We have a Windows 2008 R2 server that is backed up by TSM. The backup job is initiated centrally from a management server. We need to exclude some folders from backup - in particular, C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys, which contains tens of thousands of items (temporary private keys for SSL user sessions - that's the logic of the running application).

I can't make TSM exclude this folder from the backup. I tried to use both dsm.opt and dsm_local.opt, both exclude.dir and exclude operators. I can see in the backup log that those options are recognized. If I start the TSM GUI, in the manual backup window the folder is marked with the red forbidding sign and can't be selected. However, the folder is backed up anyways.

How can I prevent TSM from backing up that folder?

Would it be possible to see the contents of your dsm.opt file.

Also is the node associated with a client option set on the TSM server?

Anthony, there is not much to see in the config files. INCLEXCL "dsm_local.opt" in dsm.opt, and exclude and exclude.dir statements in dsm_local.opt. No include statements there, if that's what you mean.

I can successfully exclude other folders from backup using those statements. Only the MachineKeys folder is always backed up.

Sorry, I can't answer the second part of your question. The backup management servers are under control of another support team. I can ask them, but I need to ask exact questions. :)

In Reply to Anthony Whitchurch:

Would it be possible to see the contents of your dsm.opt file.

Also is the node associated with a client option set on the TSM server?

That folder is included in systemstate backup.

Rgd.
Espen

Espen,

Yes, it is. So it will be always backed up no matter how I configure the options? It's bad... OK, thank you so much for the tip.

In Reply to Espen Wallin:

That folder is included in systemstate backup.

 

Rgd.
Espen

That's correct, but you can choose to exclude systemstate with the domain parameter. It depends how important system state is for that server in a possible restore or disaster situation.

Espen,

Unfortunately, backing up the system state is a corporate policy. So we have to leave it as it is. :( Thank you for the clarification.

The most common problem with Windows EXCLUDE.DIR is too many backslashes, or specifying an incorrect (non-matching) drive or host.  For example, a very effective EXCLUDE.DIR would be something like:

   EXCLUDE.DIR   Microsoft\Crypto\RSA

You can confirm whether the EXCLUDE.DIR statement is working the way you want, including the effects of the OS, TSM Client options, and the Server "Client Option Set" (CLOPSET) using the TSM Client command "PREVIEW BACKUP <directory>" -- which also explains *why* something is excluded, making it great for debugging.

In addition, Windows keeps its own list of files and directories not to backup, even using SystemState (VSS writers), by adding the "FilesNottoBackup" Registry entry.  Here is the URL:

      https://msdn.microsoft.com/en-us/library/windows/desktop/bb891959(v=vs.85).aspx

So even if the directory and contents are included by Windows (not TSM) you should be able to prevent their backup by SystemState.

Last word of advice -- any time there is a problem with a TSM Client, just ask for this one output file:

    dsmc query systeminfo  >>hostname-systeminfo-2017-02-03.txt

That contains the DSM.OPT file, output from "Q OPTION", the versions of all the TSM Client code, SCHEDLOG, ERRORLOG, and the registry entries (amongst other goodies).  Once and done!  :-)    Good luck.

  Best Regards,

      Robert Luehrs

If the issue is the files been open, you could try to set Copy Serialization parameter to Shared Dynamic which will try to backup or archive as many as 4 times and if it remains open and it will backup on the 5th trial regardless if open or not.

But as Espen said, I see no other way to exclude that folder other than excluding sys state.