no avamar role assignment map found

Avamar Basics – Command Line Restores using avtar

I admit, when I first encountered Avamar, some of my first impressions were a little jaded by my lengthy experience with NetWorker and other products.

Whereas NetWorker has a very rich set of command line options, particularly on the client, Avamar only has a few. But the difference between the two is that Avamar’s few command line tools on the client are packed with a rich gamut of options.

Avamar Restore Options

There are a few standard options that you might use for an Avamar restore:

• A database-integrated plugin, directly on the client (e.g., Avamar embedded in the Oracle RMAN utility)
• A GUI restore (either the new web-based AUI or the Java console)
• From the command line on the client using avtar .

I might have previously split out options around vCenter/VMware restore processes. However, these now plug directly into the AUI anyway, so they’re just another variation of the AUI restore scenario.

(In addition to the above methods, you can also access Avamar restores via the REST API, which is leveraged to excellent effect in extensions such as the vRealize Automator and vRealize Orchestrator plugins.)

GUI-based restores are easy enough to navigate via the GUI, particularly now with the Avamar UI. But it’s worthwhile knowing how to make your way around a command line restore.

Aside: Setting up a User Account for Restores

In a normal Avamar environment, you’ve probably got a plethora of different user accounts setup (either integrated into Active Directory, or as direct Avamar accounts). I had never got around to configuring additional accounts in my Avamar lab environment, and I think you ought to avoid using the MCUser account for client initiated recoveries. (Because individual users/administrators on clients are unlikely to be trusted with the root credentials for Avamar.)

So as a precursor to this, I decided to create a new account in Avamar I’d be using for this process. To start the process, I went to Administrator > Setting under the AUI. From there I selected Setting > Users in the main window, and because I didn’t want a new account that could administer the entire server, I chose the clients domain:

I clicked +Add to add a new account and filled in the desired details:

The role I chose for my user account was ‘Administrator cannot retire’, which is, as you may have guessed by the name, an Administrator user that can’t retire clients. In actual fact, I only needed to create a Restore-enabled user, but I figured I’ll use this user account elsewhere so gave it a bit more oomph.

After I filled in the details and clicked OK, the User Settings updated to show my new account:

So that’s the account created. Next up – using it to do a restore.

Getting Acquainted with avtar

If you’re at all familiar with Unix and Linux platforms, you’ll have no doubt guessed that avtar is a little modelled on the Unix tar command. The avtar command takes most command-line options via the long-form method – i.e., a whole word preceded by a minus-minus. (There are some variations, but the majority of options will use a ‘–‘).

The first variant of avtar you’ll want to familiarise yourself with is –help:

This will produce a rather lengthy amount of information, so either pipe it to more or be prepared to scroll back up. Details are broken into two key categories:

• Tasks – What you’ll want to do with avtar, and
• Options – How you set granular controls on the tasks you run with avtar.

Taking a closer look at the tasks , you’ll see you can use avtar to:

• create – Make a new backup
• extract – Pull files out of a backup (i.e., restore)
• list – List the contents of a backup
• backups – List backups
• delete – Delete a backup
• viewlog – Show the logs for a particular backup
• validate – Validate a backup

Each of these tasks are useful, of course, but in this post we’ll concentrate on options around restoring from backups.

Using avtar to find the backup you want to restore from

So your first step will be to list the backups available for the host you want to restore data for. This will be via avtar –backups .

Now, when you intend to talk to an Avamar server with avtar (pretty much any time other than just running avtar –help), you’ll need to authenticate, and you’ll likely need to specify a host path you want to work on. You can bundle the password on the command line, but for my examples, I’ll be typing in the password each time.

So here’s the command I used:

(All one line.)

You use the ‘–id’ option to authenticate an account name. In this case, because the account I created wasn’t in the root domain for Avamar, I had to specify the account name and the account domain . So, that was ‘ pmdg@/clients ‘, meaning “User ‘pmdg’ in the ‘/clients’ domain”.

You also have to tell avtar the account you want to use it against. Within Avamar and avtar in particular, the account refers to the host or client name whose backups you want to interact with. For my example here, the account is ‘totesrhelly.turbamentis.int’. (Note that I didn’t have to specify the /clients domain here. I’ve specified /clients in my id.)

Running the command gives me a list of all the backups for the nominated account, including details including but not limited to:

• The backup label
• When the backup was generated
• The size of the backup

Using avtar to list the contents of a backup

Sometimes you’ll know exactly what you want to restore from a backup, but sometimes you’ll want to query the content of a backup to see if it has what you want. (Remember that since each Avamar backup is full , any backup you query will present you that full filesystem view you might know and love from NetWorker’s ‘recover’ command.)

If I wanted to list the contents of the second backup (top of the list of two backups, sequence #2), I’ll want to grab the backup label to run the backup listing, and my command will look like the following:

I added a “| less” to the end of the above command so I could pause the output for a screen capture. (When you do that, the command may appear to hang, but in that scenario it’s just Unix/Linux buffering while avtar prompts you to enter your password.)

Using avtar for a command-line restore

So far we’ve looked at:

• How to list the backups
• How to list the contents of a backup

Now we’re ready for the main event – how to restore files from a backup. There are a lot of different restore options, but I’m going to keep it simple. In this scenario, I want to recover the path /DATA/NetWorker/19.4 to /tmp/recovery from the backup I previously listed above. That makes the command line as follows:

The new CLI options I’m using here are:

• –extract to restore
• –target to specify where I want to write the restored data to, and
• fileSpec – The file path/spec to apply for matches for restoration – in this case, ‘/DATA/NetWorker/19.4’.

So, here’s what the restore looks like in action:

With the restore complete, I did a quick directory listing to confirm the results of the operation:

Wrapping up Avamar command line restores using avtar

As I mentioned earlier – the avtar command has a lot of options to it, and even in terms of finding backups and running restores, I’ve really only touched the top of it with this article. But always keep in mind that avtar is a powerful option available to you to run Avamar restores.

Did you like this post? Please share it.

Related posts:.

• Basics – Recovering SQL Databases as Files in Avamar
• Basics – Avamar Client Logs
• Meme Monday
• Basics – NetWorker Compressed Recoveries

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Notify me of follow-up comments by email.

Notify me of new posts by email.

This site uses Akismet to reduce spam. Learn how your comment data is processed .

Configuring DELLEMC Avamar Virtual Edition (AVE) & Data Domain Virtual Edition (DDVE) for VMware

Configuring dellemc avamar virtual edition (ave) & data domain virtual edition (ddve) for vmware environment.

In this blog post i am going to cover configuration of Avamar Virtual Edition (AVE) & Data Domain Virtual Edition (DDVE)

Dell EMC Avamar Virtual Edition is great for enterprise backup data protection. Avamar Virtual Edition is optimized for backup and recovery of virtual and physical servers, enterprise applications,  remote offices, and desktops or laptops.

Key features:

• Delivers a software-only data protection solution
• Supports VMware vSphere, Microsoft Hyper-V and Azure
• Provides guest and image-level backup and recovery
• Enables application-consistent recovery
• Uses variable-length deduplication
• Uses AES-256 encryption to secure data in flight or at rest

Data Domain Virtual Edition (DDVE) is a software-defined data protection solution. DDVE can be up and running in minutes on any standard server, converged or hyper-converged. DDVE delivers increased transactional and operational efficiencies, reliability. DDVE can provide data protection to multiple virtual server environments based on VMware ESXi, VMware vSphere, Microsoft Hyper-V, and KVM.

DDVE can protect data, backup and restore between virtual machines on the same server, across multiple servers or in the cloud. It can serve protection across multi-tenant environments too.

From here on I will use AVE & DDVE abbreviations for Avamar Virtual Edition & Data Domain Virtual Edition respectively.

To begin with I presume you know how to deploy AVE & DDVE for VMware platform. Please hit me with PM in case you need more info on deploying AVE & DDVE.

Configuring DELLEMC Avamar Virtual Edition (AVE).

List of Tasks:

• Install Avamar administrator on your client

Apply License to Avamar

Integrate avamar with ad, vcenter certificate authentication, add the cloud vcenter to avamar, deploy avamar proxy instances, configure avamar proxy for management workload domain datastore protection, protect cloud management domain.

Install Avamar administrator on your client windows desktop or jump server. Java is required to run the Avamar administrator

• Open Avamar server web page, e.g. http://avamar-FQDN
• From downloads page, find and download the admin console installer.
• Save and run the installation package (right click and Run as Admin).
• Once you have installed the Avamar Administrator, start it from windows client.
• Logon using root user, MCUser or Admin user account with password (specified during installation)

The following steps are required to license Avamar

• change path to cd /usr/local/avamar/etc/
• cp /tmp/AVMR_4085083_15-Jul-2019_exp.lic license.xml
• chmod 644 license.xml
• avmaint license license.xml –avamaronly
• avmaint license –avamaronly
• Launch the Avamar Administrator console and log in with a local Avamar user e.g. MCUser
• Click Administration > LDAP Management
• Click Directory Service Management and click Add
• Enter the fully qualified domain name e.g.  spoc.com
• Click Add and click Close
• On the LDAP Management tab click Edit the ldap.properties file
•     user-login-module=ldap
• To enable login for domain users navigate to Administration > Account Management
• From the actions menu select Account Management > New LDAP Map
• The LDAP domain you added previously should automatically populate.
• Enter the AD group you wish to add and click Search e.g Avamar_Admins
• Choose a role to assign to the group and click OK. In this case we have assigned the Administrator role to the Avamar_Admins group
• You should now be able to log in as a member of the Avamar_Admins AD group
• Ssh to the the Avamar server via RDP or vSphere console as member of VC_Admins.
•     From vCenter vCSA: /etc/vmware-vpx/ssl/rui.crt
• SSH to the Avamar server with “su – admin”
•     cp -p /usr/local/avamar/lib/rmi_ssl_keystore /tmp/
•     dpnctl stop mcs
• $JAVA_HOME/bin/keytool -importcert -file /tmp/rui.crt -alias vcenter-cloud -keystore /tmp/rmi_ssl_keystore

Note – The alias vcenter-cloud is a user-defined friendly name for the certificate entry in the keystore. Each certificate in the keystore must have a unique alias.

• When prompted for a password, enter new password
• When prompted enter yes to trust the certificate and press ENTER
•   cp -p /usr/local/avamar/lib/rmi_ssl_keystore rmi_ssl_keystore.date
• cp -p /tmp/rmi_ssl_keystore /usr/local/avamar/lib/.
• dpnctl start mcs

To add a vCenter client, follow these steps:

Note – Be sure you have added the vCenter SSL certificate and restarted “mcs” service

• In Avamar Administrator, select Navigation > Administration or click the Administration launcher button
• select Actions > Account Management > New Client
• For the Client Type select VMware vCenter and complete the following settings:
• Select VMware vCenter in the Client Type list
• Type the Cloud vCenter fully qualified DNS name or IP address in the New Client Name or IP field.
• Type the vCenter web services listener data port number in the Port field. 443 is the default setting.
• Type the vCenter user account name in the User Name field. This should be the app_avamar_vcenter service account and ensure to include the domain name e.g. DOMAIN\app_avamar_vcenter
• Type the vCenter user account password in the Password field.
• Type the vCenter user account password again in the Verify Password field and click OK.
• From Avamar console, access VMware tab from the top menu and click Proxy Deployment Manager
• You can select ‘Create Recommendation’ option for AVE to suggest number for necessary AVE proxy’s based on your VMware environment.
• Once the recommendation is create, you can edit each recommended proxies and assign IPs, DNS & other settings
• Once applied, necessary number of proxies would be deployed in VMware Cluster.

Any datastores that store cloud management Virtual Machines needing to be backed up need to be manually added to the individual proxies.

• In Avamar Administrator, click the Administration launcher button. The Administration window appears
• Click the Account Management tab.
• Select the proxy, and then select Actions > Account Management > Client Edit. The Edit Client dialog box appears.
• Click the Datastores tab, and then select datastores that host virtual machines you want to protect with this proxy.
• Click the Groups tab, and then assign this proxy to one or more groups by clicking the
• Select checkbox next to each group & quick OK

In order to provide image-level protection for the VMs residing in the Management Workload Domain, the Cloud vCenter client policy in Avamar must be manually activated and the associated VMs added.

• In the Avamar Administrator UI, and select Policy
• Select vCenter FQDN
• Switch to Clients tab
• Select vCenter in the navigation pane and also select it as a client in the right hand pane and then click ‘Edit’
• Uncheck ‘Disable all backups’
• Check ‘Activated’  & Click OK
• Close the Policy Window & Select Administration
• To add the client VMs residing in the relevant cluster, select the Cloud vCenter, right-click and select ‘New Client(s)’
• Navigate to Hosts & Clusters tab
• Select the cluster(s) hosting the management domain
• Leave the Dynamic option selected for the Virtual Machine Container Inclusion, select Enable Changed Block Tracking and click Select All & Click OK

—————————————————————————————————————————————————————————————————————————————————————————————————————————————-

Configuring DELLEMC Data Domain Virtual Edition (DDVE)

• Set up time and date settings

Enabling AD integrated management of Data Domain

Adding Domain Accounts with DDVE privileges

Ddboost user account creation, enable ddboost, snmp setting, add ddve to avamar.

Once the DDVE system has been installed and configured on the network there are a number of tasks you need to complete in order to connect it with Avamar via DD Boost.

Manually configure NTP server and set up time and date settings from DD System Manager by browsing to Administration > Settings

• Login to Data Domain System Manager Web Console with http://datadomainFQDN/. The default credentials are sysadmin/Password123!
• From DD System Manager UI, go to Administration > Access > Authentication and click ‘Configure’ under Active Directory tab:
• Choose Configure
• Change the mode to Active Directory click Next and set the realm to the full name of the domain you wish to join
• Configure the AD/ Kerberos Authentication and click finish to commit the changes
• At this point, the Active Directory Administrative Access should show ‘Enabled’
• To specify the AD Domain details, enter credentials with the rights to add the DD unit to AD and click OK. The services will be restarted during this Click OK to proceed.
• Once complete, add the relevant users with appropriate rights using the green ‘+’ button on the right corner:

Specify the AD group and the relevant permission you wish to assign to them

Connect to the management IP Address of the DDVE unit via SSH and login as a local admin user in order to confirm that windows admin access is permitted

Run the following command to view current setting

• adminaccess authentication show

If the result is disabled then run the following command

• adminaccess authentication add cifs

To confirm that it is now enabled run

In order to connect Avamar to Data Domain using DD Boost, you need to create a local user on the Data Domain which will later be used by Avamar.

• Login to Data Domain System Manager Web Console with http://datadomainFQDN/ using an account with admin privileges on the Data Domain unit.
• On the left pane, select Administration > Access > Local Users. Click on ‘Create’ button
• Provide the user name, password and make sure the management role is set to ‘admin’
• Click OK button.
• Make sure DDBoost is enabled by navigating to Protocols > DD Boost
• Ensure that DD Boost Status is set to enabled.
• Add the user created in the previous section using the Plus symbol to ensure the user has DD Boost Access

The final Data Domain configuration step is to set the SNMP Read/Write Community and trap host configuration to use along with Avamar.

• To configure the SNMP settings, navigate to Administration > Settings > SNMP tab.
• Scroll down to locate SNMP V2C Configuration section.
• Under Host, provide the Avamar Host name
• Set the port as 163.
• Under community drop down select ‘Create New Community’
• Enter the name of the new Community (public in this example)
• Set access to Read-Write
• Click the Plus sign to add a Host
• Specify the name of the Avamar Host name again & Click OK.
• The new community now show in the Trap Host window & Click OK

To configure the Data Domain unit as a backup target within Avamar, you need to execute the following tasks:

• Open the Avamar Administrator Console
• Click on Server tab
• Click on the Server Management tab
• Provide Data Domain FQDN DNS name
• DDBoost user name and password
• Click on Enable SNMP Getters/Setters
• Provide the SNMP Read Write Community String (Public) & Click on OK.

Once it is added, the server becomes visible as an object under the Data Domain heading

Hope you enjoyed this post, I’d be very grateful if you’d help sharing it on Social Media. Thank you!

DISCLAIMER: The views expressed on this site are strictly my own and do not necessarily reflect the opinions or views of any Company. Please always check official documentation to verify technical information.

• Install App

Infrastructure Software

For appeals, questions and feedback about Oracle Forums, please email [email protected] . Technical questions should be asked in the appropriate category. Thank you!

Interested in getting your voice heard by members of the Developer Marketing team at Oracle? Check out this post for AppDev or this post for AI focus group information.

Need to confirm Avamar agent is running or NOT on LINUX ?

How do I confirm Avamar agent is installed on Redhat Linux 7.2 Version ?

is this right ?

$ ps -ef | grep avamar

root      5997     1  0 Jan13 ?        00:00:23 /usr/local/avamar/bin/avagent.bin --bindir="/usr/local/avamar/bin" --vardir="/usr/local/avamar/var" --sysdir="/usr/local/avamar/etc" --logfile="/usr/local/avamar/var/avagent.log"

oracle   23333 22760  0 03:47 pts/0    00:00:00 grep --color=auto avamar

$ which avamar

/usr/bin/which: no avamar in (/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/oracle/.local/bin:/home/oracle/bin:/u01/app/oracle/product/12.2.0/dbhome_1/bin)

$ cat /etc/redhat-release

Red Hat Enterprise Linux Server release 7.2 (Maipo)

Navigation Menu

Search code, repositories, users, issues, pull requests..., provide feedback.

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly.

To see all available qualifiers, see our documentation .

• Notifications You must be signed in to change notification settings

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement . We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

azurerm_role_assignment Does Not Work With Some Roles #12592

stevematney commented Jul 14, 2021

• 👍 16 reactions

jku-sr commented Jun 22, 2022 • edited Loading

Sorry, something went wrong.

• 👍 2 reactions

Jost3in commented Aug 29, 2022

• 👍 1 reaction

No branches or pull requests

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

New-AzRoleAssignment : The provided information does not map to an AD object id. At line:1 char:1

I have created an application in the Azure AD like this:

Now I want to grant this application a role assignment like this

but it throws this error

Microsoft Entra ID A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory. 21,286 questions Sign in to follow Follow

Hi @Rajaniesh Kaushikk • Thank you for reaching out.

The -ApplicationId parameter in the New-AzRoleAssignment cmdlet must specify the Application ID of the servicePrincipal. When you register an application using New-AzADApplication cmdlet, it does not create a servicePrincipal corresponding to the app. However, when the application is registered via Azure Portal, it is created automatically.

In your case, to resolve the error, you need to perform the below steps:

• Run $servicePrincipal=New-AzureADServicePrincipal -AppId $clientID to create the servicePrincipal corresponding to the app registered in Azure AD.
• Run New-AzRoleAssignment -ApplicationId $servicePrincipal.AppId -RoleDefinitionName "EventGrid EventSubscription Contributor" -ResourceGroupName RG01

-----------------------------------------------------------------------------------------------------------

Please " Accept the answer " if the information helped you. This will help us and others in the community as well.

0 additional answers

• Stack Overflow for Teams Where developers & technologists share private knowledge with coworkers
• Advertising & Talent Reach devs & technologists worldwide about your product, service or employer brand
• OverflowAI GenAI features for Teams
• OverflowAPI Train & fine-tune LLMs
• Labs The future of collective knowledge sharing
• About the company Visit the blog

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Get early access and see previews of new features.

Creating Azure role assignments over a map of object_ids and roles

I'm trying to create a Terraform deployment that will enact azurerm_role_assignment by iterating over a list of principal_object_ids and their allocated roles. My code is roughly:

Define principal_ids and the role to allocate:

A module to allocate roles:

A main.tf including the following block:

What I actually end up seeing is that the last entry for a given service principal is the only one acted on. Ie, from the above example, SPID#######1 would get "storage blob data reader", but not "reader" and SPID######2 would get "storage blob date owner", but not "owner".

I'm assuming there is something going on where it only creates one block for each key, so the latest value overwrites it, but I'm not sure how to get round this without making a more complicated implementation of my subscription_access_list_by_id map.

I've tried using {for k, v in subscription_access_list_by_id : k => v } as an approach to no avail.

• terraform-provider-azure

• 3 You have duplicate keys, and therefore you will need to restructure. Note there is no language that allows duplicate keys in maps, hashes, dictionaries, linked lists, etc., so there is no workaround here. –  Matthew Schuchard Commented Jan 12, 2023 at 17:58

I tried in my environment and got below results:

Variables.tf

With above code I can add the role assignments like reader and storage-blob-data-reader to the service principal id.

The role definition name should not be list . If you need to add assign another user, you can create separate variable and assign to them.

Reference: azure - Create Role assignment dynamically in Terraform from input - Stack Overflow

Your Answer

Reminder: Answers generated by artificial intelligence tools are not allowed on Stack Overflow. Learn more

Sign up or log in

Post as a guest.

Required, but never shown

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy .

Not the answer you're looking for? Browse other questions tagged terraform terraform-provider-azure or ask your own question .

• The Overflow Blog
• The hidden cost of speed
• The creator of Jenkins discusses CI/CD and balancing business with open source
• Featured on Meta
• Announcing a change to the data-dump process
• Bringing clarity to status tag usage on meta sites
• What does a new user need in a homepage experience on Stack Overflow?
• Feedback requested: How do you use tag hover descriptions for curating and do...
• Staging Ground Reviewer Motivation

Hot Network Questions

• Is my magic enough to keep a person without skin alive for a month?
• How cheap would rocket fuel have to be to make Mars colonization feasible (according to Musk)?
• Textile Innovations of Pachyderms: Clothing Type
• Are others allowed to use my copyrighted figures in theses, without asking?
• What is the least number of colours Peter could use to color the 3x3 square?
• How can I make this equation look better?
• Colossians 1:16 New World Translation renders τα πάντα as “all other things” but why is this is not shown in their Kingdom Interlinear?
• Multiplicity of the smallest non-zero Laplacian eigenvalue for tree graphs
• What are the most common types of FOD (Foreign Object Debris)?
• What is the translation of this quote by Plato?
• How to truncate text in latex?
• What is the missing fifth of the missing fifths?
• How to extrude a profile along multiple curves keeping tilt equal between instances and sane normals?
• Would two switches in parallel in the same box meet code?
• Could a lawyer agree not to take any further cases against a company?
• Why does each leg of my 240V outlet measure 125V to ground, but 217V across the hot wires?
• Is the 2024 Ukrainian invasion of the Kursk region the first time since WW2 Russia was invaded?
• How long should a wooden construct burn (and continue to take damage) until it burns out (and stops doing damage)
• Parsing and processing "resolvectl statistics" output using awk
• Where is this railroad track as seen in Rocky II during the training montage?
• Can population variance from multiple studies be averaged to use for a sample size calculation?
• is it possible to add a stepwise counter for assigning a number to each text block?
• Could they free up a docking port on ISS by undocking the emergency vehicle and letting it float next to the station for a little while
• What is this phenomenon?

No matches found: ‘azurerm_role_assignment.example[kv01]

Hello Team,

I am having issue with importing the resource which is already created. I checked all the possible option but still having the issue.

I am using the below command based on the plan

terraform import --var-file nonprod.tfvars ‘module.key_vault[“kv01”].azurerm_key_vault.az_vlt’ “/subscriptions/0000000/resourceGroups/xxxxxx-01/providers/Microsoft.KeyVault/vaults/xxxxxxxx”

After that getting below error

no matches found: ‘azurerm_role_assignment.example[kv01]’

Hi @sumitraj0103 ,

If the message you shared is exactly what Terraform returned then it seems that something has stripped out the quotes from the resource address you specified on the command line.

If you are using PowerShell on Windows then unfortunately it does have a habit of misinterpreting command line arguments like this, so you might have better luck if you use cmd.exe (Windows Command Prompt) instead.

If you that then you must use the standard conventions for command line escaping on Windows: single quotes aren’t supported, so you will need to write it not in quotes and then use a backslash to escape the two quotes that are part of the resource instance address: \"