PVE -> PBS: error pruning backups - check log

[LooneyTunes]

Hi,

Installed PBS and just ran my first backup of VMs on PVE (NFS datastore), and seemed to have gone well, but with errors;

INFO: prune older backups with retention: keep-daily=7, keep-last=1, keep-monthly=4, keep-weekly=7, keep-yearly=2
INFO: running 'proxmox-backup-client prune' for 'vm/101'
ERROR: prune 'vm/101': proxmox-backup-client failed: Error: permission check failed - missing Datastore.Modify|Datastore.Prune on /datastore/NFSfromSynology
ERROR: Backup of VM 101 failed - error pruning backups - check log
INFO: Failed at 2023-05-10 22:57:02

I searched a bit and found posts from Nov 2020 where it was said (by Proxmox) to be fixed in a future release. Was it fixed, or is this the same issue?

Thanks

 

[Maximiliano]

The issue you mention should have been fixed in pve-manager 6.2-15. What permissions do you have enabled for the user doing the backup?

 

[LooneyTunes]

Hi, thanks for asking. As it turned out PBS was not for me so I have decomissioned the server, for now at least. Maybe I'll have another go at a later time, so I can't answer your question and now it is some time since, don't fully recall all steps involved either. I should've removed the post but honestly forgot all about it...

 

[velocity08]

The issue you mention should have been fixed in pve-manager 6.2-15. What permissions do you have enabled for the user doing the backup?

Hi @Maximiliano

i'm actually seeing this issue atm.

​

the user has access to the top level path for all datastores.

is there a specific area or information i can provide and where do i grab this from?

sorry should have included the user is set to "DatastoreBackup" role.

""G

 

[jbbenetti]

Hello everyone,

I've recently a problem concerning "prunes task" in my PBS.
My pruning tasks run every day as we can see below in my configuration :

The problem is that the old backups are not deleted and consequently my storage space fills up quickly.
Pruning tasks are carried out well every day as you can see :



And this is the logs for one task :


But I have the feeling that the prunes tasks don't through my VMs list.
Alternatively, I had to run pruning task manually as you can see and it had worked :

2023-12-01T14:54:23+01:00: Starting datastore prune on store "nasha"
2023-12-01T14:54:23+01:00: retention options: --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --keep-yearly 1
2023-12-01T14:54:23+01:00: Starting prune on store "nasha" group "vm/124"
2023-12-01T14:54:23+01:00: remove vm/124/2023-10-11T01:15:53Z
2023-12-01T14:54:24+01:00: remove vm/124/2023-10-12T01:12:30Z
2023-12-01T14:54:24+01:00: remove vm/124/2023-10-13T01:10:10Z
2023-12-01T14:54:24+01:00: remove vm/124/2023-10-14T01:08:48Z
2023-12-01T14:54:24+01:00: remove vm/124/2023-10-15T01:07:53Z
2023-12-01T14:54:24+01:00: remove vm/124/2023-10-16T01:08:10Z
2023-12-01T14:54:24+01:00: remove vm/124/2023-10-17T01:08:51Z
2023-12-01T14:54:25+01:00: remove vm/124/2023-10-18T01:08:08Z
2023-12-01T14:54:25+01:00: remove vm/124/2023-10-19T01:08:27Z
2023-12-01T14:54:25+01:00: remove vm/124/2023-10-20T01:08:05Z
2023-12-01T14:54:25+01:00: remove vm/124/2023-10-21T01:07:25Z
2023-12-01T14:54:25+01:00: remove vm/124/2023-10-22T01:07:51Z
2023-12-01T14:54:25+01:00: remove vm/124/2023-10-23T01:07:48Z
2023-12-01T14:54:26+01:00: remove vm/124/2023-10-24T01:09:19Z
2023-12-01T14:54:26+01:00: remove vm/124/2023-10-25T01:07:23Z
2023-12-01T14:54:26+01:00: remove vm/124/2023-10-26T01:07:22Z
2023-12-01T14:54:26+01:00: remove vm/124/2023-10-27T01:08:10Z
2023-12-01T14:54:26+01:00: remove vm/124/2023-10-28T01:07:20Z
2023-12-01T14:54:26+01:00: keep vm/124/2023-10-29T02:08:22Z
2023-12-01T14:54:26+01:00: remove vm/124/2023-10-30T02:07:10Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-10-31T02:07:01Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-01T02:07:15Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-02T02:07:29Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-03T02:08:07Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-04T02:07:55Z
2023-12-01T14:54:27+01:00: keep vm/124/2023-11-05T02:07:26Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-06T02:07:53Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-07T02:08:57Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-08T02:11:34Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-09T02:10:28Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-10T02:10:01Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-11T02:09:52Z
2023-12-01T14:54:27+01:00: keep vm/124/2023-11-12T02:09:28Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-13T02:07:40Z
2023-12-01T14:54:27+01:00: remove vm/124/2023-11-14T02:09:25Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-15T02:09:13Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-16T02:09:22Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-17T02:08:31Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-18T02:09:11Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-19T02:09:26Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-20T02:08:40Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-21T02:09:38Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-22T02:09:12Z
2023-12-01T14:54:28+01:00: remove vm/124/2023-11-23T02:09:19Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-24T02:09:35Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-25T02:09:31Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-26T02:09:19Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-27T02:09:05Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-28T02:08:49Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-29T02:09:03Z
2023-12-01T14:54:28+01:00: keep vm/124/2023-11-30T02:09:01Z
2023-12-01T14:54:28+01:00: Starting prune on store "nasha" group "vm/105"
2023-12-01T14:54:28+01:00: remove vm/105/2022-08-31T08:48:46Z
2023-12-01T14:54:28+01:00: remove vm/105/2022-09-30T01:00:06Z
2023-12-01T14:54:28+01:00: keep vm/105/2022-10-31T02:00:05Z
2023-12-01T14:54:28+01:00: keep vm/105/2022-11-30T02:00:07Z
2023-12-01T14:54:28+01:00: keep vm/105/2022-12-31T02:00:08Z
2023-12-01T14:54:28+01:00: keep vm/105/2023-01-31T02:00:08Z
2023-12-01T14:54:28+01:00: keep vm/105/2023-02-28T02:00:06Z
2023-12-01T14:54:28+01:00: keep vm/105/2023-03-31T01:05:35Z
2023-12-01T14:54:28+01:00: keep vm/105/2023-04-30T01:05:21Z
2023-12-01T14:54:28+01:00: keep vm/105/2023-05-31T01:05:04Z
2023-12-01T14:54:28+01:00: keep vm/105/2023-06-25T01:04:52Z
2023-12-01T14:54:28+01:00: remove vm/105/2023-07-02T01:05:16Z
2023-12-01T14:54:28+01:00: remove vm/105/2023-07-09T01:05:22Z
2023-12-01T14:54:28+01:00: remove vm/105/2023-07-16T01:05:16Z
2023-12-01T14:54:28+01:00: remove vm/105/2023-07-18T01:05:13Z

For information, my backups are saved on a NASHA.

So, I don't understand the problem.

Thanks in advance.

 

[GarryG]

Ran into this, didn't happen on an earlier account/namespace ...
Fixed by going to the datastore on PBS, then Permissions, and added an entry:
Path = the Datastore path + namespace
User = the user configured on PVE used for the backup
Role = DatastoreAdmin (which included the two functions listed in the error) - not sure if DatastoreBackup would have been sufficient, as I already had this for the user and the higher up Path ...

 

[supr4s]

Hi,

For those who come across the problem next, there is a role available specifically for this : DatastorePowerUser (backup AND pruning)
This must be set on your PBS, in the permissions of user performing the backup.

 

[Johannes S]

Hi,

For those who come across the problem next, there is a role available specifically for this : DatastorePowerUser (backup AND pruning)
This must be set on your PBS, in the permissions of user performing the backup.

For doing the actual backup one should setup an API token with just the backup permission based on the used user so in case of a ransomware or hacker attack the offender can only add new backups but not prune or remove them. See https://pbs.proxmox.com/docs/storage.html#ransomware-protection-recovery for more considerations in that regard

 

[supr4s]

Indeed you're right, thanks for the clarification!