Data Management:Database backup service (DBS)

Symptom

On the Backup Schedules page, a failed backup schedule has a status of Error.

Cause

The Error status means that at least one task in the backup schedule failed. This can be a full backup, an incremental backup, or another type of task.

Resolution

Data Disaster Recovery offers the following solutions for failed backup tasks.

Procedure

1. Click Rectify in the Status column of the failed backup schedule. You are redirected to the page for the failed backup task.

   If the failed task is a full backup, you are redirected to the Full Data page. If the failed task is an incremental backup, you are redirected to the Incremental Data page.

2. Choose a solution to fix the failed backup task.

   • To restart the failed backup task, click Restart Backup.

     Note

     If the failed task is a full backup, consider the impact of the backup operation on the source database before you restart the task. Perform this action during off-peak hours.

   • To ignore the error, click Ignore Error.

   • To troubleshoot the issue, hover over the exclamation point (!) icon to view the error message. Then, click View Exception Fixing Suggestions (for a failed full backup) or View Incremental Exception Fixing Suggestions (for a failed incremental backup). You are redirected to the Common errors topic. Search for the error message in the topic.

     Note

     If you cannot locate the error message, the failure might be caused by another type of task. In this case, contact us in the DBS customer support group (DingTalk group ID: 35585947).

Step 1: Authorize DBS service-linked role

The DBS service-linked role, AliyunServiceRoleForDBS, is a RAM role that grants permissions to access other cloud services. When DBS needs to access your Alibaba Cloud databases, such as ApsaraDB for RDS, ApsaraDB for MongoDB, ApsaraDB for Redis, or PolarDB, or a self-managed database hosted on an Elastic Compute Service (ECS) instance, it uses AliyunServiceRoleForDBS to obtain the required permissions. For more information, see service-linked roles.

The first time you use DBS, you must grant the service-linked role (AliyunServiceRoleForDBS) to DBS. For more information about the permissions, see Appendix: AliyunServiceRoleForDBS.

1. Log in to DMS 5.0.

2. In the top navigation bar, choose Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Disaster Recovery Data Source.

   Note

   If you use the DMS console in simple mode, move the pointer over the icon in the upper-left corner of the DMS console and choose All Features > Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Disaster Recovery Data Source.

3. In the dialog box that appears, click Authorize DBS SLR.

   Note

   If the authorization dialog box does not appear after you log on to the DBS console, skip the remaining steps in this topic and proceed to create a backup. For more information, see Manage a backup by using a disaster recovery data source or Create a backup from the backup plan list.

4. Click OK.

   The DBS service-linked role (AliyunServiceRoleForDBS) is created. If you need to delete the service-linked role (AliyunServiceRoleForDBS), see Delete a RAM role.

Step 2: Activate OSS

Activating Object Storage Service (OSS) does not incur fees. After activation, when you use Data Disaster Recovery to create backups, Data Disaster Recovery can store the backup data in OSS (cloud storage).

1. Log on to the Data Management Service (DMS) 5.0 console.

2. In the top navigation bar, choose Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Plan.

   Note

   If you use the DMS console in simple mode, move the pointer over the icon in the upper-left corner of the DMS console and choose All Features > Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Plan.

3. In the dialog box that appears, click Activate OSS Now.

4. In the dialog box that appears, click Activate Now.

5. On the Object Storage Service (OSS) page, read the service agreement, select the agreement checkbox, and then click Activate Now.

You have now activated the DBS service.

Appendix: AliyunServiceRoleForDBS

Role name: AliyunServiceRoleForDBS

Policy: AliyunServiceRolePolicyForDBS

Permissions:

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "rds:DescribeDBInstanceNetInfo",
        "rds:DescribeDBInstanceNetInfoForChannel",
        "rds:DescribeTasks",
        "rds:DescribeDBInstances",
        "rds:DescribeFilesForSQLServer",
        "rds:DescribeImportsForSQLServer",
        "rds:DescribeSlowLogRecords",
        "rds:DescribeBinlogFiles",
        "rds:DescribeSQLLogRecords",
        "rds:DescribeParameters",
        "rds:DescribeParameterTemplates",
        "rds:DescribeDBInstanceAttribute",
        "rds:DescribeDatabases",
        "rds:DescribeAccounts",
        "rds:DescribeSecurityIPList",
        "rds:DescribeSecurityIps",
        "rds:DescribeDBInstanceIPArray",
        "rds:DescribeDBInstanceIPArrayList",
        "rds:DescribeDBInstanceSSL",
        "rds:DescribeDBInstanceTDE",
        "rds:CreateDBInstance",
        "rds:CreateAccount",
        "rds:CreateDatabase",
        "rds:ModifySecurityIps",
        "rds:GrantAccountPrivilege",
        "rds:CreateMigrateTask",
        "rds:CreateOnlineDatabaseTask",
        "rds:DescribeMigrateTasks",
        "rds:DescribeOssDownloads",
        "rds:CreateBackup",
        "rds:DescribeBackups",
        "rds:DescribeBackupPolicy",
        "rds:ModifyBackupPolicy",
        "rds:DescribeBackupTasks",
        "rds:DescribeBinlogFiles"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecs:DescribeInstance",
        "ecs:DescribeInstances",
        "ecs:DescribeVpcs",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeSecurityGroupAttribute",
        "ecs:AuthorizeSecurityGroup",
        "ecs:JoinSecurityGroup",
        "ecs:RevokerSecurityGroup"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "kms:ListKeys"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "cms:PutEventRule",
        "cms:PutEventTargets",
        "cms:ListEventRules",
        "cms:ListEventTargetsByRule",
        "cms:DeleteEventRule",
        "cms:DeleteEventTargets"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "polardb:DescribeDBClusterIPArrayList",
        "polardb:DescribeDBClusterNetInfo",
        "polardb:DescribeDBClusters",
        "polardb:ModifySecurityIps",
        "polardb:DescribeDBClusterEndpoints",
        "polardb:DescribeDBClusterAccessWhitelist",
        "polardb:ModifyDBClusterAccessWhitelist"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "dds:DescribeDBInstanceAttribute",
        "dds:DescribeReplicaSetRole",
        "dds:DescribeSecurityIps",
        "dds:DescribeDBInstances",
        "dds:ModifySecurityIps"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "kvstore:DescribeSecurityIps",
        "kvstore:DescribeInstances",
        "kvstore:DescribeAccounts",
        "kvstore:DescribeDBInstanceNetInfo",
        "kvstore:CreateAccount",
        "kvstore:ModifySecurityIps",
        "kvstore:DescribeInstanceAttribute",
        "kvstore:AllocateInstancePrivateConnection",
        "kvstore:DescribeLogicInstanceTopology"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "drds:DescribeDrdsDB",
        "drds:DescribeDrdsDBs",
        "drds:DescribeDrdsDbInstance",
        "drds:DescribeDrdsDbInstances",
        "drds:DescribeDrdsDBIpWhiteList",
        "drds:DescribeDrdsInstances",
        "drds:ModifyDrdsIpWhiteList",
        "drds:CreateDrdsDB",
        "drds:DescribeTable",
        "drds:DescribeTables",
        "drds:ModifyRdsReadWeight",
        "drds:ChangeAccountPassword",
        "drds:CreateDrdsInstance",
        "drds:CreateInstanceAccount",
        "drds:CreateInstanceInternetAddress",
        "drds:DescribeInstanceAccounts"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "vpc:DescribeVpcs"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },    
    {
       "Action": [
         "bssapi:QueryResourcePackageInstances"
      ],
       "Resource": "*",
       "Effect": "Allow"
    },
    {
      "Action": "hdm:AddHDMInstance",
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
          "StringEquals": {
              "ram:ServiceName": "dbs.aliyuncs.com"
          }
        }
    }
  ]
}

Error scenario

When you configure a backup schedule in the Data Disaster Recovery console, the precheck fails. The error message indicates that the binlog_format parameter of the source database is not set to ROW. For more information, see Back up on-premises and third-party cloud databases.

To resolve this issue, run the set global binlog_format=ROW command on the source database and then terminate all active connections. If you do not terminate the connections, existing sessions may continue to write data in a non-ROW format, which causes inconsistent incremental data.

Usage notes

• The binlog_format parameter must be set to ROW. In ROW mode, the binary log records the complete before-image and after-image for any Data Manipulation Language (DML) operations. This detailed logging is essential for data restoration.

• Setting binlog_format to STATEMENT or MIXED is not recommended. The ROW format is more stable and reliable for backup and recovery purposes.

• Changing binlog_format to ROW only affects the content of the binary log and does not impact database queries. However, we recommend that you terminate all active database connections to ensure all connections use the ROW format.

Procedure

1. Use a privileged account to connect to the source database and run the following command to set binlog_format to ROW.

   SET GLOBAL binlog_format = 'ROW';

   To verify the current value of the binlog_format parameter, run the following command:

   SHOW GLOBAL VARIABLES LIKE 'binlog_format';

2. Terminate all active connections to the database. This step is critical to prevent existing sessions from writing data in a non-ROW format, which causes inconsistent incremental data.

Prerequisites

• You have purchased a backup schedule. For more information, see Create a backup schedule.

  Note

  When you purchase the backup schedule, select MySQL as the database type and logical backup as the backup method.

• You have created a read-only ApsaraDB RDS for MySQL instance. For more information, see Create a read-only ApsaraDB RDS for MySQL instance.

• Method 1: Configure a backup schedule using a public endpoint:

  • Obtain the public endpoint of the read-only instance. For more information, see View and manage instance endpoints and port numbers.

  • Add the CIDR blocks of Database Backup Service (DBS) to the whitelist of the read-only instance. For more information, see Configure an IP whitelist.

    Note

    When you configure the backup schedule, select Self-managed database with Public IP:Port for Database Location, and then click How to Add to Whitelist to obtain the CIDR blocks of Database Backup Service (DBS).

    You must also specify parameters such as Backup Method, Database Type, and Connection Address.

• Method 2: Configure a backup schedule using an internal endpoint:

  • You have obtained the internal endpoint of the read-only instance and used the ping command locally to get its current internal IP address.

    ~ % ping rr-bp1xxx.mysql.rds.aliyuncs.com
    PING rr-bp1xxx.mysql.rds.aliyuncs.com (172.xx.xxx.101): 56 data bytes
    Request timeout for icmp_seq 0
    Request timeout for icmp_seq 1

    Important

    The internal IP address that you obtain may change in some scenarios, which can cause the backup to fail. For more information, see What are the impacts of a backup on a database?.

  • You have added the CIDR blocks of Database Backup Service (DBS) to the whitelist of the read-only instance. For more information, see Configure an IP whitelist.

    Note

    When you configure the backup schedule, select RDS Instance for Database Location, and then click How to Add to Whitelist to obtain the CIDR blocks of Database Backup Service (DBS).

Considerations

• Binlog replication may be delayed during backups over the public network. We recommend setting a higher value for the local log Retention Period on the Backup Policy tab of the Backup and Restoration page for your read-only ApsaraDB RDS for MySQL instance. The default retention period is 18 hours.

• When you configure a backup schedule using an internal endpoint, the internal IP address can change if you clone the read-only instance, migrate it to another availability zone, or change its VPC or vSwitch. A change in the IP address causes the connection to the source instance to fail, resulting in a backup failure.

  If this occurs, obtain a new current internal IP address as described in the Prerequisites section, and then modify the backup source database. Save the changes.

Procedure

You can configure a backup plan for an ApsaraDB RDS for MySQL read-only instance by selecting one of two options for Database Location: A self-managed database with a public IP address and port or A self-managed database connected through Express Connect, a VPN Gateway, or an Intelligent Gateway.

Obtain internal and public endpoints

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. On the Basic Information page, click View Connection Details to view the internal and public endpoints of the read-only instance. The Database Connection page lists the Internal Endpoint and Public Endpoint with their corresponding port numbers. The internal endpoint uses the format rr-bp1xxx.mysql.rds.aliyuncs.com.

   Note

   If the read-only instance does not have a public endpoint, click Apply for Public Endpoint in the Public Endpoint row on the Database Connection page, and then click OK. The new endpoint is displayed after it is enabled.

FAQ

• Q: Why does my backup schedule fail to connect to the source instance when using an internal IP address, and how do I fix it?

  A: Possible causes: The internal IP address used in Method 2 is dynamic and can change if you clone the read-only instance, migrate it to another availability zone, or change its VPC or vSwitch. This change breaks the connection to the source instance and causes the backup to fail.

  Solution: Use the internal endpoint of the read-only instance and run the ping command locally to obtain a new current internal IP address. Then, modify the backup source database and save the changes.

  ~ % ping rr-bp1xxx.mysql.rds.aliyuncs.com
  PING rr-bp1xxx.mysql.rds.aliyuncs.com (172.xx.xxx.101): 56 data bytes
  Request timeout for icmp_seq 0
  Request timeout for icmp_seq 1

• Q: Does Database Backup Service (DBS) support full and incremental backups of a read-only instance?

  A: Yes, DBS supports both.