Merge pull request #106469 from dcurwin/mar4-2020

PRMerger10 · web-flow · commit 9e522d2cb5c5 · 2020-03-04T08:20:35.000-08:00
Three changes
diff --git a/articles/backup/backup-azure-restore-files-from-vm.md b/articles/backup/backup-azure-restore-files-from-vm.md
@@ -59,7 +59,7 @@ Refer to the [Access requirements](#access-requirements) section to make sure th
 
 #### For Windows
 
-When you run the executable, the operating system mounts the new volumes and assigns drive letters. You can use Windows Explorer or File Explorer to browse those drives. The drive letters assigned to the volumes may not be the same letters as the original virtual machine. However, the volume name is preserved. For example, if the volume on the original virtual machine was “Data Disk (E:`\`)”, that volume can be attached on the local computer as “Data Disk ('Any letter':`\`). Browse through all volumes mentioned in the script output until you find your files or folder.  
+When you run the executable, the operating system mounts the new volumes and assigns drive letters. You can use Windows Explorer or File Explorer to browse those drives. The drive letters assigned to the volumes may not be the same letters as the original virtual machine. However, the volume name is preserved. For example, if the volume on the original virtual machine was "Data Disk (E:`\`)", that volume can be attached on the local computer as "Data Disk ('Any letter':`\`). Browse through all volumes mentioned in the script output until you find your files or folder.  
 
    ![File recovery menu](./media/backup-azure-restore-files-from-vm/volumes-attached.png)
 
@@ -119,7 +119,7 @@ To list all logical volumes, names, and their paths in a volume group:
 
 ```bash
 #!/bin/bash
-lvdisplay <volume-group-name from the pvs command’s results>
+lvdisplay <volume-group-name from the pvs command's results>
 ```
 
 To mount the logical volumes to the path of your choice:
@@ -251,9 +251,9 @@ If you have problems while recovering files from the virtual machines, check the
 | ------------------------ | -------------- | ------------------ |
 | Exe output: *Exception caught while connecting to target* | The script isn't able to access the recovery point    | Check whether the machine fulfills the [previous access requirements](#access-requirements). |  
 | Exe output: *The target has already been logged in via an iSCSI session.* | The script was already executed on the same machine and the drives have been attached | The volumes of the recovery point have already been attached. They may NOT be mounted with the same drive letters of the original VM. Browse through all the available volumes in the file explorer for your file. |
-| Exe output: *This script is invalid because the disks have been dismounted via portal/exceeded the 12-hr limit. Download a new script from the portal.* |    The disks have been dismounted from the portal or the 12-hour limit was exceeded | This particular exe is now invalid and can’t be run. If you want to access the files of that recovery point-in-time, visit the portal for a new exe.|
+| Exe output: *This script is invalid because the disks have been dismounted via portal/exceeded the 12-hr limit. Download a new script from the portal.* |    The disks have been dismounted from the portal or the 12-hour limit was exceeded | This particular exe is now invalid and can't be run. If you want to access the files of that recovery point-in-time, visit the portal for a new exe.|
 | On the machine where the exe is run: The new volumes aren't dismounted after the dismount button is clicked | The iSCSI initiator on the machine isn't responding/refreshing its connection to the target and maintaining the cache. |  After clicking **Dismount**, wait a few minutes. If the new volumes aren't dismounted, browse through all volumes. Browsing all volumes forces the initiator to refresh the connection, and the volume is dismounted with an error message that the disk isn't available.|
-| Exe output: The script is run successfully but “New volumes attached” is not displayed on the script output |    This is a transient error    | The volumes will have been already attached. Open Explorer to browse. If you're using the same machine for running scripts every time, consider restarting the machine and the list should be displayed in the subsequent exe runs. |
+| Exe output: The script is run successfully but "New volumes attached" is not displayed on the script output |    This is a transient error    | The volumes will have been already attached. Open Explorer to browse. If you're using the same machine for running scripts every time, consider restarting the machine and the list should be displayed in the subsequent exe runs. |
 | Linux specific: Not able to view the desired volumes | The OS of the machine where the script is run may not recognize the underlying filesystem of the protected VM | Check whether the recovery point is crash-consistent or file-consistent. If file-consistent, run the script on another machine whose OS recognizes the protected VM's filesystem. |
 | Windows specific: Not able to view the desired volumes | The disks may have been attached but the volumes weren't configured | From the disk management screen, identify the additional disks related to the recovery point. If any of these disks are in an offline state, try bringing them online by right-clicking on the disk and click **Online**.|
 
@@ -289,7 +289,7 @@ To browse files and folders, the script uses the iSCSI initiator in the machine
 
 We use a mutual CHAP authentication mechanism so that each component authenticates the other. This means it's extremely difficult for a fake initiator to connect to the iSCSI target and for a fake target to be connected to the machine where the script is run.
 
-The data flow between the recovery service and the machine is protected by building a secure SSL tunnel over TCP ([TLS 1.2 should be supported](#system-requirements) in the machine where script is run).
+The data flow between the recovery service and the machine is protected by building a secure TLS tunnel over TCP ([TLS 1.2 should be supported](#system-requirements) in the machine where script is run).
 
 Any file Access Control List (ACL) present in the parent/backed up VM are preserved in the mounted file system as well.
 
diff --git a/articles/backup/backup-sql-server-azure-troubleshoot.md b/articles/backup/backup-sql-server-azure-troubleshoot.md
@@ -16,6 +16,7 @@ For more information about the backup process and limitations, see [About SQL Se
 To configure protection for a SQL Server database on a virtual machine, you must install the **AzureBackupWindowsWorkload** extension on that virtual machine. If you get the error **UserErrorSQLNoSysadminMembership**, it means your SQL Server instance doesn't have the required backup permissions. To fix this error, follow the steps in [Set VM permissions](backup-azure-sql-database.md#set-vm-permissions).
 
 ## Troubleshoot discover and configure issues
+
 After creating and configuring a Recovery Services vault, discovering databases and configuring backup is a two-step process.<br>
 
 ![sql](./media/backup-azure-sql-database/sql.png)
@@ -30,9 +31,26 @@ During the backup configuration, if the SQL VM and its instances are not visible
 
 - If the vault in which the SQL VM is registered in the same vault used to protect the databases, then follow the [Configure Backup](https://docs.microsoft.com/azure/backup/backup-sql-server-database-azure-vms#configure-backup) steps.
 
-If the SQL VM needs to be registered in the new vault, then it must be unregistered from the old vault.  Unregistration of a SQL VM from the vault requires all the protected data sources to be stop protected and then you can delete the backed up data. Deleting backed up data is a destructive operation.  After you have reviewed and taken all the precautions to unregister the SQL VM, then register this same VM with a new vault and retry the backup operation.
+If the SQL VM needs to be registered in the new vault, then it must be unregistered from the old vault.  Unregistration of a SQL VM from the vault requires all the protected data sources to be stop protected and then you can delete the backed-up data. Deleting backed up data is a destructive operation.  After you have reviewed and taken all the precautions to unregister the SQL VM, then register this same VM with a new vault and retry the backup operation.
+
+## Troubleshoot Backup and Recovery issues  
+
+At times, either random failures may happen in backup and restore operations or those operations might get stuck. This may be because of antivirus programs on your VM. As a best practice, we suggest the following steps:
+
+1. Exclude the following folders from antivirus scanning:
 
+    `C:\Program Files\Azure Workload Backup`
+    `C:\WindowsAzure\Logs\Plugins\Microsoft.Azure.RecoveryServices.WorkloadBackup.Edp.AzureBackupWindowsWorkload`
 
+    Replace `C:\` with the letter of your *SystemDrive*.
+
+1. Exclude the following three processes running within a VM from antivirus scanning:
+
+    - IaasWLPluginSvc.exe
+    - IaasWorkloadCoordinaorService.exe
+    - TriggerExtensionJob.exe
+
+1. SQL also offers some guidelines about to work with antivirus programs. See [this article](https://support.microsoft.com/help/309422/choosing-antivirus-software-for-computers-that-run-sql-server) for details.
 
 ## Error messages
 
@@ -145,7 +163,6 @@ Operation is blocked as the vault has reached its maximum limit for such operati
 |---|---|---|
 The VM is not able to contact Azure Backup service due to internet connectivity issues. | The VM needs outbound connectivity to Azure Backup Service, Azure Storage or Azure Active Directory services.| - If you use NSG to restrict connectivity, then you should use the AzureBackup service tag to allows outbound access to Azure Backup to Azure Backup Service, Azure Storage or Azure Active Directory services. Follow these [steps](https://docs.microsoft.com/azure/backup/backup-sql-server-database-azure-vms#allow-access-using-nsg-tags) to grant access.<br>- Ensure DNS is resolving Azure endpoints.<br>- Check if the VM is behind a load balancer blocking internet access. By assigning public IP to the VMs, discovery will work.<br>- Verify there is no firewall/antivirus/proxy that is blocking calls to the above three target services.
 
-
 ## Re-registration failures
 
 Check for one or more of the following symptoms before you trigger the re-register operation:
diff --git a/articles/backup/restore-sql-database-azure-vm.md b/articles/backup/restore-sql-database-azure-vm.md
@@ -106,24 +106,25 @@ To restore the backup data as .bak files instead of a database, choose **Restore
 2. Select the SQL Server name to which you want to restore the backup files.
 3. In the **Destination path on the server** input the folder path on the server selected in step 2. This is the location where the service will dump all the necessary backup files. Typically, a network share path, or path of a mounted Azure file share when specified as the destination path, enables easier access to these files by other machines in the same network or with the same Azure file share mounted on them.<BR>
 
->To restore the database backup files on an Azure File Share mounted on the target registered VM, make sure that NT AUTHORITY\SYSTEM has access to the file share. You can perform the steps given below to grant the read/write permissions to the AFS mounted on the VM:
->- Run `PsExec -s cmd` to enter into NT AUTHORITY\SYSTEM shell
->   - Execute `cmdkey /add:<storageacct>.file.core.windows.net /user:AZURE\<storageacct> /pass:<storagekey>`
->   - Verify access with `dir \\<storageacct>.file.core.windows.net\<filesharename>`
->- Kick off a restore as files from the Backup Vault to `\\<storageacct>.file.core.windows.net\<filesharename>` as the path<BR>
-You can download Psexec via <https://docs.microsoft.com/sysinternals/downloads/psexec>
+    >To restore the database backup files on an Azure File Share mounted on the target registered VM, make sure that NT AUTHORITY\SYSTEM has access to the file share. You can perform the steps given below to grant the read/write permissions to the AFS mounted on the VM:
+    >
+    >- Run `PsExec -s cmd` to enter into NT AUTHORITY\SYSTEM shell
+    >   - Execute `cmdkey /add:<storageacct>.file.core.windows.net /user:AZURE\<storageacct> /pass:<storagekey>`
+    >   - Verify access with `dir \\<storageacct>.file.core.windows.net\<filesharename>`
+    >- Kick off a restore as files from the Backup Vault to `\\<storageacct>.file.core.windows.net\<filesharename>` as the path<BR>
+    You can download Psexec via <https://docs.microsoft.com/sysinternals/downloads/psexec>
 
 4. Select **OK**.
 
-![Select Restore As Files](./media/backup-azure-sql-database/restore-as-files.png)
+    ![Select Restore As Files](./media/backup-azure-sql-database/restore-as-files.png)
 
 5. Select the **Restore Point** corresponding to which all the available .bak files will be restored.
 
-![Select a Restore Point](./media/backup-azure-sql-database/restore-point.png)
+    ![Select a Restore Point](./media/backup-azure-sql-database/restore-point.png)
 
 6. All the backup files associated with the selected recovery point are dumped into the destination path. You can restore the files as a database on any machine they are present on using SQL Server Management Studio.
 
-![Restored Backup Files in Destination Path](./media/backup-azure-sql-database/sql-backup-files.png)
+    ![Restored Backup Files in Destination Path](./media/backup-azure-sql-database/sql-backup-files.png)
 
 ### Restore to a specific point in time
 
@@ -158,6 +159,9 @@ If you've selected **Full & Differential** as the restore type, do the following
 
     ![Choose a full recovery point](./media/backup-azure-sql-database/choose-fd-recovery-point.png)
 
+    >[!NOTE]
+    > By default, recovery points from the last 30 days are displayed. You can display recovery points older than 30 days by clicking **Filter** and selecting a custom range.
+
 1. On the **Advanced Configuration** menu, if you want to keep the database nonoperational after the restore, enable **Restore with NORECOVERY**.
 1. If you want to change the restore location on the destination server, enter a new target path.
 1. Select **OK**.
