Security Center:Troubleshoot the issues that cause the abnormal status of the anti-ransomware agent and backup tasks

Error code

Information in the Details message

Cause

Solution

CLOUD_ASSIST_NOT_RUN

Cloud assistant Not started

Cloud Assistant is not started.

Log on to the Elastic Compute Service (ECS) console and check whether Cloud Assistant runs as expected. For more information, see O&M and monitoring FAQ.

RoleNotExist

Your Alibaba Cloud account is not authorized.

Your Alibaba Cloud account does not have the required permissions.

Log on to the Security Center console by using your Alibaba Cloud account or a RAM user to which the AliyunRAMFullAccess policy is attached. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, click Authorize Now and assign the AliyunServiceRoleForHbrEcsBackup and AliyunServiceRoleForSas roles to your account.

CLIENT_CONNECTION_ERROR

The client connection is abnormal. Check the ECS instance network and try again.

The network connection fails.

Perform the following operations to troubleshoot network connection issues:

1. Log on to your ECS instance, run the ping or telnet command to test the connectivity between the ECS instance and the anti-ransomware endpoint, and then check whether firewall policies are configured for the ECS instance. For more information about anti-ransomware endpoints, see Anti-ransomware endpoints.

2. After you troubleshoot network connection issues, perform the following operations to reinstall the anti-ransomware agent: Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Install in the Actions column.

ECS_ROLE_POLICY_NOT_EXIST

ecs role does not have AliyunECSAccessingHBRRolePolicy

The AliyunECSAccessingHBRRolePolicy policy is not attached to the RAM role that your ECS instance assumes, which causes the failure to install the anti-ransomware agent.

Perform the following operations to troubleshoot policy issues and then reinstall the anti-ransomware agent:

1. Attach the AliyunECSAccessingHBRRolePolicy policy to the RAM role that your ECS instance assumes. For more information, see What can I do if the error message "The strategy of AliyunECSAccessingCloud BackupRolePolicy is missing on EcsRamRole. Please refer to the FAQ for authorization" appears when I install the Cloud Backup backup client on an ECS instance?

2. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Install in the Actions column.

CHECK_ACTIVATION_COMMAND_TIMEOUT

The activation command times out.

The installation of the anti-ransomware agent times out.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

ECS_STOPPED

The ECS instance is not started.

The anti-ransomware agent fails to be installed because the ECS instance is not started.

Perform the following operations to start the ECS instance and then reinstall the anti-ransomware agent:

1. Log on to the ECS console. Start the ECS instance that is stopped. For more information, see Start an instance.

2. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Install in the Actions column.

UNINSTALL_FAILED

Failed to uninstall client

The anti-ransomware agent fails to be uninstalled because the execution of the Cloud Assistant command times out.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find an anti-ransomware policy that is applied to specific servers, select the server from which the anti-ransomware agent fails to be uninstalled, and then click Delete in the Actions column.

   Note

   Approximately 2 minutes is required to remove the server from the anti-ransomware policy. Wait until the server is removed.

2. Apply the anti-ransomware policy to the server. For more information, see Edit an anti-ransomware policy.

3. On the Server extortion virus protection tab, find the server that you want to manage and click Install in the Actions column.

INSTALL_FAILED

Installation failed

The anti-ransomware agent fails to be installed because the execution of the Cloud Assistant command times out.

Perform the following operations to reinstall the anti-ransomware agent:

1. Make sure that the Security Center agent on the server is online. To check the status of the Security Center agent on a server, find the server in the list of servers that are protected by anti-ransomware policies, and view the value in the Agent Status column. If the Security Center agent on the server is offline, troubleshoot the issue by following instructions provided in Troubleshoot why the Security Center agent is offline.

2. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

3. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

AGENT_NOT_RUN_AFTER_INSTALLATION

Post-installation services not started

After you install the anti-ransomware agent, the agent is not started because some registry entries of the agent that you previously uninstall are retained.

Perform the following operations to clear the registry entries and reinstall the agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. Clear the following registry entries based on the version of the anti-ransomware agent that is installed:

   • The registry entries of the V1.0 anti-ransomware agent

     # The V1.0 anti-ransomware agent
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\hybridbackup
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\hbrupdater

   • The registry entries of the V2.0 anti-ransomware agent

     # The V2.0 anti-ransomware agent
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\hbrclient
     HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application\hbrclientupdater
     HKEY_LOCAL_MACHINE\SOFTWARE\Alibaba, Inc.\Aliyun Hybrid Backup Service Client
     # 64-bit
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B1F066FC-D85C-46F8-9ED7-88A4385AF9A6}}_is1
     # 32-bit
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9A3FBAB2-A9B0-4F3B-951A-ABC72D58BA6D}}_is1

3. On the Server extortion virus protection tab, find the server that you want to manage and click Install in the Actions column.

FAILED_TO_DOWNLOAD_INSTALLER

Failed to download the installation package

The installation package of the anti-ransomware agent fails to be downloaded because the network connection fails.

Perform the following operations to troubleshoot network connection issues:

1. Log on to your ECS instance, run the ping or telnet command to test the connectivity between the ECS instance and the anti-ransomware endpoint, and then check whether firewall policies are configured for the ECS instance. For more information about anti-ransomware endpoints, see Anti-ransomware endpoints.

2. After you troubleshoot network connection issues, perform the following operations to reinstall the anti-ransomware agent: Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Install in the Actions column.

PRECHECK_COMMAND_FAILED

Preflight command failed

The execution of the Cloud Assistant command times out.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

INSTALL_COMMAND_TIMEOUT

Install Command timeout

The anti-ransomware agent fails to be installed because the installation command times out.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

ServiceUnavailable

ServiceUnavailable

Your Alibaba Cloud account does not have the required permissions, or the queries per second (QPS) exceeds the upper limit.

• Log on to the Security Center console by using your Alibaba Cloud account. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, click Authorize Now and assign the AliyunServiceRoleForHbrEcsBackup and AliyunServiceRoleForSas roles to your account.

• If the issue persists after the required permissions are granted, submit a ticket for consultation and start a live chat for support.

CONFLICT_WITH_EXISTING_AGENT

Conflict with existing client

The anti-ransomware agent fails to be installed because the agent is installed.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

ACTIVATE_COMMAND_FAILED

An error occurs on the agent. You can reinstall the agent to restore normal service operations. If the error persists, submit a ticket for consultation and start a live chat for support.

An error occurs on the anti-ransomware agent.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

3. If the anti-ransomware agent fails to be installed, submit a ticket for consultation and start a live chat for support.

CHECK_RUNNING_COMMAND_FAILED

Check service startup command failed

A service error occurs.

Perform the following operations to reinstall the anti-ransomware agent:

1. Log on to the Security Center console. On the Anti-ransomware page, click the Server extortion virus protection tab. On the tab, find the server that you want to manage and click Uninstall.

   After you uninstall the anti-ransomware agent, the status of the agent changes to Not Installed.

2. On the Server extortion virus protection tab, find the server that you want to manage and click Install.

INSTALL_COMMAND_FAILED

Installation Command failed

The installation of the anti-ransomware agent is blocked by the security software installed on the server.

1. Uninstall the security software installed on the server.

2. Log on to the Security Center console. On the Server extortion virus protection tab of the Anti-ransomware page, find the server and click Install in the Actions column to install the anti-ransomware agent.

Error code

Information in the Details message

Cause

Solution

EXPIRED

The backup task timed out

• Network connection errors occur.

• The backup task is stopped because the server is restarted when the anti-ransomware agent runs the backup task on the server.

• The ECS instance stops running.

• The backup task times out because a large number of files need to be backed up.

• The version of the anti-ransomware agent is outdated and needs to be upgraded.

• If network connection errors occur, check whether the MQTT Connection Lost. message is included in the backup logs. If the message is included, optimize network settings.

• If the ECS instance stops running, check whether the ECS instance is connected or whether a restart task is configured for the ECS instance.

• If the backup task times out because a large number of files need to be backed up, modify the backup policy and remove directories that you do not need to back up.

SOURCE_NOT_EXIST

Backup source path does not exist

The backup directory that you specified in the anti-ransomware policy does not exist.

Specify another backup directory in the anti-ransomware policy.

VSS_BACKUP_IN_PROGRESS

VSS is used by other services

You must view the logs of Volume Shadow Copy Service (VSS) and the system events of Windows to identify the reason. The following section describes the possible reasons:

• VSS is used by other services.

• Exceptions occurred on VSS.

If errors on VSS persist, we recommend that you reconfigure the anti-ransomware policy and clear VSS(Windows). For more information, see Edit an anti-ransomware policy.

OPEN_VAULT_FAILED

Failed to open backup Library

• Access to Object Storage Service (OSS) during backups failed. We recommend that you check your network settings.

• The difference between the local time of your server and the system time of OSS exceeds the threshold.

• In the ECS log named hbrclient.log, find the endpoint of OSS. The endpoint is in the oss-xxx.aliyuncs.com or oss-xxx-internal.aliyuncs.com format. In the ECS instance, run the ping or telnet command to check whether the endpoint of OSS can be accessed.

• Check whether firewalls and security groups allow network requests that are sent from the anti-ransomware agent.

• Check whether security software blocks network connections.

• If ErrorCode=RequestTime TooSkewed, Errorhessage="The difference between the request time and the current time is too large." is included in the backup logs of the anti-ransomware agent, check the local time on your server. If the difference between the local time and the system time of OSS exceeds 15 minutes, change the time value that is displayed on your server to the system time of OSS, and then restart the anti-ransomware agent. The system time and time zone of OSS is the same as the time and time zone of the region in which the ECS instance resides. If the ECS instance resides in a region in the Chinese mainland, the time zone of the ECS instance is UTC+8. If the ECS instance resides in a region outside the Chinese mainland, the time zone of the ECS instance is the time zone of the region.

  systemctl restart hbrclient

INTERNAL_ERROR or InternalError

An internal error occurred.

An internal error occurred in the backup feature. In most cases, the error occurs in V1.0 anti-ransomware policies.

On the Anti-ransomware page, click Upgrade in the Actions column to upgrade a V1.0 anti-ransomware policy to a V2.0 anti-ransomware policy.

If the issue persists, collect logs of the anti-ransomware agent and submit a ticket to contact technical support.

killed

The backup process is terminated by the system

In most cases, the system forcefully terminates the process if the CPU utilization or memory usage is excessively high. As a result, the backup fails.

Log on to the ECS console. On the Monitoring tab of the instance details page, view the CPU utilization or memory usage during the backup period. If the backup process consumes a large amount of resources, limit the resources that can be occupied by the backup process. For more information, see How do I resolve OOM issues on an HBR client?

CreateSnapshotFailed

Failed to create a backup snapshot when the backup is about to end

If a backup snapshot failed to be created when the backup is about to end, OSS cannot be accessed at this point in time.

You can submit a ticket to contact technical support.

CONNECT_TO_VAULT_FAILED

Failed to access the backup vault

Access to OSS failed during backups.

Check network settings. In the ECS log named hbrclient.log, find the endpoint of OSS. The endpoint is in the oss-xxx-internal.aliyuncs.com format. In the ECS instance, run the ping or telnet command to check whether the endpoint of OSS can be accessed.

AppError: ErrorCode=TooManyConcurrentJobs, ErrorMessage=TooManyConcurrentJobs

A large number of backup tasks are running, and new backup tasks cannot be run

A large amount of data needs to be backed up, or a subsequent backup task is run when the previous backup task is not complete due to the slow backup speed.

Perform the following operations in turn:

• Specify a longer backup interval or exclude directories and files that you do not need to back up when you configure an anti-ransomware policy.

  1. If no historical backup data exists or no historical backup data is required, remove the server from the anti-ransomware policy. For more information, see Manage servers that are added to an anti-ransomware policy.

  2. Perform the following operation to add the server to the anti-ransomware policy again: Select the server when you modify the anti-ransomware policy. For more information, see Edit an anti-ransomware policy.

If the issue persists, submit a ticket for consultation and start a live chat for support.

EcsStopped

The ECS instance is not started.

The ECS instance is stopped.

Check the status of the ECS instance and whether the ECS instance is stopped due to overdue payments.

EcsReleased

The ECS instance is released

The ECS instance is released.

None.

ClientDisconnectedAegisClientNotOnline

The Security Center agent and the anti-ransomware agent are offline

The Security Center agent and the anti-ransomware agent are offline.

• Check the status of the Security Center agent. Make sure that the Security Center agent is online. For more information, see Troubleshoot why the Security Center agent is offline.

• Check the status of the anti-ransomware agent. Make sure that the anti-ransomware agent is online.

• Perform the following operations to check the network connection status of the ECS instance: Log on to your ECS instance, run the ping or telnet command to test the network connectivity between the ECS instance and the anti-ransomware endpoint, and then check whether firewall policies are configured for the ECS instance. For more information about anti-ransomware endpoints, see Anti-ransomware endpoints.

ClientDisconnected

The anti-ransomware agent is offline

The anti-ransomware agent is offline.

• Check the status of the anti-ransomware agent. Make sure that the anti-ransomware agent is online.

• Perform the following operations to check the network connection status of the ECS instance: Log on to your ECS instance, run the ping or telnet command to test the network connectivity between the ECS instance and the anti-ransomware endpoint, and then check whether firewall policies are configured for the ECS instance. For more information about anti-ransomware endpoints, see Anti-ransomware endpoints.

OOM

The memory usage is high

If a large amount of file data is stored in the backup directory, the memory usage is high. If the memory usage exceeds the upper limit, the system forcefully terminates the process, and the backup fails.

For more information, see How do I resolve OOM issues on an HBR client?

JOB_CANCELED

The backup task is automatically disabled

The backup task is disabled because the anti-ransomware policy that is applied to the server is disabled or the anti-ransomware capacity is exhausted.

Check whether the anti-ransomware policy is disabled. If the anti-ransomware policy is enabled, check whether the anti-ransomware capacity is exhausted. You can view the used capacity and total capacity on the Anti-ransomware page.