Troubleshoot Cloud Backup client network issues - Cloud Backup

Diagnose and resolve network issues that cause Cloud Backup backup client failures in on-premises environments.

Background

Backup clients installed outside Alibaba Cloud VPCs may encounter network issues such as firewalls blocking domains or ports, bandwidth throttling causing timeouts, network inspection tools modifying HTTP requests, or insufficient upstream bandwidth causing backup failures.

Issue overview

Issue

Diagnostic tool output

Client logs

Analysis and troubleshooting

The console shows Failed to open the backup vault.

Diagnostic tool output:

i/o timeout
An existing connection was forcibly closed by the remote host
No connection could be made because the target machine actively refused it.
connect: no route to host

Client log messages:

i/o timeout
An existing connection was forcibly closed by the remote host
No connection could be made because the target machine actively refused it.
connect: no route to host

The backup client cannot reach the target domain. Possible causes:

Firewall rules block certain addresses or ports.
Network bandwidth is insufficient.
Upstream or downstream bandwidth is throttled.
Multiple concurrent backup jobs consume available bandwidth.
Antivirus software may interfere with the backup service.
A proxy configured on the local machine is not working correctly.
A network behavior detection tool detects non-compliant content and blocks the corresponding request.
An Express Connect failure occurs.
A VPN Gateway or Cloud Enterprise Network failure occurs.

Troubleshoot request failures.

The console shows Failed to open the backup vault.

Diagnostic tool output:

This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.

Client log message:

This is usually a temporary error during hostname resolution and means that the local server did not receive a response from an authoritative server.

DNS resolution fails. Possible causes:

The DNS server is unreachable or the connection times out.
The DNS server configuration is incorrect.
Firewall or network rules block the traffic.

Troubleshoot DNS resolution failures.

Troubleshoot request failures

Check connectivity to the Cloud Backup endpoint domain name and port.
1. Check your network firewall rules.
  
  Add the backup client endpoints and ports to your firewall allowlist.
  
  For addresses starting with http, allow port 80. For addresses starting with https, allow port 443.
2. Check whether antivirus software is enabled.
  
  Antivirus software can interfere with the Cloud Backup service process. Disable it and retry.
3. Check if a proxy (HTTP, SOCKS5, or TCP) is configured and working correctly.
  
  The proxy must correctly forward traffic for the backup client endpoint and port.
4. If you use Cloud Enterprise Network for network connectivity, contact Cloud Enterprise Network support to verify that the corresponding endpoints and ports are working correctly.
5. If you use VPN Gateway for network connectivity, contact VPN Gateway support to verify that the corresponding endpoints and ports are working correctly.
Run the telnet command to test connectivity to the endpoint and port. Check available upstream bandwidth (for backup) or downstream bandwidth (for restoration).
Use the public domain name of the control network detected by the Cloud Backup client diagnostic tool as the endpoint. Example:
```
telnet post-cn-mp90rcien05.mqtt.aliyuncs.com 80
```
1. If network monitoring is available, check the network traffic at the time of backup or restoration.
2. If you use the Internet, contact your carrier or network administrator to inquire about traffic conditions.
3. If you use Cloud Enterprise Network or VPN Gateway, check the bandwidth and view monitoring data in the Cloud Enterprise Network or VPN Gateway console.
Based on the bandwidth and the number of concurrent jobs, determine whether the current bandwidth is insufficient.

For example, if upstream bandwidth is 20 MB/s but only 10 MB/s is available for backup, request failures can occur with large data volumes.
If you cannot determine the bandwidth (especially upstream), use ossutil probe to measure it.
1. Obtain the endpoint domain name and AccessKey.
  
  Use the public domain name of the control network detected by the Cloud Backup client diagnostic tool.
2. Download and install ossutil.
  
  Download and install ossutil.
3. Measure the upload bandwidth.
  Create a temporary bucket named examplebucket. The following command uploads a test file and recommends a concurrency level based on your hardware and bandwidth:
```
./ossutil64 probe --probe-item upload-speed --bucketname examplebucket
```
  Example output:
```
cpu core count:2 
parallel:2,average speed:679.72(KB/s),current speed:1344.00(KB/s),max speed:1440.00(KB/s)) 
parallel:3,average speed:643.31(KB/s),current speed:704.00(KB/s),max speed:1632.00(KB/s)) 
parallel:4,average speed:646.62(KB/s),current speed:512.00(KB/s),max speed:1600.00(KB/s)) 
suggest parallel is 2, max average speed is 679.72(KB/s)
```
If insufficient bandwidth is confirmed, take the following actions.
1. Increase your bandwidth.
2. Configure timeout retry parameters. Increase the retry interval and count to improve the backup success rate on low-bandwidth connections.
  
  Configure data backup retry count and interval.
3. Adjust the backup job schedule to run backups when the network is idle.
4. If you have multiple backup clients and jobs, stagger their backup schedules to make the best use of the available bandwidth.

Troubleshoot DNS resolution failures

Check the DNS configuration on your local machine.

If no private DNS server is configured, set the DNS server address to the Alibaba Cloud public DNS 223.5.5.5.
Check your firewall rules. Add the backup client endpoints and ports to your allowlist.
Contact your network administrator to check for other restrictions.
After you confirm that the address reported by the diagnostic tool resolves correctly, try the backup again.