Troubleshooting

Troubleshooting#

Permission denied error when saving Bacula configuration# 

Error 1000: Internal error.
[Warning] file_put_contents(/etc/bacula/bacula-dir.conf): failed to open stream:
Permission denied (@line 56 in file
/var/www/bacularis/protected/Common/Modules/ConfigBacula.php).

The web server user of the Bacularis API requires read/write access to the Bacula configuration files. It requires manual administrator action to set proper permission to files. Bacularis does not solve this issue automatically.

Below you can find two hints, how this problem can be solved:

Hint 1: assign web server user to Bacula group

If your Bacula daemons use bacula user with group bacula, you can assign the web server user to bacula group, for example for apache user the comman can look as below:

usermod -a -G bacula apache

After running this command the web server (or PHP-FPM if used) needs to restarted (example for the Apache web server).

systemctl restart php-fpm
systemctl restart httpd

Hint 2: make sure that permissions for Bacula config files are correct

If you applied Hint 1, now you need to check if all Bacula configuration files have appropriate system group assigned. In many cases it is group bacula:

# ls -la /etc/bacula
drwxr-xr-x  3 root   bacula 4096 2022-02-05  .
drwxr-xr-x 86 root   root   4096 08-18 07:42 ..
-rw-rw----  1 bacula bacula 4100 03-25 06:24 bacula-dir.conf
-rw-rw----  1 root   bacula 1128 2022-01-16  bacula-fd.conf
-rw-rw----  1 bacula bacula 1607 2022-02-05  bacula-sd.conf
-rw-rw----  1 root   bacula  266 2022-01-16  bconsole.conf

Please note that the Bacula config directory should have permissions rwxr-xr-x that does allow to modify existing files by bacula user but does not allow creating new config files. To enable creating new files by user group you should set the directory permissions to rwxrwxr-x.

Bacula config file permissions are rw-rw---- that gives read/write access for the file owner/group.

HTTP error 500 and no interface page is loading#

If after successful installation you experienced the HTTP error 500 and you are not able to load the web interface, please make sure that your PHP is at least in version 7.4 or greater. From Bacularis 2.1.0 minimal PHP version has been changed from 7.1 to 7.4.

CentOS 8 / CentOS Stream 8 / AlmaLinux 8 / Oracle Linux 8 / Rocky Linux 8

By default on these systems is installed PHP version 7.2. Please switch PHP to 7.4 or greater by the following command:

dnf module switch-to php:7.4

After that please refresh the Bacularis web page.

Error 100 after switching connection from HTTP to HTTPS#

After switching connection from HTTP to HTTPS (or reverse) you will encounter this error displayed in the red error window:

Error code: 100
Message: Problem with connection to remote host. cURL error

It happens because the connection between Web -> API has to be updated in the Bacularis configuration.

To solve this error, please go to:

[Page: Security] => [Tab: API hosts] => [Button: 'Edit' for current API host] => [Field: Protocol]

change in the select field the HTTP into HTTPS and save the form.

Here you can see the solution on screenshots:

../_images/bacularis_ssl_cert_changed_fix1.png

../_images/bacularis_ssl_cert_changed_fix2.png

File daemon crashes after running Bacularis plugins (MySQL, MariaDB…)#

If your file daemon crashes after each job with using Bacularis plugins it can mean than you use Bacula 15.0.0 - 15.0.2. In the Bacula 15.0.0 - 15.0.2 in the BPIPE plugin is a bug that causes the file daemon segfault and crash. We reported this problem to the Bacula Community bug tracker and it has been fixed in Bacula 15.0.3:

https://gitlab.bacula.org/bacula-community-edition/bacula-community/-/issues/2737

To use the Bacularis plugins (MySQL, MariaDB) with Bacula 15.0.0 - 15.0.2 you can choose one of the ways:

  • Upgrade the Bacula file daemon to version 15.0.3 or greater.

OR

  • Downgrade the Bacula file daemon to version 13.0 or lower. Newer Bacula director and storage daemon work well with older file daemons.

OR

  • If you want to have the file daemon 15.0.0 - 15.0.2 you can patch and compile Bacula file daemon.

OR

  • Prepare a script that after finishing a job will restart the Bacula file daemon

U2F security key authentication does not work#

U2F authentication requires having in Bacularis encrypted HTTPS connection with valid TLS/SSL certificate. It also requires using domain name instead of IP address. If you use HTTP or IP address, U2F key authentication will not work.

Also please make sure if you use the same domain name to access Bacularis as you used to register U2F keys in Bacularis. Access form subdomains is allowed, but from different domains not.

Not possible to enable TOTP 2FA function#

In version 5.0.0 there is a bug that causes TOTP 2FA function not possible to enable for new users. If user already used 2FA in previous versions, this problem does not happen. This bug has been fixed in next release after 5.0.0. Please also see the workaround below.

Workaround

To enable TOTP 2FA in version 5.0.0, please first click Save button in the Two-factor authentication method setting on the Account settings page as shown on the screenshot below. After this action the TOTP 2FA function will be possible to enable.

../_images/bacularis_totp_2fa_bug_enable_workaround.png

Error 1000 when you go to Volumes page# 

Error 1000 - Internal error. [Warning] strtotime(): It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected the timezone 'UTC' for now, but please set date.timezone to select your timezone. (@line 135 in file /var/www/bacularis/protected/API/Modules/VolumeManager.php).

To solve this error please set a timezone in the PHP configuration file. You can do it the php.ini file, for example:

date.timezone = "Europe/Warsaw"

To check your timezone, please look at the list of all timezones possible to set in the php.ini file.

Error during Bacula installation in initial wizard on Ubuntu 22.04 Jammy#

The Bacularis initial wizard installs Bacula using system package repositories. On Ubuntu 22.04 Jammy in system repositories the Bacula packages are not available. This is the only Ubuntu version in which the Bacula packages temporary were not provided. It causes that the default installation in the Bacularis initial wizard fails.

Long time after releasing Ubuntu 22.04 the Bacula system packages were published in additional repository called jammy-proposed. To avoid occuring the error in initial wizard on Ubuntu 22.04 Jammy, please before installing Bacula through the initial wizard, add this jammy-proposed repository to your operating system as follows:

echo 'deb http://security.ubuntu.com/ubuntu/ jammy-proposed universe' > /etc/apt/sources.list.d/jammy-proposed.list
apt update

Once it is done, the Bacula installation process in initial wizard can be repeated. It will continue in place where it finished in previous try.

Error about a problem with connection to bconsole when using Docker image#

If you run Bacularis using Docker container image and you experienced the following error in the web interface error window:

Error code: 4
Message: Problem with connection to bconsole. Output=>Connecting to Director localhost:9101, Exitcode=>1

it can mean that Docker set limit of opened filed in container to a big value. Bacula has a problem with starting if this limit is high. It is reported in the Bacula bug tracker here:

https://gitlab.bacula.org/bacula-community-edition/bacula-community/-/issues/2716

You can check this number by ulimit command executed inside the container:

ulimit -n

As a workaround you can set this open file limit for Docker containers in Docker Systemd unit like here:

/usr/lib/systemd/system/docker.service

by adding there a new parameter for dockerd:

--default-ulimit nofile=1024:1024

This dockerd line can look like this one:

ExecStart=/usr/bin/dockerd --default-ulimit nofile=1024:1024 -H fd:// --containerd=/run/containerd/containerd.sock

At the end please reload Systemd and restart Docker:

systemctl daemon-reload
systemctl restart docker

PHP warning from preg_match() about allocation of JIT memory#

This warning can happen on systems where in PHP settings is enabled JIT (just-in-time) compilation of patterns:

[Warning] preg_match(): Allocation of JIT memory failed, PCRE JIT will be disabled. This is likely caused by security restrictions. Either grant PHP permission to allocate executable memory, or set pcre.jit=0 (@line 95 in file /usr/share/bacularis/protected/vendor/bacularis/bacularis-common/Common/Modules/BaculumUrlMapping.php).

If in your system you encounter this warning, please disable pcre.jit by editing php.ini configuration file (usually it is placed somewhere in /etc) and adding there to [Pcre] section this line:

pcre.jit=0

After saving the php.ini file, please reload the PHP configuration. For PHP-FPM it can be:

systemctl reload php-fpm

Time fields contain invalid date/time values#

Wrong timezone is set in the PHP configuration. To fix it, please update “date.timezone” option in the php.ini file, for example:

date.timezone = "Europe/Warsaw"

To check your timezone, please look at the list of all timezones possible to set in the php.ini file.

The job history list or the job files table is empty#

The reason can be a try to load too many elements, for example 20,000 jobs. In this case please check the web server logs for the Bacularis API and the Bacularis Web to make sure, that it is because of exhausted PHP memory limit.

[Error] Allowed memory size of 125829120 bytes exhausted (tried to allocate 1167360 bytes) (@line 262 in file /var/www/bacularis/protected/API/Modules/BaculumAPIServer.php).

If it is this case, you can solve in in two ways:

  • setting lower elements limit in the Bacularis Web application settings (gearwheel icon on the top left side of page),

  • increasing memory limit for PHP by setting in php.ini file for example:

memory_limit = 256M

Warning about legacy keyring on apt update command#

Using apt-key to manage package keys is deprecated. From this reason while updating repositry database you can see a warning like this:

W: https://packages.bacularis.app/stable/ubuntu/dists/jammy/InRelease: Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details.

To migrate from apt-key to a new way of storing package keys in the gpg location, please follow on steps below:

  1. Remove the Bacularis key from the APT key database

apt-key del '546E 19BB E5BD D219 644C 0851 E72D 44EC 5C3D BD51'

  1. Add the Bacularis key to the gpg keys in /usr/share/keyrings

wget -qO- https://packages.bacularis.app/bacularis.pub | gpg --dearmor > /usr/share/keyrings/bacularis-archive-keyring.gpg

  1. Edit the Bacularis repository file

vi /etc/apt/sources.list.d/bacularis.list

and to deb line the string in square bracket:

[signed-by=/usr/share/keyrings/bacularis-archive-keyring.gpg]

For example, for the Debian 11 Bullseye entries you need to change:

From:

deb https://packages.bacularis.app/stable/debian bullseye main

To:

deb [signed-by=/usr/share/keyrings/bacularis-archive-keyring.gpg] https://packages.bacularis.app/stable/debian bullseye main

If in your Bacularis repository file you have architecture defined in the deb line like here (example for Ubuntu 18.04 Bionic):

deb [arch=amd64] https://packages.bacularis.app/stable/ubuntu bionic main

the signed-by string needs to be added just after with a space character as separator:

deb [arch=amd64 signed-by=/usr/share/keyrings/bacularis-archive-keyring.gpg] https://packages.bacularis.app/stable/ubuntu bionic main

Job file list does not show results#

This problem can mean that you use Bacula 9 or older. In Bacula 11 has been changed the Bacula table format and Filename property is no longer in separate SQL table but it is added to the File table. This change has an effect on Bacularis.

In this case in the Bacularis Web debug log you will see the following error:

Column not found: 1054 Unknown column 'File.Filename' in 'field list'

The solution is to upgrade Bacula to version 11 or greater.

Job file list is empty if you sort by size or MTIME#

If you use MySQL or MariaDB database as the Bacula catalog database and if the binary log is enabled, then you can encounter a problem with sorting the job file list by size or MTIME. This can be caused by insufficient privileges to create temporary function that is used to list the file list.

To fix it, please add to the database configuration file (usually it is /etc/my.cnf) the log_bin_trust_function_creators=on directive enabled as below.

[mysqld]
log_bin_trust_function_creators=on

After adding it, you will need to reload the database configuration.

Searching by filename does not work in restore wizard#

This problem can mean that you use Bacula 9 or older. In Bacula 11 has been changed the Bacula table format and Filename property is no longer in separate SQL table but it is added to the File table. This change has an effect on Bacularis.

In this case in the Bacularis Web debug log you will see the following error:

Column not found: 1054 Unknown column 'File.Filename' in 'field list'

The solution is to upgrade Bacula to version 11 or greater.

I forgot my admin password. What should I do?#

There is possible to reset the admin user password. For all three supported authentication methods the way to reset the password will be different.

If you use the local user authentication or the HTTP basic authentication, you will need a tool to set your password. Usually it can be htpasswd that is provided in httpd-tools package on CentOS/RHEL/Rocky/OracleLinux/AlmaLinux or in apache2-utils package on Debian/Ubuntu.

  • For the local user authentication you can run the following command from the root account:

htpasswd /etc/bacularis/Web/bacularis.users YOURADMINUSER

In place YOURADMINUSER you need to type your admin username.

  • For the HTTP basic authentication you can run the following command from the root account:

htpasswd /path/to/your/users/file YOURADMINUSER

In place YOURADMINUSER you need to type your admin username.

  • For the LDAP authentication you need to change the password on the LDAP server.

Once the new password is set, you can try to log in with the new password.

How to use deployment SSH key to other purposes#

If you use SSH keys authentication to deploy Bacularis and Bacula components to remote hosts, you might want to reuse the SSH key also to other purposes than deployment, e.g. outisde Bacularis. The SSH keys added to Bacularis Web have owner/group set the same as web server/PHP user and group. The permissions are set to 600 (only owner has read/write permissions). To be able reuse the key for example in some scripts executed by Bacula in Runscript, you need to make the key accessible for Bacula user. Below you can find two ways for solving it.

1. Use sudo for executing SSH#

In this way please add to /etc/sudoers.d/bacularis file the following line in form as below:

YOUR_USER ALL = (WEB_SERVER_USER) NOPASSWD: /usr/bin/ssh

For example, if your Bacula user is bacula and web server user is www-data, the sudoers line can look like here:

bacula ALL = (www-data) NOPASSWD: /usr/bin/ssh

After adding it, the SSH command executed from bacula account can look like this:

sudo -u www-data ssh -i /etc/bacularis/Web/ssh_key1.pem gani@10.0.0.201

2. Change SSH key permissions#

In this way you can change permissions and the SSH key group to Bacula group.

Below you can find example for web server user www-data and group bacula.

chown www-data:bacula /etc/bacularis/Web/ssh_key1.pem
chmod 660 /etc/bacularis/Web/ssh_key1.pem

After this change you can use SSH connection in your script:

ssh -i /etc/bacularis/Web/ssh_key1.pem gani@10.0.0.201

(Adding this section to this Troubleshooting chapter was inspired by @sitemapxml idea in the Bacularis GitHub issue here: bacularis/bacularis-app#46)

Where to find help?#

User group#

For getting help with installing and configuring Bacularis you can use the Bacularis User Group at the address:

https://group.bacularis.app

Bug tracker#

If you find a bug in Bacularis, you can report it to the Bacularis APP GitHub Project at:

bacularis/bacularis-app#issues