S3 cloud	Y	N (provides more powerful features for backing up directly to the cloud, see the next two lines)
Backup to S3 Cloud Storage	N	Y
Backup to Azure Storage	N	Y (as of Jaglion V2)
SiS (SEP Immutable Storage)	N	Y (as of Jaglion V2)
Si3 restore	Y	Y
Si3 encryption	Y	Y (as of Jaglion V2)
Seeding Si3 deduplication store Noteb	Y	N
Usage of tachometer	Y	N

Note^a

SEP sesam does not support a direct upgrade from the Si3 V1 to new Si3. However, to use the new Si3 you can:

• Back up all data again to the newly configured Si3 deduplication store.
• After configuring a new Si3, you can also create a replication job to replicate from the Si3 V1 to the Si3 store. Replication reads all the data from the source-side store on the source-side RDS and sends it to the target store using the source-side deduplication function. For details, see Replicating from Si3 V1 to Si3.
• You can also configure a new Si3 and an old Si3 V1 in parallel on the same host by enabling the key enable_gui_allow_multi_dedup.

Note^b

The Initial Seed feature does not work in v. 5.0.0 Jaglion, but you can use it in earlier SEP sesam versions.

==Configuring a Media Pool==Configuring a Media Pool/en

Part VI: Authentication

About Authentication and Authorization

SEP sesam operations, such as backup and restore, can only be performed by users who have the appropriate permissions. SEP sesam v. 5.0.0 authentication concept - which is used to grant and restrict access to SEP sesam Server(s) and specific objects - has changed. Now only a user with Superuser privileges can configure authentication and attach permissions (ACLs) to created users.

Authentication is a two-step process. First, the identity of a user accessing a SEP sesam Server is authenticated by verifying the user credentials (username and password). After successful authentication SEP sesam checks if the authenticated user has the appropriate permissions to access a specific resource or operation within the SEP sesam Server.

Authorization is implemented through permissions based on the user type that defines the connection to the SEP sesam Server and the available GUI objects. Additionally, custom user roles can be set by configuring ACLs by a user with Superuser privileges.

Authentication methods

After the initial installation of SEP sesam, no users are configured except the Superuser. SEP sesam provides several authentication methods that are mutually exclusive (and may be version dependent): database-based authentication, which is simply called authentication, and policy-based authentication. By default, policy-based authentication is active. Note that only one authentication method can be active at a time.

	Note
	You can bypass authentication for local server for all users by setting the parameter localFullAccess in the <SESAM_ROOT>/var/ini/sm.ini file to true as described in the section below.

Database-based authentication

It allows Superusers to configure users and grant them appropriate permissions to perform SEP sesam operations by setting individual passwords and assigning users to the appropriate user group.

You can use LDAP/AD authentication in combination with database-based authentication. This way SEP sesam can authenticate users against an external LDAP/AD directory. If LDAP/AD authentication is enabled in SEP sesam and users are correctly mapped, they can log in to SEP sesam according to their entry in the LDAP/AD directory and user mapping information. For details, see Configuring LDAP/AD Authentication.

If database-based authentication is enabled, users can also authenticate with a signed certificate by simply selecting a (signed) certificate at login instead of entering a password. For details, see Configuring Certificate-Based Authentication.

The assigned user group (based on user type) determines the actions that the group members can perform. The database-based authentication can be enabled from GUI by activating authentication under the Configuration ‐> Permission Management. This is the only way to set the password for the Superuser (Administrator).

When database-based authentication is enabled, the authEnabled parameter in the <SESAM_ROOT>/var/ini/sm.ini file on the SEP sesam Server is set to true. For details on database-based permissions, see Configuring Database-Based Authentication.

Policy-based authentication

Policy-based authentication represents a traditional approach to managing user's privileges. SEP sesam GUI is based on Java and uses the sm_java.policy file to grant the required permissions. The policy file is located at <SESAM_ROOT>/var/ini/sm_java.policy, where <SESAM_ROOT> is the pathname of the SEP sesam home directory.

For policy-based authentication, the permissions are assigned to the user/host combination in the sm_java.policy file. You can also grant users the required permissions by using GUI: Main Selection -> Configuration ‐> User Permissions. For details on policy-based permissions, see Configuring Policy-Based Authentication.

Configuring localFullAccess in sm.ini

localFullAccess determines whether a user logged to the SEP sesam Server is allowed to use SEP sesam CLI and GUI without any authentication. If set to true, authentication is not required. If set to false, the authentication is mandatory for all users. SEP sesam will prompt for the username and password to log in.

If database-based authentication is enabled, the flag localFullAccess is automatically set to false. A certificate is passed from the SEP sesam command line to the SEP sesam Server, where it is verified. The certificate file is stored in <SESAM_ROOT>/var/ini/ssl.

	Note
	On Unix, only the system root user can access this directory and use the command line without authentication. On Windows, use Windows User Account Control (UAC) to restrict access to the certificate file.

How to change the localFullAccess flag

1. Locate the <SESAM_ROOT>/var/ini/sm.ini file on the SEP sesam Server (where <SESAM_ROOT> is the pathname of the SEP sesam home directory). Open the sm.ini file using a text editor and set the flag for the localFullAccess parameter to true.
2. Once you have changed the settings, save your changes and restart the SEP sesam Server for the changes to take effect. The sm.ini file is preserved when you upgrade your SEP sesam Server.

Implementing authentication and authorization

After enabling the appropriate authentication method (database-based or policy-based authentication as described above), perform the following steps to manage users and implement authentication and authorization:

1. Create new users.
2. Add users to groups.
3. Assign user types (roles) to the new users.
4. In addition to user roles (and permissions based on the user type), there are several user permissions (ACLs) that you can set (assign to a role) to control access to specific resources or operations.

Managing users

Once authentication is enabled, you can create new users and add them to groups (Superuser, Admin, Backup, Restore, or Operator). When selecting a user type (role), it represents a specific role in SEP sesam with associated permissions (e.g. Superuser has full control over SEP sesam). The permissions based on the selected user type (default permissions) control access to SEP sesam Server, a specific resource, operation, and available UI options.

Note that the procedure for managing users differs depending on the authentication method selected, so you must ensure that you follow the appropriate procedure:

• For database-based authentication, see Configuring Database-Based Authentication.
• For policy-based authentication, see Configuring Policy-Based Authentication.
• For LDAP/AD authentication, see Configuring LDAP/AD Authentication

Attaching user permissions

In addition to the default permissions (described above) based on the selected user type, you can also set custom user roles by configuring ACLs if you have Superuser privileges. For more details on permissions, see User Roles and Permissions.

ACLs allow you to configure permissions for each user or group with fine-grained access rights for locations, clients, backup tasks (or groups), media pools, and schedules. For example, if you assign the Restore user permission to a specific backup task, that user can start the task-specific backup. For more information, see Using Access Control Lists.

Part VII: SEP sesam Backup

About Backup

About Backup/en==Configuring SESAM_BACKUP== SEP sesam Server Disaster Recovery/en

Creating Exclude List

Creating Exclude List/en==Enforcing Full Backup== Enforcing Full Backup/en==Backup on the Remote Device Server== How to create a Remote Device Server (RDS)/en

Part VIII: Scheduling

Special Schedules

Special Schedules/en

Part IX: SEP sesam Operation in the Network

Backup over an alternate network

Your license must first be modified to match the new server name and/or IP address. Send the original license, the new server name, and the IP address to info@sep.de.

When you receive the new license information, you can change the SEP sesam Server name using sm_setup.

1. Set the SEP sesam profile and enter the following command:
sm_setup change_servername <mynewserver>
2. After executing the command, check the interfaces of the renamed SEP sesam Server: Main selection -> Components -> Clients -> double-click the server (Client) to open its properties. In the Interfaces field, manually remove the old interfaces and enter the new interfaces for http and https.

Configuring SSL Secured Communication for SEP sesam Backup Network

Configuring SSL Secured Communication for SEP sesam Backup Network/en==List of Ports Used by SEP sesam== 4 4 3 Tigon:List of Ports Used by SEP sesam/en

Configuring clients in the firewall environment

Configuring Clients/en

Part X: SEP sesam Events

Creating a Backup Event

Creating a Backup Event/en

Creating a Media Event

Creating a Media Event/en==Creating a Migration Event== Creating a Migration Event/en

Creating a Command Event

Creating a Command Event/en

Follow-up Events

Follow-up Events/en

Part XI: SEP sesam Log Files

Interpreting Error Messages/en==Analyzing SEP sesam Log Files== 4 4 3:Analyzing SEP sesam Log Files/en==Tips for Backup Troubleshooting== 4 4 3:Tips for Backup Troubleshooting/en

Part XII: SEP sesam Interfaces

Using Pre and Post Scripts

Using Pre and Post Scripts/en==How to Configure Mail Notification== How to Configure Mail Notification/en

Part XIII: Managing Media

Managing EOL

Retention time defines a specific duration (in days) for which a backup or data set is protected against deletion or overwriting. It ensures that backups are retained for a predetermined period to meet operational, regulatory, or other requirements. Once the retention time for a backup expires, it may be deleted or overwritten based on the backup retention policies in place.

To set the retention time for backup data, SEP sesam uses the EOL attribute (End-of-Lifetime). The EOL is the expiration date of a backup or a saveset and defines the date when a backup or a saveset reaches the end of its defined retention time and can be removed or overwritten.

Retention time and EOL determine when backups can be safely removed from storage to free up space and resources. This ensures that data remains accessible for a specific period of time, and enables efficient management of storage resources by allowing the removal of backups that are no longer needed for recovery or compliance purposes.

Retention time is defined on a media pool level. When a saveset is written to a medium in a specific media pool, the expiration date is calculated and set, and retention begins. For example, a media pool has retention time of 30 days. If a saveset is created and written to this pool on January 1st, its EOL is set to January 31st. To maintain consistency of the backed-up data and keep the backup chain available for restore, SEP sesam automatically manages retention and adjusts the EOL of backups and media.

You can also manually adjust the EOL of your data, as described in Changing Retention (EOL).

	Note
	Retention time and EOL refer only to backups and related migrated and replicated savesets. SEP sesam logs, readability check logs, calendar sheet entries, and restore tasks have separate retention parameters. For details, see retention periods.

Backup chain and EOL

For a backup chain, SEP sesam manages the EOL values of backups according to the rules of dependency-based retention, synchronizing the EOL of interdependent savesets in the chain. This ensures that no backup is prematurely removed from the system and prevents interruption of the backup chain. Interdependent backups remain available throughout their retention time to ensure the recoverability of the entire backup chain.

For more information refer to Backup Chain Dependencies.

Storage management

When the EOL is reached, the protection for a saveset expires. However, the storage space occupied by an expired saveset isn't immediately freed. When space is required, the savesets with the oldest EOL are deleted first. SEP sesam uses the GET_OLDEST policy to preserve data on the media for as long as possible.

To overwrite a saveset and reuse the storage space, there should be no other savesets dependent on a particular saveset. Automatic retention management tracks dependencies and synchronizes the expiration dates to prevent deletion of savesets that might be still required for restore. This condition can be bypassed by modifying the expiration date (EOL) of the backup chain manually.

Media can be reused when the EOL of all stored savesets expires and is not write-protected (locked).

SEP sesam automatically allocates the media in a media pool with the oldest expired EOL for reuse. The media that has the longest time since EOL expired is reused first.

EOL types

SEP sesam manages the EOL property for three main object types: savesets, backups, and tape media.

Saveset EOL

The expiration date of a single saveset. It is initially calculated by adding the backup day (the date when the data is written to the medium) and the retention time specific to the media pool.

For example, in a media pool with 30 days retention time, a full backup is run on January 1st. EOL of this backup is set to January 31st. Five days later a differential backup is run, with EOL set to February 5th. Because differential backup depends on the preceding full backup, the EOL of the full backup is adjusted to match the EOL of the differential backup and is also set to February 5th.

Backup EOL

The expiration date of all savesets belonging to the same backup, including migrated and replicated savesets.

For example, you extend the backup EOL for a saveset. The EOL is adjusted for all savesets belonging to this backup (original, migrated and replicated savesets) to match the new EOL.

	Note
	By default, failed backups are also retained for the configured media pool retention time. This backup retention behavior can be changed by modifying the EOL-related keys, as described in Customize the default retention behavior for backups and migration. These keys are not supported in versions prior to 4.4.3 Beefalo V2, where failed backups were automatically deleted after 3 days.

Media EOL

The expiration date of a tape medium, determined by the longest saveset EOL on that medium. In case an interdependent saveset exists on another medium or datastore, the media EOL (Locked until attribute in tape properties) is adjusted accordingly. The tape can be reused after EOL of all savesets on tape expires (provided that the tape is not locked or write-protected). When another saveset is added to tape or EOL of an existing saveset on tape is changed, SEP sesam checks which EOL is the longest. If new EOL exceeds the current EOL of the tape, media EOL is automatically extended, otherwise it remains unchanged.

For example, a media EOL is set to February 3rd. A saveset is added to the tape with EOL set to February 25th. The media EOL is extended to February 25th. Another saveset with EOL February 20th is added to the tape, and the media EOL remains set to February 25th.

Automatic adjustment of retention and EOL

If the retention time is considered from the perspective of an individual backup, it can ensure restorability of data only for that backup. To enable complete restore of data backed up in the backup chain, SEP sesam tracks all dependent backup savesets and manages their retention time according to their dependencies.

Automatic adjustment of EOL follows the rules of dependency-based retention and is based on the longest EOL of interdependent savesets in a backup chain. This ensures that a backup, on which other backups depend for restore, is not removed prematurely from the system, which could potentially disrupt the backup chain. If a saveset is missing from the backup chain, data recovery to a specific point in time is not possible. SEP sesam maintains control over the dependencies among individual backup savesets and provides rules for automatic retention management based on these dependencies.

INCR backups require all previous savesets (FULL, DIFF and INCR) in a chain to be available for a successful restore. INCR backup taken as the third INCR after the FULL requires the FULL, the first, the second, and the third INCR to provide complete restore capability.

Example

For example, the following backup strategy is employed:

• Monthly full backup every 4th Sunday, in media pool MONTHLY with retention time 31 days
• Weekly differential backup every Sunday, in media pool WEEKLY with retention time 14 days
• Daily incremental backup, in media pool DAILY with retention time 7 days

Backup chain starts with the full backup and ends with an incremental backup. Full backup in a chain is a standalone backup and doesn’t require any other backups to successfully restore data. Therefore, the EOL of the full backup doesn’t affect any other saveset EOL.

Differential backup depends on the full backup for restore. Therefore, if EOL of differential backup exceeds EOL of the full backup on which it depends, the EOL of the full backup is extended to match retention of the differential backup.

Incremental backup requires previous savesets of all backup levels in a chain for a successful restore. INCR backup taken as the third INCR after a DIFF requires the FULL, the last DIFF, and the last three INCRs to provide complete restore capability. The EOL of incremental backups is adjusted with every new dependent incremental backup. In addition, if EOL of incremental backup exceeds EOL of the differential and full backups on which it depends, the EOL of the differential and full backups is extended accordingly.

In case the entire backup chain is stored on tape, the media EOL matches with the longest EOL of saveset on the tape. If any of the subsequent savesets on the tape exceeds this EOL, the media EOL is adjusted accordingly.

The figure below illustrates the adjustment of saveset EOLs. Only the most significant backups are filled in to retain clarity for informational purposes and to avoid cluttering the image. Note that media EOL is initially set to match the first FULL backup, and is adjusted later with the second DIFF backup to match the longest saveset EOL on the tape.

Rules for the automatic EOL adjustment

Rule #1: Full backups do not expire as long as dependent DIFF/INCR exist

Full backups will not be allowed to expire or be deleted as long as there are dependent DIFF/INCR backups that rely on them. The EOL of a full backup is extended if the EOL of subsequent backups exceeds the EOL of the full backup they depend on. If the EOL of the dependent backups is shorter, the EOL of the full backup remains unchanged.

For example, A full backup has EOL set to February 1st. A subsequent DIFF backup has EOL set to January 23rd. Because the DIFF backup expires before the FULL backup (EOL of the FULL is longer), the backup chain is not broken and the EOL of the FULL is not adjusted. Another subsequent DIFF backup has EOL set to February 6th. Because the FULL backup expires before the dependent DIFF (EOL of the FULL is shorter), and the backup chain could become unrestorable, the EOL of the FULL is adjusted to February 6th.

Rule #2: An increased EOL of a DIFF/INCR saveset results in an increased EOL of all dependent savesets

If the EOL of a DIFF or INCR saveset is increased, SEP sesam also increases the EOL of all preceding savesets (FULL and other DIFF and INCR) on which it depends. SEP sesam ensures that EOL of the FULL saveset and other DIFF and INCR is not shorter than the potentially modified EOL of the dependent DIFF or INCR saveset.

Rule #3: A decreased EOL of a DIFF/INCR saveset leads to decreased EOL of all dependent savesets

If the EOL of a DIFF or INCR saveset is decreased, SEP sesam decreases the EOL of all dependent subsequent savesets (DIFF and INCR). Note that you cannot set the EOL in the past.

Rule #4: A too short EOL of DIFF/INC savesets leads to an increased EOL

If the DIFF/INCR backup detects that a saveset belonging to an FDI chain has an EOL that is too short, then any subsequent DIFF/INCR backup that runs on a pool with a longer retention time will increase the EOL of the saveset from that particular pool.

	Note
	If the EOL of a saveset belonging to an FDI chain has already expired, it will not be extended. In this case, the next DIFF/INCR backup will be executed as a FULL backup, with settings that were defined for that DIFF or INCR backup (most notably, the media pool).

Rule #5: A new or migrated DIFF/INC backup leads to adjusted EOL for dependent savesets

When a new INCR or DIFF backup is run or an INCR or DIFF backup is migrated, SEP sesam automatically adjusts the EOL of all related savesets to match.

Rule #6: The last successful backup or migration is automatically retained

SEP sesam automatically retains the last successful backup or migration saveset if the next backup/migration fails. By extending the EOL of the last successful backup/migration, SEP sesam ensures that at least one successful backup is retained. This behavior is enabled by default and can be changed by setting the values of the corresponding keys, as described in Customizing Global Retention Policy.

	Note
	SEP sesam also allows you to manually adjust EOL if the default retention does not meet the requirements, but you should be careful with this option. Manually adjusted EOL overrides the EOL defined by the retention time in the media pool configuration.

Rule #7: Media EOL cannot be shorter than the longest saveset EOL on that tape

For tape media, SEP sesam adjusts the media EOL to match the longest EOL of the savesets stored on the tape. The media EOL and saveset EOL are interdependent and changes affect one another.

If a saveset EOL on tape is increased or decreased, the media EOL is adjusted accordingly. Similarly, modifying media EOL impacts saveset EOL.

Viewing EOL

EOL for savesets and backups, and for tape media is displayed in GUI and Web UI in several views. In GUI you can also modify the EOL.

Where in Web UI

In Web UI the EOL is read-only and cannot be modified.

Backup & Saveset EOL

• Monitoring -> Last Backup State -> click a backup task -> task properties – Storage Location -> in the storage locations table: Saveset EOL
• Monitoring -> Backups -> click a backup task -> task properties – Storage Location -> in the storage locations table: Saveset EOL
• Infrastructure -> Data Stores -> click the selected data store to open the properties -> in tab Properties click View savesets for this data store: columns Backup EOL and Saveset EOL
• Infrastructure -> Tapes -> click the selected tape to open the properties -> in tab Properties click View savesets for this tape: columns Backup EOL and Saveset EOL

Tape media EOL

Infrastructure -> Tapes, column Media EOL

Where in GUI

You can use the GUI to modify the EOL parameter in several different ways:

Backup & Saveset EOL

• Job State -> Backups -> double-click a backup task -> task properties – Info 1 -> in the Storage location table: Saveset EOL
• Components -> Tapes -> Media -> select the media and open properties -> Savesets tab -> columns Backup EOL and Saveset EOL
• Components -> Media Pools -> select the media pool and expand it to open media -> double-click to open the media properties -> Media properties – Properties 1 -> tab Savesets: columns Backup EOL and Saveset EOL
• Components -> Data Stores -> double-click the selected data store to open the properties -> tab Savesets: columns Backup EOL and Saveset EOL

Tape media EOL

• Components -> Tapes -> Media -> select one or more tapes -> right-click and select Change Media EOL
• Components -> Tapes -> Media -> select the tape to open its properties -> Locked until

Tracking the adjusted EOL

SEP sesam provides insight into how and when EOL values were modified. In Web UI, in the backup results window the Backup EOL displays EOL changes triggered manually or by automatic EOL adjustment process (in GUI this information can be found in the EOL changed by column in the Media view). Note that to display further details in the backup results window, you may have to switch to Advanced view in the Web UI.

When EOL adjustments occur automatically due to dependency-based retention or system-driven policies, this column displays the associated Backup ID or Saveset ID that initiated the adjustment, and helps you trace the specific backups or savesets responsible for the EOL change.

When a user manually alters the EOL, the EOL changed by column will show the username responsible for the modification.

The modified EOL is also recorded in the main log. You can generate these logs for audit and compliance purposes, providing a clear history of all EOL adjustments made (see also Audit Logging).

	Note
	Adjusting the Backup EOL of savesets stored on tape media may affect the Media EOL. The media EOL may also depend on the EOL of FULL/DIFF/INCR savesets stored on other media or even in datastores.

Checking and Labeling Tape Media

Checking and Labeling Tape Media/en==Configuring Removable Media== 4 4 3:Configuring Removable Media/en==LTO Encryption== LTO Encryption/en

Part XIV: Monitoring & Reporting

Monitoring, logging, reporting and notifications

Overview

---

About Monitoring

About Reporting

About Logging

Notification Center

Advanced logging

---

Audit Logging

Setting Log Level

Analyzing SEP sesam Log Files

Mail Notifications

---

SEP sesam Interfaces

Configuring Email Accounts

Troubleshooting

---

Troubleshooting Guide

FAQ

---

Monitoring & Reporting

Notifcations & Logging

Version 5.0.0 Jaglion

---

Monitoring and Reporting

How to Configure Mail Notification

Part XV: Web Interface

Restore Assistant

There are two ways to restore your data in SEP sesam: via GUI restore or via the web interface Restore Assistant. Although most options are the same in both restore interfaces, the web Restore Assistant is more intuitive and offers additional advanced options thus making it easy to restore your data.

The enhanced and redesigned Restore Assistant supports new task types and features advanced restore options. It also provides simple and flexible single file restore (SFR) for almost all VMs (except Proxmox VE) if you have the appropriate permissions. For more details on SFR, see Web Single File Restore for Virtual Machines.

Additional task types are supported with SEP sesam v. 5.0.0 Jaglion V2: NetIQ/Micro Focus eDirectory, Micro Focus iFolder, PostgreSQL and MySQL. You can perform a regular restore or write your backups to dump files (equivalent to the GUI option Write saveset into file). This actually restores the data to a single file rather than to its original location.

Authentication required

Only authenticated users who have been granted the appropriate permissions can access Restore Assistant and restore their data. These permissions are defined according to the user type. For details, see User Roles and Permissions.

Restoring encrypted backups

You can perform an online restore of data from password-protected encrypted backups. If you restore encrypted data with a password stored in the SEP sesam database, the password is automatically used for decryption during the restore. If the password is not stored in the database, you will be prompted to enter it online. In the latter case, if you do not know the password, you cannot restore an encrypted backup (it will remain locked).

Simple and advanced web restore

The Restore Assistant provides simple and advanced online restore features. Switching between simple and advanced mode is version-dependent, see Setting UI mode, and related to user permissions. The operations and options available after logging in may differ depending on the user type. For details, see User Roles and Permissions.

Restore features

Restore Assistant provides the following features:

• You can restore:
  • Data from regular Path backups, NDMP and NSS file system Path backups.
  • Email from Kopano, Dovecot IMAP, Courier and Cyrus backups.
  • Micro Focus GroupWise, HCL Domino, MS Exchange, and MS SQL backups; for the latter two, special procedure is required. See Web Exchange Restore and Web MS SQL Restore.
  • Virtual machine backups for all supported virtual environments (VMware, Hyper-V, RHV, OLVM, Citrix Hypervisor, KVM/QEMU, OpenNebula, Proxmox VE, and Nutanix AHV).
  • Single files from almost all VMs (except Proxmox VE): VMware vSphere, Microsoft Hyper-V, Citrix Hypervisor, KVM/QEMU, Nutanix AHV, Oracle Linux Virtualization Manager (OLVM), Red Hat Virtualization (RHV), and OpenNebula. For details, see Web Single File Restore for Virtual Machines.
• VMware sandbox restore provides improved functionality and usability of the recovery options, i.e. the use of run and execution commands of the VMware guest tools. See VMware Sandbox Restore.
• With the flexibility to switch between simple and advanced restore modes, experienced users can fine-tune their restore.

Accessing the Restore Assistant

You can access the restore assisstant in one of the following ways:

• via the GUI: by clicking the Restore Assistant icon in the toolbar or from Activities -> Restore Assistant
• from SEP sesam Web UI: left menu -> Restore Assistant
• or by entering the following address in the browser bar: http://[sesamserver]:11401/sep/ui/restore/.

Note

If you cannot access the web Restore Assistant, check if you have received the appropriate permissions for online restore. The operations and options available after logging in may differ depending on the user type. Other Web UI display restrictions may depend on the custom roles with specific permissions and the UI mode. For details, see About Authentication and Authorization and User Roles and Permissions.

Setting UI mode

You can easily switch from simple to advanced restore mode to refine the restore with additional options. Simple restore mode is enabled by default. Note that the simple restore options cover the most common restore cases and are the recommended method for performing a restore. The advanced options should only be used by experienced users.

To switch from simple to advanced restore mode, enable the Advanced View option in the lower left corner.

	Tip
	In the upper menu you can change the display language (German or English). The Monitoring, Web UI, Help and Account icons (in the upper right corner) allow you to quickly check the status of all restore jobs (Monitoring -> Restores), access the SEP sesam Web UI and online help, and log in and out via Restore Assistant.

Online restore in simple UI mode

The available restore options in simple mode cover the most common restore cases and are the recommended method for performing a restore. The restore procedure includes selecting the savesets to restore, the restore target, etc., and provides a step-by-step restore assistant depending on the type of data to restore. Note that for more experienced users, some additional restore options are available in advanced restore mode. For details, see Online restore in advanced UI mode.

Depending on the type of data, different procedures can be used for restore:

• Online restore of path, mail, HCL Domino, and Micro Focus Groupwise backups.
• Online restore of VM backups.
• Online restore of MS Exchange mailbox database and MS SQL backups with specific procedures described in the Web Exchange Restore and Web MS SQL Restore articles.

Restoring path, mail, HCL Domino, and Micro Focus Groupwise backups

The procedures for restoring path, HCL Domino, Micro Focus Groupwise, and mail (Kopano Groupware, Dovecot IMAP, Courier, and Cyrus) backups are almost identical, but some options (such as the Execution options) may vary depending on the task type selected. Note that a separate procedure applies for restoring MS Exchange and MS SQL, which is described in the articles Web Exchange Restore and Web MS SQL Restore.

1. Open Restore Assistant in the browser.
2. In the Start window, select appropriate task type: Files and directories, Micro Focus GroupWise, HCL Domino, Kopano Groupware, Dovecot IMAP, Courier, or Cyrus. Select the appropriate restore type and click Next.

3. In the Client window, select your client. You can filter clients by name, location, or operating system. Click Next.


4. In the Task window, select your backup task from the Task selection. A backup task defines the source data that was backed up by the client.

	Tip
	You can search for a file or directory by entering your search term in the Search for files or directories in all backups field.

Under Backup selection, select the exact backup version you want to restore. You can use the calendar function in the upper right corner to set a date range for the displayed backups.
Then select (in the lower right corner) whether you want to perform a selective or complete restore and click Next. Note that an additional step is required for a selective restore. For a complete restore, you are immediately taken to step 6 (Target tab).




5. If you are performing a selective restore, select a single saveset in the Files window and click Next.
6. The options in the Target window differ slightly depending on whether you want to restore from a path, GroupWise, HCL Domino backups, or from email backups.
Restore from path, GroupWise or HCL Domino backups
1. Select the target client for the restore.


2. In most cases, the Restore to original target path option is enabled by default to restore the files to the original location. Deselect this option if you want to restore your data to a new restore destination and specify a new target path; you can type or browse the path where you want to restore your data.


3. Under the Execution options, you can set additional restore options:

Do not overwrite existing items: Files are only restored if they do not already exist on the target system.
Create new version: Restore files under a new name.
Overwrite existing items: If the data exists on the target server, it is replaced with the restored version.
4. Decide how you want to restore your data (keep the original tree structure or flat):
Keep original tree structure: When restoring to the original location, the Keep original tree structure option is selected by default. The directory structure of the restored files is the same as the original directory structure of the backed up data.
Restore all items flat in the selected target directory: The backup is simply restored to a file without recreating the directory structure.
Click Next.
5. In the Finish window, review the summary of your restore task (restore type (based on task type, client, backup level, restore options) and click Start restore.



Kopano Groupware, Dovecot IMAP, Courier, or Cyrus mail restore

	Note
	You can also restore MS Exchange mailbox databases using SEP sesam Exchange Recovery Pro in the Restore Assistant, but the procedure is different from the mail restore procedure described below. For details, see Web Exchange Restore.

1. Check the target client for the restore.


2. Under the Target mail folder and user, enter a new mail user (the option Change user to ) and/or folder (Change folder to option) if you want to restore mail(s) to a different user mailbox or folder. Skip this step to restore mails to the original location (default).


3. Under the Execution options, you can specify additional restore options:
Do not overwrite existing folders and mails: Folders and mails are only restored if they do not already exist on the target system.
Overwrite existing folders and mails: If the data exists on the target server, it will be replaced with the restored version.

	Note
	The Auto recover after restore option required for Kopano restores is enabled by default and cannot be changed.

Click Next.



7. In the Finish window, review the summary of your restore task (restore type (based on task type, client, backup level, restore options) and click Start restore.

For more restore options in advanced UI mode, see Restoring path, mail, HCL Domino, and Micro Focus Groupwise backups in advanced UI mode.

Restoring virtual machines

If you want to restore a virtual machine (VM), you can choose what to restore from a list of VM types. The restore procedure in simple mode is almost identical for all VM types, except that additional options are available for some VM types, notably VMware with an additional step.

	Note
	The advanced restore options such as VMware instant recovery, VMware sandbox restore, VM single file restore, writing backups to the file system, etc. are only available in advanced UI mode.

1. Open the Restore Assistant in the browser.
2. In the startup window, select your target restore type: VMware vSphere, Microsoft Hyper-V, Citrix Hypervisor, KVM/QEMU, Proxmox VE, Red Hat Virtualization (RHV), OpenNebula, or Nutanix-AHV. In our example, the procedure for VMware is shown with an additional step in the Files window. Click Next.


3. In the Virtual Machine window, under Selection of the server, select your target server.
Then, under Selection of the virtual machine select the VM you want to restore. You can filter VMs by name, location, or OS.
Click Next.


4. In the Task window, under Task selection, select your source task. A backup task defines the source data that was backed up by the client.
Under Backup selection, select the exact backup version you want to restore. You can use the calendar feature in the upper right corner to filter a date range for the displayed backups.
Click Next. Note that an additional step is required for a VMware restore. For other VMs (Hyper-V, OpenNebula, etc.), you are immediately taken to step 6 (Target window).


5. In the Files window (available for VMware VM only), under the Virtual disk (VMDK) selection enable or disable the target VM disk(s) and/or Configuration you want to restore.
Click Next.


6. In the Target window, under the Target selection select your target environment for restore. You can use the drop-down list to check virtual machines.
Then set additional restore options under the Execution options:
Do not overwrite an existing virtual machine: The VM is restored only if it does not already exist on the target system.
Restore an existing virtual machine with a new name: The VM is restored with a new name, MAC address and UUID.
Overwrite an existing virtual machine: If the VM exists on the target server, it will be replaced with the restored version. The original MAC address and UUID of the VM are preserved.
(Do not) start virtual machine after restore: You can also define if you want to start a virtual machine after restore or not.
Click Next.


7. Modify or set additional restore options under the Virtualization restore options:
Data mover: Select the data mover.
Recovery options: Specify whether or not to start the VM after restore.
Under Target options of the virtual machine from the drop-down lists select ESX server and Datastore.
Click Next.

8. In the last step, check the summary of your restore task (restore type (based on task type, selected backup, its date and details, restore options, etc.) and click Start restore.

Additional VM restore options are available in advanced UI mode, see Restoring VMs in advanced UI mode.

Online restore in advanced UI mode

For more experienced users, some additional restore options are available in advanced UI mode. In the startup window, you can select additional restore types, such as restoring backups and VMs to the file system, writing backups and VMs to dump files, restoring a single file from a VM, performing VMware sandbox restore, etc. An additional Options tab is also available for all task types.

As with the options in simple mode, the advanced options differ depending on the type of restore:

• Online restore from path, mail, HCL Domino, and Micro Focus Groupwise backups.
• Online restore from VM backups
• VM single file restore; see Web Single File Restore for Virtual Machines.
• VMware sandbox restore, described in VMware Sandbox Restore.
• Online restore of MS Exchange mailbox database and MS SQL backups, described in Web Exchange Restore and Web MS SQL Restore.

Restoring path, mail, HCL Domino, and Micro Focus Groupwise backups in advanced UI mode

The following additional restore options may be available when you restore path, mail, HCL Domino, and Micro Focus Groupwise backups in advanced UI mode:

	Note
	Restoring MS Exchange and MS SQL backups requires a special procedure that is described in the Web Exchange Restore and Web MS SQL Restore articles.

• In the Start window, you can restore backups to the file system or write backups to dump files.
If you want to restore backups to the file system (this corresponds to the GUI option As path backup and allows you to restore your data directly to the file system without requiring any additional action), follow the procedure described in the above section Restoring path, mail, HCL Domino, and Micro Focus Groupwise backups. Note that the procedures are very similar, but some options may not be available (e.g., the Client window). If you want to write your backups to dump files (this corresponds to the GUI option Write saveset into file and restores the data to a single file rather than to its original location), you must specify a restore destination path in the Target window (by browsing or typing the path). Optionally, you can change the name of the dump file. If the dump file name is not specified, it is automatically generated. For step-by-step procedure, see MS SQL example Restoring MS SQL databases by writing backups to dump files.


• Additional execution options are available when restoring Path and MS SQL backups:
• Overwrite existing items with newer items from backup: If the data exists on the target server, it is replaced with newer items from the backup.
• Overwrite existing items with older items from backup: If the data exists on the target server, it is replaced with older items from the backup.


• The Options tab (available for all task types) allows you to set the following options:
At Optional data source selection, you can select your preferred media pool, drive, used media|barcode, and interface from the drop-down lists.

The Include/Exclude Filter tab allows you to specify which files or directories you want to include or exclude from the restore, for example, enter *.docx in the appropriate filter to include or exclude all MS Word *.docx files from the restore. You can use the include or exclude filter on the client side or the exclude filter on the server side. The latter is not available for complete restores.
Under the Advanced restore options, you can further refine your restore:
• Use the Log, Special Options tab to change the log level for your specific restore, see Setting Log Level. You can specify additional commands that may be useful for specific options of the sbc command. For details about the commands, see SBC CLI.


• Use the Retention, Generation, Pre/Post tab if you want to specify the retention period parameter for the restore (how long (in days) the restore task is kept), enable/disable a generation restore, and specify whether to apply a pre- or post-script to the restore task, see Pre/Post options.

Restoring virtual machines in advanced UI mode

If you enable advanced UI mode, you can set additional restore options. Advanced mode is recommended only for experienced users, as the options in the default simple mode are sufficient for most recovery cases. The following additional options are available in advanced UI mode.

• In the Start window, you can restore virtual machines to a file system, write virtual machines to dump files, perform VM single file restore, VMware instant recovery, or VMware sandbox restore:
  • If you want to restore VMs to a file system (not available for VMware), the restore procedure is the same as described in the above section Restoring path, mail, HCL Domino, and Micro Focus Groupwise backups. You only need to select a server and VM as the source instead of a client.
  • If you want to write VMs to dump files, the procedure differs from the usual VM restore only in that you must specify a restore target path in the Target window and optionally change a name for the dump file (see the relevant section above).
  • If you want to perform VM single file restore or VMware sandbox restore, see Web Single File Restore for Virtual Machines and VMware Sandbox Restore.
  • If you want to perform VMware instant recovery, see VMware Instant Recovery.
• In the Options window, additional restore options are available:
• In the case of a VMware restore, under Virtualization restore options, you can select the desired transport mode from the list of available transport modes (HOTADD, SAN, NBD, or NBDSSL); click the transport mode that appears and reorder the modes to suit your needs.


• Under Target options of the virtual machine you can specify additional target options, such as network interface(s), folder, storage repository, etc. Note that the available target options depend on the selected task type (VMware, Citrix, Hyper-V, etc.).


• You can modify the Recovery options: By clicking the Edit button (in the upper right corner), you can enable/disable different recovery actions: conf, remove, start, etc., and perform VM-related checks: VM power state, VM guest tools state and VM network IP address.

To add your custom action or your check, select the template from the Actions or Checks drop-down lists or manually enter your action/check commands. To activate your custom action/check, click Save. You can easily remove any action/check by clicking the recycle bin icon.

• Under the Optional data source selection, you can select your preferred media pool, drive, used media|barcode, and interface from the drop-down lists.


• An additional set of options is available under the Advanced restore options: You can specify the retention period parameter for the restore (how long (in days) the restore task will be kept), enable/disable a generation restore, and decide whether apply a pre- or post script to the restore task, see Pre/Post options.
  In the case of a VMware restore, you can also specify the transport hierarchy (if you have not previously changed the transport mode under Virtualization restore options); see Selecting the best VMware transport mode for your environment for details.

Monitoring restores

You can view the status of your restore jobs by clicking the monitoring icon (second icon in the upper right corner), via SEP sesam Web UI (Monitoring -> Restores) or SEP sesam GUI (Main Selection -> Job State -> Restores). For details, see Monitoring and Reporting.

Part XVI: SEP sesam Command Line Interface

SEP sesam CLI

Overview

The SEP sesam command line interface (CLI) is a utility that provides an alternate way of executing SEP sesam commands in UNIX and Windows environments. SEP sesam command line interface provides two CLI components: administration utility SEP sesam CLI and client utility SBC CLI. The latter is used to back up and restore data locally on the host.

SEP sesam CLI administration utility provides all of the functions available via SEP sesam graphical management interface and also additional CLI commands that are not available in the GUI. Note that different commands can be available depending on your SEP sesam license.

SEP sesam CLI commands can be used to install and configure a SEP sesam environment automatically without a GUI. They enable administrators to access SEP sesam database and manage the whole SEP sesam environment, for example, to install, configure and manage SEP sesam Servers and Clients centrally without a GUI. Every CLI command (except a native SQL statement) checks and follows the internal structure and dependencies of the SEP sesam database.

Features

• Automatic configuration of SEP sesam environments after installation (e.g., on implementation)
• Change the SEP sesam configuration without using the SEP sesam GUI
• Script-based mass installation and configuration (e.g., provider environment)
• Operate tests for installation and configuration in SEP sesam environments
• Get SEP sesam status, log and version information
• Determine SEP sesam object information for further use in other programs

Running CLI commands

You must have SEP sesam administrator privileges to run SEP sesam CLI commands and use the command prompt as an administrator. All commands are run from the <SESAM_ROOT>/bin/sesam/ directory. If you want to execute SEP sesam commands globally (and not from the actual run directory), set the SEP sesam profile as described in What happens when I set a profile?.

Understanding the command structure

The SEP sesam general syntax for a CLI command is:

sm_cmd <command> [–option] [<object>] [[–<parameter>] <value>]

where the following information is provided for each command

• sm_cmd: A command line tool that invokes the command line interface.
• Usage: The actual syntax of the command, including the arguments.
• Description: A brief summary of what the command does.
• Arguments: The definition of options used in the command.
• Example: Example of the command usage of the specified command and its options.

Command conventions

The parameters for a command are order-dependent and might include required and optional values or keyword choices, depending on how the information is bracketed. Required parameters are marked with an asterisk (*). An example is provided below.

| vertical bar

Separates the choices between two or more options or arguments.

[ ] square brackets

Indicate optional values.

< > angle brackets

Indicate that the enclosed element is mandatory.

Example:

sm_cmd <get|list|add|modify|backup|remove|restart> taskevent [OPTIONS...]

One of the actions bracketed with < > symbols, in this case <get|list|add|modify|backup|remove|restart>, is required, while the [OPTIONS...] are enclosed with [ ] symbols, therefore the information requested is optional. The following options are available for our sample taskevent command.

OPTIONS:
    -@ [param]     follow up (command to be run after the event completes)
    -G [ID]        task group
    -S [ID]        name of the interface
    -Z [number]    stop task if it runs longer than (e.g. 8:00 means that the task is automatically stopped after 8 hours)
    -d [ID]        drive number
    -j [ID]        backup task
    -l [param]     backup level (C = Copy, F = Full, D = Differential, I = Incremental)
    -m [ID]        media pool
    -s [0|1]       source-side deduplication

Let's say that we want to run a backup event for a backup task named win-cli_c_drive and use the target media pool (to which the data will be backed up) MP_disk_week. The command would look like this:

sm_cmd backup taskevent -j win-cli_c_drive -m MP_disk_week

Getting help

To list all available options, use the main help sm_cmd help. To show help for specific object, use sm_cmd help <object>, for example, sm_cmd help client.

Common action commands

The action command is used to perform an action or retrieve information/status about the resource. Most SEP sesam CLI resources have the following action commands:

get

The get command retrieves information about the resource or the operation that is currently defined.

list

The list command returns a list of objects for the specified resource. If the optional <object_name_or_id> is also specified, then the results are filtered by that value.

add

The add command creates a new object or event. If the optional <object_name_or_id> is also specified, then the objects are created according to the specified value.

modify

The modify command changes an existing resource based on the specified object options.

remove

The remove command deletes the specified object.

Before you begin

SEP sesam CLI is a very powerful command-line tool. You should be aware of its implications on your entire environment before you start using it.

Recommendations for using the SEP sesam CLI

• SEP sesam's optional command line commands change the SEP sesam database directly. Therefore all command line entries should be checked and verified!
• SEP sesam executes the commands immediately the <Enter>/<Return> key is pressed, which means that entries cannot be corrected, as is the case with the SEP Sesam GUI. It is extremely important that you are familiar with CLI and use it cautiously in order not to cause a system failure of the backup environment. Note that an erroneous entry can lead to complete data loss or other damage to the database. Such mistakes can void the warranty of your SEP sesam licensing agreement.

	Note
	Before you start scripting with the SEP sesam CLI, you should familiarize yourself with the SEP sesam environment. Read the SEP sesam documentation carefully and work on the SEP sesam installation and configuration to understand how the SEP sesam objects work together.

SEP sesam CLI usage

Command	Description
sm_cmd <get|list|add|modify|remove|send> account	Create and administer email accounts.
sm_cmd <get|list|remove|check> acl	List or delete access control list (ACL).
sm_cmd list allevent	List all SEP sesam events.
sm_cmd list allresult	List all results within the specified time period.
sm_cmd backup	Start the backup task or the backups of the task group.
sm_cmd clear cache	Clear the entire server cach.
sm_cmd <get|list|add|modify|remove> calendar	Create and administer calendars.
sm_cmd <get|list|add|modify|remove> calendarevent	Create and administer calendar events.
sm_cmd <download|show> calendarsheet	Display or download calendar information.
sm_cmd <get|list|add|modify|remove|dir> client	Create and administer clients.
sm_cmd <get|list|add|modify|start|remove> command	Create and administer commands.
sm_cmd <get|list|add|modify|remove> commandevent	Create and administer command events.
sm_cmd <get|list|add|modify|enable|disable|link|unlink|remove> credential	Configure and administer credentials.
sm_cmd <download|show> current	Display or download the current drive information.
sm_cmd <get|list|add|modify|remove> datastore	Create and administer data stores.
sm_cmd <get|list|add|modify|remove> default	Configure and administer default keys.
sm_cmd dir <argument>	List all specified clients, elements, VMs, etc.
sm_cmd <get|list|add|modify|remove|start|mount|dismount|unload> drive	Create and administer drives.
sm_cmd <get|list|add|modify|remove> drivegroup	Create and administer drive groups.
sm_cmd <get|list|add|modify|remove> group	Create and administer user groups.
sm_cmd <get|list|add|remove> interface	Create and administer interfaces.
sm_cmd start inventory	Start archive adjustment.
sm_cmd <show|update|report> license	Check the SEP sesam license information and update the license.
sm_cmd <get|list|add|modify|remove|load|unload|import|export> loader	Create and administer loaders.
sm_cmd <get|list|add|modify|remove> loaderdevice	Create and administer loader devices.
sm_cmd <get|list|add|modify|remove> location	Create and administer locations.
sm_cmd <download|show|list> log	Monitor and download log files from the server.
sm_cmd <get|list|add|modify|remove> media	Create and administer storage media.
sm_cmd <get|list|add|modify|remove> mediapool	Create and administer media pools.
sm_cmd <get|list|add|modify|start|init|remove> mediapoolevent	Create and administer media events.
sm_cmd migrate	Start a migration immediately.
sm_cmd <get|list|add|modify|remove|start> migration	Create and administer migration events.
sm_cmd <get|list|add|modify|remove> migrationtask	Create and administer migration tasks.
sm_cmd <get|list|add|modify|start|remove> newdayevent	Create and administer NEWDAY events.
sm_cmd <get|list|add|modify> notification	Create and modify notifications.
sm_cmd <get|list> opersystem	List a specific OS or all operating systems.
sm_cmd render	Renders the specified template.
sm_cmd <list|restart>	Check and restart backups/migrations.
sm_cmd <get|list|add|modify|restore|start|remove> restoreevent	Create and administer restore events.
sm_cmd <get|list|add|modify|start|remove> restoretask	Create and administer restore tasks.
sm_cmd <get|list> result	Monitor the results according to set filters (e.g., clients, tasks).
sm_cmd <dir> saveset	Browse a saveset.
sm_cmd <get|list|add|modify|rename|remove|start> schedule	Configure and administer schedules.
sm_cmd <download|show> services	Monitor and download different files or logs.
sm_cmd list session	List all active sessions.
sm_cmd start <task|restore|migration|command>	Start an event.
sm_cmd start report	Create a customized report.
sm_cmd <get|list|add|modify|start|remove> task	Create and administer tasks.
sm_cmd <get|list|add|modify|backup|remove|restart> taskevent	Create and administer task events.
sm_cmd add taskgen	Generate tasks according to the specified task type.
sm_cmd <get|list|add|modify|start|remove> taskgroup	Create and administer task groups.
sm_cmd <get|list|add|modify|remove> taskgrouprelation	Create and administer task group relations.
sm_cmd <download|list> update	Monitor and download JAR (.jar) updates.
sm_cmd <get|list|add|modify|remove|reset> user	Create and administer users.
sm_cmd show version	Display SEP sesam Server and Client package version.
sm_cmd <resetcbt|check|generate|list> vsphere	Reset CBT, monitor vSphere environment and generate vSphere task group.

SEP sesam CLI - Jaglion

Some changes were made in the CLI for the Jaglion version.

Obsolete

The object taskgrouprelation has been removed. Use sm_cmd modify taskgroup {task_group} -j {task}[,{task}] instead. Example: sm_cmd modify taskgroup taskgroup1 -j task1,task2

New objects

Migrationresults, Replication, Replicationresult, Replicationtask, Restoreresult, SQL.

SBC CLI

SBC CLI/en

Part XVII: Appendix

SEP sesam Matrices

Software and hardware interoperability

---

SEP sesam OS and Database Support Matrix

SEP sesam Storage Hardware Support Matrix

Archive of Supported Devices

Features

---

Encryption Support Matrix

VMware SF and IR Support Matrix

Required components

---

Java Compatibility Matrix

VDDK Compatibility Matrix

Cross-Platform Recovery File System Layer

Cross-Platform Recovery File System Layer/en