The SAP HANA Restore Fails When the Backup Encryption Root Key is Changed and the Point-in-time (PTI) Restore is Performed Using Old Backups

When you change the backup encryption root key and perform the point-in-time (PIT) restore using old backups, the SAP HANA restore fails.

Symptoms

The SAP HANA restore fails with the following error:

2025-01-24T19:39:00+05:30 P0073408 19498a2ad80 ERROR RECOVERY RECOVER DATA finished with error: [448] recovery could not be completed, volume 3, reached log position 0, [110514] Backint terminated successfully without connect, [110507] Backint exited with exit code 1 instead of 0. console output: backint: ERROR: System error: /usr/sap/HA7/SYS/global/hdb/backint/DB_HA7/log_backup_3_0_69593600_69604736, rc=32: Broken pipe, [110126] Backup rootkey 3a4f2d12f823e104cad22f992a7f62db71cbeec0ca38f631c8c15c6091cb0bf7 is required for decryption of backup files, but not found in key store. Please make sure you have provided the necessary keys before recovery., [301103] No root key matching hash=3a4f2d12f823e104cad22f992a7f62db71cbeec0ca38f631c8c15c6091cb0bf7

Causes

Performing the point-in-time (PIT) restore using old backups.

Resolution

For SYSTEMDB:

1. Recovery root key to the target system manually using below procedure:

 (a) Copy the root key from source to target:

encadm@sdehana01:/usr/sap/ENC/HDB07> scp -r /usr/sap/ENC/HDB07/backup/sec/SYSTEMDB/backup001_rootkeys pncadm@sdehana02:/usr/sap/PNC/HDB03/backup/sec/SYSTEMDB/ pncadm@sdehana02's password: backup001_rootkeys 100% 1440 9MB/s 0:00

 (b) After the root key is copied from source to target system, run the root key recover command:

 Example:

h07adm@sde\-newhana1:/usr/sap/\/HDB09/backup/sec/SYSTEMDB\> hdbnsutil \-recoverRootKeys /usr/sap/\/HDB09/backup/sec/SYSTEMDB/backup001\_rootkeys \-\-database\_name=SYSTEMDB Please Enter the password: Importing root keys for DBID: 1 from /hana/shared/\/HDB09/backup/sec/SYSTEMDB/backup001_rootkeys Successfully imported root keys from /hana/shared/\/HDB09/backup/sec/SYSTEMDB/backup001_rootkeys done.

2.  Perform Point-in-time (PIT) restore from Command Center.

For Tenant Database:

1. Recovery root key to the target system manually using below procedure: 

(a) Copy the root key from source to target:

encadm@sdehana01:/usr/sap/ENC/HDB07> scp -r /usr/sap/ENC/HDB07/backup/sec/SYSTEMDB/backup001_rootkeys pncadm@sdehana02:/usr/sap/PNC/HDB03/backup/sec/SYSTEMDB/ pncadm@sdehana02's password: backup001_rootkeys 100% 1440 9MB/s 0:00

(b) After you copy the root key from source to target system, run the root key recover command:

 Example:

\adm@sde-newhana1:/usr/sap/\/HDB09/backup/sec/SYSTEMDB> ll total 8 -rw-r----- 1 \adm sapsys 1440 Jul 6 16:33 backup001_rootkeys -rw-r----- 1 \adm sapsys 1440 Jul 7 11:00 dbid3_rootkeys h07adm@sde\-newhana1:/usr/sap/\/HDB09/backup/sec/SYSTEMDB\> hdbnsutil \-recoverRootKeys dbid3\_rootkeys \-\-database\_name=\ Please Enter the password: Importing root keys for DBID: 3 from /hana/shared/\/HDB09/backup/sec/SYSTEMDB/dbid3_rootkeys     Successfully imported root keys from /hana/shared/\/HDB09/backup/sec/SYSTEMDB/dbid3_rootkeys done.

2. Perform Point-in-time (PIT) restore from Command Center.