Visham Rawat

RSA SA 10.6.6 Backup - Error backing /etc directory

Discussion created by Visham Rawat on Sep 11, 2019
Latest reply on Sep 16, 2019 by John Snider

Upgrade from RSA SA 10.6.6 to NetWitness 11.3. I've run the backup script, and am getting the following error for 4 of my 18 machines, others are fine.


2019-09-10 18:32:47 +0100 | 29554 | Backing up ETC(/etc) files from: VLC
2019-09-10 18:32:55 +0100 | 29554 | WARNING: Errors occurred while backing up /etc directory.
2019-09-10 18:32:55 +0100 | 29554 | Verify contents of VLC-
2019-09-10 18:32:55 +0100 | 29554 | Located in /var/netwitness/database/nw-backup/2019-09-10/VLC-


I looked up another thread on a similar error. However, in my case on running the lsattr command on the /etc folder, I don't find any -------i------ flagged files.

This usually happens when something changes in the directory in the course of the backup, or there is file or folder with the immutable flag set.

lsattr /root

lsattr /etc/ssh

if any of the files show an ------i------- then the immutable flag is set and you need to remove it using

chattr -i <filename>