All Products
Search

This Product

    Data Management:Install a backup gateway

    Document Center

    Data Management:Install a backup gateway

    Last Updated:Mar 28, 2026

    A backup gateway is a client you install on a database server. It connects your on-premises or private-network databases to Data Disaster Recovery (DBS) by handling physical backups, restores, and automatic backup set downloads to your local server.

    When you need a backup gateway

    Install a backup gateway if your database falls into one of these scenarios:

    ScenarioHow the gateway helps
    Physical backupThe gateway starts a process on the database server that receives backup schedules from the DBS console and performs file-level backups and restores.
    Private network backupIf DBS cannot reach your database directly (for example, databases in an on-premises data center or another cloud provider's private network), the gateway acts as an outbound proxy — it initiates the connection to DBS and OSS on your behalf.
    Automatic backup set downloadThe gateway periodically pulls backup sets from cloud storage to your local server, keeping a local copy for faster recovery.
    Install the gateway only on the database server, not on other hosts.

    If your database server has no internet access, you need to install a proxy gateway on a bastion host before installing the backup gateway. See Install a proxy gateway on a bastion host.

    Prerequisites

    Before you begin, make sure you have completed all of the following:

    • Java installed on the database server:

      • Linux: Install Java Runtime Environment (JRE) 1.8. Download it from the Oracle website.

      • Windows: Install Java SE Development Kit (JDK) version 8u261. Download it from the .

      Important

      On Windows, only JDK 8u261 is supported. Other versions cause the backup precheck to fail. Run java -version to verify the installed version before proceeding.

    • An AccessKey with the required permissions. An AccessKey consists of an AccessKey ID and AccessKey Secret. The gateway uses these credentials to register with DBS. See Create an AccessKey.

      • If you are using a Resource Access Management (RAM) user, grant it the AliyunDBSFullAccess and AliyunOSSFullAccess permissions. See Grant permissions to a RAM user.

      • By default, both permissions are granted to your Alibaba Cloud account when you activate DBS.

      • After the backup gateway is added, it is visible to all users under your account in the DBS console.

      Important

      Installation fails if the AccessKey ID or AccessKey Secret is incorrect. Double-check both values before you begin.

    • More than 1 GB of free disk space at the intended installation path.

    • Server permissions:

      • Linux: root permissions

      • Windows: administrator permissions

    • (SQL Server only) The sysadmin role assigned to the NT AUTHORITY\SYSTEM account. Run the following SQL command:

      By default, NT AUTHORITY\SYSTEM is the account used to start AliyunDBSAgent.
      ALTER SERVER ROLE [sysadmin] ADD MEMBER [NT AUTHORITY\SYSTEM]
GO

    Precautions

    Install using the GUI

    The GUI installer is the default method. The installer checks whether your system supports a graphical interface (Windows, or Linux with GNOME/KDE). If no GUI is available, the installer falls back to the command-line method automatically. You can also install the backup gateway in unattended mode.

    1. Log in to the DMS console V5.0DMS console 5.0.

    2. Go to Backup Gateway:

      • Advanced mode: Move the pointer over the icon icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Gateway.

      • Normal mode: In the top navigation bar, choose Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Gateway.

    3. In the upper-right corner, click Add Backup Gateway.

    4. Copy the Windows backup gateway installation command and run it in a Windows command prompt. After the download completes, the installation package runs automatically. Follow the installation wizard:

      1. Select an installation language and click Next.

      2. Accept the agreement and click Next.

      3. Select DBS Backup Gateway and click Next. > Note: This example installs a DBS Backup Gateway to connect to on-premises data. For the bastion host architecture, see Install a proxy gateway on a bastion host.

      4. Select an installation path, click Next, and then click Confirm.

      5. Confirm the Agent Region, enter your AccessKey ID and AccessKey Secret, and click Next. > Note: > - Select the Agent Region closest to your database. Selecting the wrong region causes the gateway to show as offline in the console. > - The AccessKey information is stored in plaintext in .\config\dbs-agent.conf in the installation directory. > - For a bastion host architecture, enter the bastion host's private IP address in Database Gateway Address. The Database Gateway Port defaults to 9797.

      6. Confirm the component package selection and click Next. Installation takes 1 to 5 minutes.

      7. When installation finishes, click Next, then click Done.

      Installation command

    5. Open the Windows Run dialog, type services.msc, and click OK to open Service Manager.

    6. In Service Manager, verify that AliyunDBSAgent is running. If it is not, right-click AliyunDBSAgent and select Start.

    7. Back in the DBS console, on the Backup Gateway page, click Refresh to confirm the new gateway appears and shows as online.

      Backup Gateway page

    The gateway is now online and ready to use with backup schedules.

    Install using the command line

    Use this method when your database server has no graphical interface (for example, a headless Linux server).

    1. Log in to the DMS console 5.0.

    2. Go to Backup Gateway:

      • Advanced mode: Move the pointer over the icon icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Gateway.

      • Normal mode: In the top navigation bar, choose Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Gateway.

    3. In the upper-right corner, click Add Backup Gateway.

    4. Set the Backup Gateway Network Type and copy the installation command: Run the command on the database server. The system downloads and runs the installer automatically. Example:

      • Public Network: Access DBS over the internet.

      • ECS Private Network/VPC: Access DBS over an Alibaba Cloud leased line.

      [root@iZbp****** ~]# wget -O aliyunDBSAgentInstaller.jar https://aliyun-dbs.oss-cn-hangzhou-internal.aliyuncs.com/installer/0.0.141/aliyunDBSAgentInstaller-0.0.141.jar && sudo java -Dregion=cn-hangzhou -jar aliyunDBSAgentInstaller.jar

    5. Follow the interactive prompts:

      1. Select a language. Enter 0 for Chinese or 1 for English and press Enter. `` Select your language 0 [x] chn 1 [ ] eng Input selection: 0 ``

      2. Enter 1 to read the gateway agreement and press Enter. `` Press 1 to continue, 2 to quit, 3 to redisplay 1 ``

      3. Enter 1 to accept the agreement and press Enter. `` Press 1 to accept, 2 to reject, 3 to redisplay 1 ``

      4. Select the component to install. Enter Y to install a backup gateway (Agent) and press Enter. The proxy gateway (Database Gateway DG) option will show DG Not Selected. `` ----- Agent ----- Enter Y for Yes, N for No: Y DG Not Selected Done! ` > Note: To install a proxy gateway for the bastion host architecture instead, enter N here, then enter Y` at the Database Gateway (DG) prompt. See Install a proxy gateway on a bastion host.

      5. Enter 1 to confirm the component selection and press Enter. `` Press 1 to continue, 2 to quit, 3 to redisplay 1 ``

      6. Select an installation path. Press Enter to use the default path /usr/local/aliyun/dbs_agent, or enter a custom path. If a previous installation exists at the path, you will see a warning. Enter Y to overwrite, then 1 to continue. > Important: Overwriting replaces the existing gateway. To keep your previous installation, cancel and uninstall it first. See Upgrade or uninstall a backup gateway. `` --------------------------- Warning! The directory already exists! This may overwrite existing files. Are you sure you want to install here? --------------------------- Enter Y for Yes, N for No: Y Press 1 to continue, 2 to quit, 3 to redisplay 1 ``

      7. Confirm the installation path. Enter O and press Enter. `` The destination directory will be created at: /usr/local/aliyun/dbs_agent -------------------------------------- Enter O for OK, C to Cancel: O ``

      8. Select your backup gateway region. Choose the region closest to your database. > Important: Selecting the wrong region causes the gateway to show as offline in the console. `` Backup Gateway Region: 0 [x] China (Hangzhou) 1 [ ] China (Shanghai) 2 [ ] China (Beijing) 3 [ ] China (Hong Kong) ... Input selection: ``

      9. Enter your AccessKey ID and AccessKey Secret. Press Enter to confirm. `` AccessKey ID: [] yourAccessKeyID Access Key Secret: [] yourAccessKeySecret ``

      10. (Optional) Enter proxy gateway information. Skip this step (press Enter twice) unless you are using a bastion host architecture. For bastion host setups, enter the bastion host's private IP address and port (default: 9797). `` Proxy Gateway Information (Optional, for bastion host scenarios) Proxy Gateway Address: [] Proxy Gateway Port: [9797] ``

      11. Enter 1 to confirm and start installation. Installation takes 1 to 5 minutes. `` Press 1 to continue, 2 to quit, 3 to redisplay 1 ` When installation completes, you will see: ` Installation was successful Application installed on /usr/local/aliyun/dbs_agent ``

    6. Back in the DMS console, on the Add Backup Gateway page, click Complete Installation in the lower-right corner.

      Complete installation button

    7. On the Backup Gateway page, click Refresh to confirm the new gateway appears and shows as online.

      Backup Gateway page

    The gateway is now online and ready to use with backup schedules.

    Manage the backup gateway (Linux)

    Use these commands to manage the gateway service on Linux:

    ActionCommand
    Start/usr/local/aliyun/dbs_agent/bin/aliyun-dbs-agent.sh start
    Stop/usr/local/aliyun/dbs_agent/bin/aliyun-dbs-agent.sh stop
    Restart/usr/local/aliyun/dbs_agent/bin/aliyun-dbs-agent.sh restart
    UninstallFrom the installation directory, run java -jar Uninstaller/uninstaller.jar -c

    Upgrade or uninstall a backup gateway

    Before reinstalling, uninstall the existing gateway and delete the dbs_agent folder.

    Linux

    1. Go to the installation directory:

      cd /usr/local/aliyun/dbs_agent

    2. Run the uninstaller:

      java -jar Uninstaller/uninstaller.jar -c

      A successful uninstallation is shown in the output. swss

    3. Return to the parent directory and delete the folder:

      cd /usr/local/aliyun
sudo rm -rf dbs_agent

    Windows

    1. In Programs and Features, uninstall AliyunDBSAgent.

    2. Delete the dbs_agent folder manually.

      The default installation path is C:\Program Files\aliyun\dbs_agent.

    After uninstalling, reinstall using the GUI or command-line method.

    Install a proxy gateway on a bastion host

    If your database server is on an internal network with no internet access, install a proxy gateway on a bastion host first. The proxy gateway forwards backup data from the database server to DBS cloud storage, and forwards restore data in the reverse direction.

    The overall setup is:

    1. Install a proxy gateway on the bastion host (this section).

    2. Install a backup gateway on the database server, pointing it to the bastion host's private IP address.

    This section shows how to install a proxy gateway on a Linux bastion host using the command-line method. For Windows bastion hosts, see Windows bastion host.

    1. Log in to the DMS console 5.0.

    2. Go to Backup Gateway:

      • Advanced mode: Move the pointer over the icon icon in the upper-left corner and choose All Features > Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Gateway.

      • Normal mode: In the top navigation bar, choose Security and disaster recovery (DBS) > Data Disaster Recovery (DBS) > Backup Gateway.

    3. Click Install Backup Gateway in the upper-right corner.

    4. Set the Backup Gateway Network Type, copy the installation command, and run it on the bastion host. Example:

      [root@iZbp****** ~]# wget -O aliyunDBSAgentInstaller.jar https://aliyun-dbs.oss-cn-hangzhou-internal.aliyuncs.com/installer/0.0.141/aliyunDBSAgentInstaller-0.0.141.jar && sudo java -Dregion=cn-hangzhou -jar aliyunDBSAgentInstaller.jar

    5. Follow the interactive prompts:

      1. Select a language. Enter 0 for Chinese or 1 for English.

      2. Enter 1 to read the gateway agreement.

      3. Enter 1 to accept the agreement.

      4. Select the component. Enter N to skip the backup gateway (Agent), then enter Y to install the proxy gateway (Database Gateway DG). `` Enter Y for Yes, N for No: N -- DG -- Enter Y for Yes, N for No: Y Done! ``

      5. Enter 1 to continue.

      6. Select an installation path. Press Enter for the default /usr/local/aliyun/dbs_agent, or enter a custom path. This example uses /usr/local/aliyun/daili_dbs_agent. `` Select installation path: [/usr/local/aliyun/dbs_agent] /usr/local/aliyun/daili_dbs_agent Press 1 to continue, 2 to quit, 3 to redisplay 1 ``

      7. Confirm the component selection and enter 1 to start installation. Installation takes 1 to 5 minutes. When complete, you will see: `` Installation was successful Application installed on /usr/local/aliyun/daili_dbs_agent ``

    6. Verify the proxy gateway is running:

      ps aux | grep app_aliyun_proxy

      The following output confirms the process is running:

      root     1****  0.0  0.5 7*****  9*** ?        Ssl  16:06   0:00 /usr/local/aliyun/daili_dbs_agent/dist/app_aliyun_proxy/app_aliyun_proxy -addr :9797 -logdir /usr/local/aliyun/daili_dbs_agent/logs

      If you see errors you cannot resolve, contact support in the DBS customer consultation DingTalk group (ID: 35585947).

    The proxy gateway is now running on the bastion host. Next, install a backup gateway on the database server. When prompted for the proxy gateway address during installation, enter the bastion host's private IP address and port (default: 9797).

    FAQ

    The backup gateway does not appear on the Backup Gateway page after installation.

    The most common cause is that the gateway process has not started. On Windows, open Service Manager (services.msc) and start AliyunDBSAgent. On Linux, run /usr/local/aliyun/dbs_agent/bin/aliyun-dbs-agent.sh start.

    Also check:

    • The region configured in the gateway matches the region selected in the DBS console. A mismatch causes the gateway to be invisible or show as offline.

    • The agent log for AccessKey errors. Logs are at /usr/local/aliyun/dbs_agent/logs on Linux.

    • The Backup Gateway page list is not automatically refreshed. Click Refresh to see newly added gateways.

    The gateway shows as offline after installation.

    Start with the same checks above (gateway process started, region match). If those are correct, also verify:

    • Network connectivity between the gateway server and DBS is not blocked by network connection or routing issues.

    • The JRE or JDK version is correct: JRE 1.8 on Linux, JDK 8u261 on Windows. Other versions cause precheck failures.

    Do the gateway name and creation time change after an upgrade, reinstall, or OS change?

    • Upgrade or reinstall (same hardware): The gateway name and creation time stay the same as long as the CPU model and MAC address are unchanged.

    • Different OS family (for example, CentOS 7.9 to Alibaba Cloud Linux 3.2104 LTS): The name and creation time change.

    • Same OS family reinstall (for example, CentOS 7.9 to CentOS 8.5): The name and creation time stay the same.

    SQL Server backup fails with insufficient permissions.

    Grant the sysadmin role to the NT AUTHORITY\SYSTEM account:

    ALTER SERVER ROLE [sysadmin] ADD MEMBER [NT AUTHORITY\SYSTEM]
GO

    Earlier backup gateway versions have a Log4j2 vulnerability.

    Versions 0.0.129 and earlier are affected by the Apache Log4j2 RCE vulnerability (CVE-2021-44228). Upgrade to the latest version and reconnect the gateway to your physical backup schedule. See Upgrade or uninstall a backup gateway.

    Where are the backup gateway logs on Linux?

    If you used the default installation directory, logs are at /usr/local/aliyun/dbs_agent/logs.