From SEPsesam
This page contains changes which are not marked for translation.
Other languages:

Copyright © SEP AG 1999-2023. All rights reserved.

Any form of reproduction of the contents or parts of this manual is allowed only with the express written permission from SEP AG. When compiling and designing user documentation SEP AG uses great diligence and attempts to deliver accurate and correct information. However, SEP AG cannot issue a guarantee for the contents of this manual.


Does SEP sesam require identical versions of SEP sesam Client and Server?

To avoid general version compatibility issues, the SEP sesam Client and the SEP sesam Server / Remote Device Server should always have the same version number.
Forward and backward compatibility is limited to path backups only.

How do I order a new licence?

To obtain a license, contact SEP sesam sales at SEP contact page or sales@sep.de and provide the following information:

  • host name of the SEP sesam Server
  • IP address of the SEP sesam Server

To determine which specific names are used by SEP sesam (for example, if more than one network card is installed on the server), go to Help -> License Info in the SEP sesam GUI menu bar and check the details. Licenses are available immediately after your purchase or renewal is completed and will be sent to you by email.

License Info displays all licensed components which are currently in use. It also shows you the number of clients and modules needed by your configuration if your SEP sesam Server is currently running in trial mode.

Information sign.png Note
Some features require a special license, for example, SEP sesam Exchange Recovery Pro and SEP sesam SharePoint Recovery Pro. SEP sesam licenses are issued on the basis of the size and requirements of your environment, so make sure that you are aware of feature/application specific licensing. For details on newly introduced licenses, see SEP sesam Exchange Recovery Pro license and SEP sesam SharePoint Recovery Pro license.

License info.jpg

How do I activate a license?

You can activate licenses easily by importing the license in the SEP sesam GUI. Note that the SEP sesam Exchange Recovery Pro and SEP sesam SharePoint Recovery Pro extensions require special licences and specific activation steps, as described in the section Activating special licenses.

Activating licenses in the SEP sesam GUI

After you have received your SEP sesam license by email, proceed as follows:

  1. From the SEP sesam GUI menu bar -> Help, select License Info. The SEP sesam License Info window appears.
  2. Click the button Import New License. A new window opens prompting you to paste a valid license file.
  3. Copy a valid license file sm_lic.ini and paste it from the clipboard or use the file manager to browse and select the required license as .ini or .zip file.
  4. Click Apply to enable the license.
  5. License info import.jpg

SEP Tip.png Tip
The License Info also enables you to check the expiration date and to upgrade your license. All licensed components currently in use are displayed.

If the program displays any errors (for instance, in the host name or IP address), email the SEP sesam License Info to SEP sesam sales by clicking the Send as Mail button. Clicking the button opens an email with the license information loaded. Address the message to sales@sep.de and send it.

Activating special licenses

To activate the special licenses, such as SEP sesam Exchange Recovery Pro or SEP sesam SharePoint Recovery Pro, proceed as follows:

  1. Go to Start -> All Programs -> SEP sesam Exchange Recovery Pro or Start -> All Programs -> SEP sesam SharePoint Recovery Pro and open the extension. A License file not installed message appears.
  2. Click the License info button and import the license.ini file.

Both, SEP sesam Exchange Recovery Pro and SEP sesam SharePoint Recovery Pro extensions require specific installation and configuration. For details on these procedures, see SEP sesam Exchange Recovery Pro and SEP sesam SharePoint Recovery Pro.

Why does the W008-License TCPIP address not match the local address

This problem usually occurs on SLES-based Linux systems. Check the file /etc/hosts and change the relevant entry for the loopback address127.0.0.2 or remove it from the /etc/hosts file entirely.

How do I obtain the community version?

The SEP sesam community version is available to the general public for private use on Microsoft Windows and Linux. Please note that the software, manuals, licensing and terms from SEP AG and SEP Software Inc remain unchanged.

During the installation of a SEP sesam demo version (available at SEP Download Center), a community license file is created automatically. This file must be copied to the license file location after the 30-day trial period is over.

The file sm_lic.ini.com can be found at <SESAM_ROOT>/skel. Copy the file to <SESAM_ROOT>/var/ini and rename it to sm_lic.ini.

If you want to check the license status, go to Help -> License Info.

Technical support is not provided for the SEP sesam community version and it cannot be upgraded. Visit the SEP Forum or search SEP Wiki for help.

How do I obtain the free Zarafa extension?

Free Backup for Zarafa environments

In addition to the most common server operating systems such as Novell Netware, Linux, Windows, Unix and Solaris, SEP sesam provides extensions that execute hot backups on common groupware and database applications. A complete overview of supported software is available in the SEP sesam OS and Database Support Matrix.

Zarafa users can download the complete SEP sesam environment to backup their Zarafa installation for free. The following modules are provided in the free download:

  • SEP sesam ONE Server for scheduling and managing all backup and restore tasks. SEP sesam ONE supports backup to tape and disk. A 500 GB Virtual Tape Library is integrated into the base product.
  • SEP sesam Zarafa Online Module for up to 10 users. The module supports online backup and restore of the complete Zarafa server environment for up to 10 users, including restore and recovery of single mailboxes and e-mails.
  • SEP sesam MySQL Online Module. The module supports hot backup and restore of the Zarafa database.
  • SEP sesam Graphical User Interface (GUI), which includes the powerful restore wizard.

The free Zarafa Server backup license does not expire but is limited to this dedicated environment. Note that no upgrade services or technical support are included.

The free Zarafa version can be upgraded with the following additions, available at the SEP homepage:

  • High-capacity SEP sesam Servers License (Standard Server with 5 streams and 1TB or Advanced Server with 124 data streams and 1TB)
  • Additional SEP sesam Clients to back up servers other than the Zarafa Server
  • Additional online database extensions
  • Autoloader support
  • Disaster recovery modules
  • SAN backup capability
  • Citrix XenServer or VMware ESX/ESXi disaster recovery
  • Expanded storage capability
  • or additional Zarafa users

To apply for a free Zarafa backup, send the following information to sales@sep.de:

* Name of your company
* Complete address
* Contact person, including phone and email
* Which additional servers do you use in your IT environment?
* Which backup software do you use besides SEP sesam?

Additionally, provide the Zarafa related information:

* SEP sesam Server installation – is it on a Zarafa server or on a dedicated SEP sesam Server?
* IP address of the SEP sesam Server
* Hostname of the SEP sesam Server
* Operating system of the SEP sesam Server
* Number of Zarafa users

All SEP sesam software is available at the SEP Download Center.

SEP sesam Server for Linux
SEP sesam Server for Windows
Zarafa module (included in SEP sesam Client for Linux since version 3.6)
MySQL module (included in SEP sesam Client for Linux since version 3.6)
An introduction on backing up the Zarafa server with SEP sesam is available on the SEP Wiki: SEP sesam Extension for Zarafa.


What are the hardware and software requirements for a SEP sesam Server?

SEP sesam Server hardware requirements

The following are the hardware requirements for the SEP sesam Server, RDS or SEP sesam Client. They are similar for both servers, SEP sesam Server and RDS, except for the required space on the file system for the SEP sesam database, which is not necessary for RDS.

  • The hardware requirements for the SEP sesam components represent the common requirements. Additional amount of RAM/CPU may be required for bigger Si3 data stores. For details, see Si3 Deduplication Hardware Requirements.
  • (Windows only) Make sure that you are using CPUs with supported AVX versions (AVX, AVX2, or AVX-512) and FMA3 (Fused Multiply-Add 3-operand Form) or FMA4 (Fused Multiply-Add 4-operand Form) to prevent the Sesam Transfer Protocol Server (STPD) from automatically disabling the HTTPS port. This happens when the CPU instructions are missing due to unsupported AVX. Consequently, the TLS key and certificate cannot be created. For a list of supported AVX versions, see Advanced Vector Extensions.
Requirements SEP sesam Server Standard edition SEP sesam Advanced Server edition SEP sesam Premium Server edition SEP sesam Enterprise Server SEP sesam Client
Memory (without Si3 deduplication) 8 GB RAM Minimum 16 GB RAM 32 GB RAM Minimum 64 GB RAM 2 GB (recommended 4 GB)
Memory (with Si3 deduplication) Minimum 16 GB RAM Minimum 32 GB RAM 64 GB RAM Minimum 128 GB RAM Minimum 4 GB
Core (without Si3 deduplication) 1x CPU with 4 cores (≥ 2,4 GHz) 1x CPU with 8 cores (≥ 2,4 GHz) Minimum 1x CPU with 8 cores (≥ 2,4 GHz) Minimum 2x CPUs with 4 cores (≥ 2,4 GHz) -
Core (with Si3 deduplication) 1x CPU with 6 cores (≥ 2,6 GHz) 2x CPUs with 8 cores (≥ 2,6 GHz) 2x CPUs with minimum 8 cores (≥ 2,6 GHz) Minimum 2x CPUs with 8 cores (≥ 2,6 GHz) -
Minimum hard disk space for SEP sesam metadata 100 GB 300 GB 500 GB 500 GB 4 GB (for all client data)
No. of backup clients Up to 15 Recommended up to 50 Recommended up to 150 Recommended for more than 150 -

Si3 deduplication hardware requirements

  • For the minimum Si3 hardware requirements that apply to SEP sesam Si3 deduplication server, see the above requirements list. Keep in mind that these requirements represent the demand for deduplication only. In addition, the amount of memory for the operating system and other services should be taken into account.
  • For details on the required Java version, see Java Compatibility Matrix. Si3/Si3-NG is not mandatory, so there is no dependency rule for it in the RPM/DEB packages.
  • When estimating the maximum size of a deduplication store, you have to ensure that there is enough space available for dedup trash, otherwise the deduplication store will run out of space. You should calculate the required disk space based on a representative sample of your full backup and add the additional storage space equal to approximately 50% of the representative full backup.

Disk attachment and protocols

Si3/Si3-NG supports all types of direct-attached disk storage, such as serial attached SCSI (SAS), Serial ATA (SATA), and Fibre Channel (FC)/LUN.

Performance tip

Applies to Windows only: SEP AG recommends using the High performance power plan to increase the performance of your backup. Note that Windows sets all computers to the Balanced power plan by default and you must manually switch to the High Performance power plan. This way, your Windows computer will use more power, but the systems with Si3 will always operate at the highest performance level.

  • From the Start menu, go to Control Panel -> System and Security -> Power Options and change the setting to High performance.


  • Si3 NG deduplication store is not supported for NSS and MooseFS volumes.
  • To avoid problems resulting from the combination of excessively large Si3 deduplication stores and inefficient hardware, the maximum initial Si3/Si3-NG deduplication store size is limited to 40 TB. If you would need to increase this limit, contact SEP support.
  • This limitation applies to the creation of a new Si3/Si3-NG deduplication store in the GUI.
Information sign.png Note
It is recommended to run Si3 deduplication (SEP sesam Server or RDS) on the physical host. It is also possible to run it on a virtual machine. In this case, take into account that deduplication consumes a lot of server resources for reading, processing and writing the deduplicated data, as well as for some other deduplication tasks such as housekeeping and various checks. These tasks require a large amount of IO and a large amount of memory. Si3 performance can be affected by other virtual machines running on the same host. Therefore, if you are running Si3 on a VM, you should be aware of possible bottlenecks and shortcomings.

Required additional amount of RAM and CPU cores

Memory requirements are dependent on the number of concurrent streams and expected workload. The following tables show the recommended minimum additional amount of RAM and CPU cores for a Si3/Si3-NG data store to ensure good performance. The TB value corresponds to the capacity of the Si3/Si3-NG data store.

Information sign.png Note
These requirements relate solely to the need for deduplication. In addition, you should consider the amount of memory for the operating system and other services.
Si3/Si3-NG data store capacity (check initial size limit) RAM
<20 TB at least 16 GiB
20-40 TB at least 32 GiB

The following table shows the number of CPU cores required for a Si3/Si3-NG data store. The TB value is the amount of data backed up (before deduplication)!

Backed up data (before dedup) CPU cores Note
10 TB 4
20 TB 4
40 TB 8

This is the minimum amount to ensure good performance. Depending on the number of concurrent streams, more cores may be needed.

SEP sesam Server software requirements


We recommend that you use a separate partition for the SEP sesam metadata in order to prevent SEP sesam metadata from filling up the operating system partition.

  • Linux: create a mount point for /var/opt/sesam/var (see recommended size above)
  • Microsoft Windows: add a new drive (see recommended size above) and install SEP sesam on this drive.

Which Java version does SEP sesam require?

The required Java version depends on SEP sesam version. Check the following Java compatibility matrix for details. Oracle/Sun Java, IBM Java or OpenJDK can be used. For details on how to install Java, see Installing and Managing Java.

Java version SEP sesam version
Java 17 on demand Note1
OpenJDK 11 LTS 4.4.3 Beefalo, 5.0.0 Jaglion, Jaglion V2 Note2
Java 11 4.4.3 Beefalo, 5.0.0 Jaglion, Jaglion V2 Note2
Java 10 is not supported!
Java 9 is not supported!
Java 8 ≥ patch level 111 (both Windows and Linux) 4.4.3 Grolar; 4.4.3 Beefalo, 5.0.0 Jaglion, Jaglion V2 Note2
Java 8 (at least patch level 111) ≥ JRE 1.8.0_111 (required for Linux) v. ≥ 4.4.3 Tigon V2
Java 8 (required for Windows) v. ≥ 4.4.3
Java 7 (all OS except Windows) 4.4.3 Note3
Java 7 4.4.2
Java 6 4.2.1 & 4.2.2
  • SEP sesam Jaglion V2, including SP1, supports Java 17 only on demand, if the use of Java 17 from the command line has been enabled with sm_setup set_java_path -f <java_17_installation_path>
  • Java 1.8 (≥ 1.8.0_111) is only accepted if it is already installed and the computer does not have a 4K display.
  • Jaglion V2 is the last version of SEP sesam that supports Java 1.8.


SEP sesam versions 4.4.3 until 4.4.3 Tigon V1 running on non-Windows platform require Java 7, however, SEP sesam uses JavaFX for its web dashboard and user-defined schedules features. If you want to have all the 4.4.3 features available, you need OpenJFX package or Oracle®'s Java 8 (already includes JavaFX) on your SEP sesam GUI client.

You can check your Java version with the following command:

  java -version


#> java -version
java version "1.7.0_45"
Java(TM) SE Runtime Environment (build 1.7.0_45-b18)
Java HotSpot(TM) 64-Bit Server VM (build 24.45-b08, mixed mode)

Linux – RPM

If the SEP sesam Server is installed as an RPM package, Java must also be installed as an RPM.

Note: To install a SEP sesam Server on an OES2 system, Java 1.5 must remain the default version so that Novell-specific functions can operate. If a different Java version (such as 1.6) is installed on the system via RPM, the default Java version is kept, i.e. the reinstallation doesn't overwrite it. Java and the SEP sesam Server can be installed as described below.

In the example below, 64-bit Sun Java is used:

  • After the download is complete, give the package execution rights:
#> chmod +x jre-6u25-linux-x64-rpm.bin
  • Install the JRE Binary package:
#> ./jre-6u25-linux-x64-rpm.bin
UnZipSFX 5.50 of 17 February 2002, by Info-ZIP (Zip-Bugs@lists.wku.edu).
  inflating: jre-6u25-linux-amd64.rpm
Preparing...                ########################################### [100%]
   1:jre                    ########################################### [100%]
Unpacking JAR files...
  • Verify that the Sun Java version was properly registered in the package database:
#> rpm -qa | grep jre
  • The SEP sesam Server is installed via an RPM package. The SEP sesam installer finds the Java information in the package manager and automatically creates a link to it in the directory /opt/sesam/bin/sesam. If the SEP sesam Server and Java are installed via Tarball, you must create the link manually.

Linux – Tarball

If Java is installed as Tarball, the SEP sesam Server must also be installed as Tarball. The installation of a SEP sesam Server package with --nodeps is not supported.

Install Java Tarball as follows:

  • Download a Java version that is compatible with your operating system, such as SUN Java 64-version jre-7u<version>-linux-x64.tar.gz, to/opt/java.
  • Go to the directory /opt/java.
  • Extract the Tar archive ./jre-7u<version>-linux-x64.tar.gz to the folder /opt/java.
  • Java is now unpacked into the subfolder jre1.7.0_45 and is ready to use. Java functions can be tested as follows:
#>  /opt/java/jre1.7.0_45/bin/java -version
java version "1.7.0_45"
Java(TM) SE Runtime Environment (build 1.7.0_45-b18)
Java HotSpot(TM) 64-Bit Server VM (build 24.45-b08, mixed mode)
  • Create the directory structure /opt/sesam/bin/sesam to link Java to the SEP sesam Server installation:
#> ln -s /opt/java/jre1.7.0_45/bin/java /opt/sesam/bin/sesam/java
  • You can now proceed with the installation of SEP sesam Server via Tarball.


You can operate several Java versions on Windows. The SEP sesam Server can work with a Java version other than the operating system's default Java version. Enter the path of your Java version into the <SESAM_ROOT>\var\ini\sm.ini file in the [JAVA] section:

  java_interpreter="C:\Program Files\Java\jre7\bin\java"
  java_home="C:\Program Files\Java\jre7"

This gives the SEP sesam Server its own Java environment on startup.

Where can I get the latest 64-bit version of Sun's JRE?

The link below takes you to a list of different versions of Sun's Java Runtime Environment for your operating system and architecture (64- and 32-bit). After accepting the license agreement, you can download the relevant package.



How do I install a Remote Device Server (RDS)?

Detailed instructions can be found at How to create a Remote Device Server (RDS).

    • Linux/UNIX: Select and install the SEP sesam Remote Device Server package (for example, sesam_rts-4.0.2-13.rhel5.i386.rpm for RedHat) from the SEP download center.
    • Windows: Select the SEP sesam Server package (for example, sesam-srv- from the SEP download center. Start the installation and choose SEP sesam Remote Tape as the package.
  1. Add the computer as a normal SEP sesam Client under Components -> Topology. Ensure that the DNS between the SEP sesam Server and SEP sesam Remote Device Server is properly handled.
  2. Create a new drive group under Components -> Disk Drives and select the drive from the remote computer as a New drive.
  3. To see the name of the new device on the Remote Device Server, use the command: <SESAM_BIN>/sesam/slu topology (for example, Tape0 or/dev/nst0). If you selected a disk drive, you only need to enter the drive type DISK_HARD.
  4. Create a new media pool and assign it to the new drive group.
  5. Register the new media to the media pool.

How do I install the SEP sesam GUI on a Linux system?

To install a SEP sesam GUI on a Linux system, proceed as follows:

  1. Download a package for your Linux distribution from https://download.sep.de/linux/.
  2. Depending on your distribution, install the SEP sesam GUI, as described in SEP sesam Quick Install Guide.
  3. After installing, check that the SEP sesam Server is available by using the following command:
  4. nslookup <SEP sesam Server name> For details, see nslookup.
  5. Make a shortcut with the following path:
  6. /opt/sesam/bin/gui/sesam_gui -S <SEP sesam Server name>

What problems may occur after installing the SEP sesam RPM package?

The following message appears when starting the SEP sesam GUI:

The connection to the server sesamserver was denied.

The last message was:

  java.rmi.RemoteException: Connection refused to host: [SEP sesam-Server]; nested
  exeption is:
  java.net.Connect.Exception: Connection refused

Make sure that the SEP sesam RMI Server component is active and that the correct port is being used.

The program is terminated.

If you get this error message, check the Java version with the following command:

/opt/sesam/bin/sesam/java -version

If the Java version is not 1.7 or higher, you will need to update the Java files.

How do I change the IP address and server name of the SEP sesam Server?

Your license must first be modified to match the new server name and/or IP address. Send the original license, the new server name and the IP address to info@sep.de.

When you receive the new license information, you can change the SEP sesam Server name using sm_setup. Set the SEP sesam profile and enter the following command:

sm_setup change_servername <mynewserver>

After executing the command, check the interfaces of the renamed SEP sesam Server: Main selection -> Components -> Clients -> double-click the server to open the properties. In the Interfaces field, manually remove the old interfaces and enter the new interfaces for http and https.

Manual add remove interfaces.png

How do I adjust SEP sesam limits?

The best way to adjust SEP sesam limits on the system is to create the Systemd override file. By using this file the settings are not overwritten during the update.

To adjust the SEP sesam limits, proceed as follows:


> root@cefix:~# systemctl show sepsesam.service | grep ^LimitCORE=
> LimitCORE=2147483648

  1. Create the override file and adjust the value:
  2. > mkdir -p /etc/systemd/system/sepsesam.service.d/ > echo "[Service]" > > /etc/systemd/system/sepsesam.service.d/override.conf echo > "LimitCORE=infinity" >> > /etc/systemd/system/sepsesam.service.d/override.conf
  3. Reload the system by using the command:
  4. > root@cefix:~# systemctl daemon-reload
  5. Then specify:
  6. > root@cefix:~# systemctl show sepsesam.service | grep ^LimitCORE= > LimitCORE=infinity

What effect does an antivirus scanner have on SEP sesam?

Antivirus scanners may negatively impact the backup and restore operation:

  • The SEP sesam install process is very slow
  • The GUI is slow or hangs for several seconds
  • Backup and restore jobs are terminated abruptly
  • Reduced data throughput and speed
  • Sesam server / client is not available (Errorcode 10060)

Use antivirus exclusions rules for SEP sesam. The following items must be excluded from any virus scanning activities:

  • All SEP sesam installation directories on the SEP sesam Server, Client and Remote Device Server (RDS):
    • SESAM_BIN directory including all subfolders
    • SESAM_VAR directory including all subfolders
  • Data store on the SEP sesam Server and Remote Device Server:
    • Any partition on which data store has been configured for backup must be excluded from virus scanning.
  • All SEP sesam processes on the SEP sesam Server, Client and Remote Device Server:
    • Exclude all executable files from the following directories:

With some virus scanners, you can disable the Child Process Monitoring rule option. In this case, only the following SEP sesam processes must be excluded:





How do I calculate the data store capacity (free space calculation and license check)?

In SEP sesam version 4.2.2, if non-SEP sesam data is stored on the same volume as the SEP sesam data store, then a SEP sesam storage license is required for this data. Now only SEP sesam data is counted.

The method for calculating the required disk space changed with SEP sesam version 4.4. It is now possible to store non-SEP sesam data on the same partition as the data store. The new formula is as follows:

space occupied by Sesam + free disk space > DS capacity

where "DS capacity" is the configured capacity value in SEP sesam's data store configuration.

SEP sesam expects the configured data store space to be available:

It is essential that the value of volume size of non-sesam data is always larger than the data store capacity value! If the configured data store capacity is not completely available for SEP sesam (i.e., if the non-sesam data occupies more space), backup or migration tasks will fail, even if there is free space on disk.

DatastorePositive.pngDatastoreNegative.png DatastorePositiveError2.png


   Volume size:     10 TB
   Used by Sesam:    4 TB
   Used by non Sesam 3 TB
   Free disk space:  3 TB
   DS capacity:      6 TB
   4 TB + 3 TB     > 6 TB:  -> Backup can start
   DS capcity:       8 TB
   4 TB + 3 TB     < 8 TB:  -> Backup will fail

For example, data store reports the following error:

 Not enough disk space could be freed to reach high water mark of -100GB for data store Data-Store. 
 (Data store: Data-Store. Free space: 696GB . Freed: 3GB). 

Solution: You have to correct the capacity value of your data store.

How do I determine the number of SID for Oracle?

View the list of the operating system's running processes

If an Oracle instance is running, the system monitor will also be running. The name of the Oracle process always contains part of the instance name. The common form is ora_<process_name>_<sid>

oracle@myhost:/ ps -ef | grep smon
oracle 23557 11596 0 Dec 19 ? 0:22 ora_smon_rac1

In this case, the SID is rac1.

Check the oratab

Open the oratab in /var/opt/oracle. You will find the name of the instance and the Oracle home for automatically starting Oracle instances.

oracle@myhost:cat /var/opt/oracle/oratab

View the parameter file

In the Oracle home under dbs or database, you will find either init<sid>.ora or the relevant SP file. The parameters of the instance are stored here. The db_name and instance_name parameters provide information about the database name and SID.

Sign in on the instance as DBA and query the relevant views

In SQL*Plus as DBA-User: SQL

1.	SHOW parameter db_name
2.	SHOW parameter instance_name

The following statements can be used from every tool

1.	SQL> SELECT instance_name FROM v$instance;
2.	SQL> SELECT [name] FROM v$database;

For more information on SID, see: http://www.ordix.de/ORDIXNews/1_2004/db_1.html (German).

How do I configure SEP sesam profile to run automatically during login?

Create a link in the directory /etc/profile.d/:

ln -s /var/opt/sesam/var/ini/sesam2000.profile /etc/profile.d/sesam.sh

How do I set permissions for a GUI client?

In SEP sesam versions before 4.4.3 Grolar, you have to set client permissions via the command line. As of version 4.4.3 Grolar, you can simply set client permissions by configuring ACLs in the SEP sesam GUI. For details, see Using Access Control Lists.

What problems may occur when adding a new client?

The following error messages may appear when adding new clients to the SEP sesam Server.

Error message:

No Access for Computer pc2 - please enter for pc1


There is no SEP sesam installed on computer pc2, please install it.

The problem might be:

  • There might be no SEP sesam Client software installed.
  • The wrong system name has been entered in the SEP sesam GUI.
  • There is an active firewall between the two computers. By default, a firewall is active on Windows XP with SP2 and SuSE Linux after 9.1.


  • Install the SEP sesam software on the target client.
  • If the name was entered incorrectly, delete it and then re-enter it.
  • Deactivate the firewalls or install the SEP sesam Firewall option.

Error message:

Rights Restriction -  [pc1.domain.de system] in pc2:<SESAM_VAR>/var/ini/sm_ctrld.auth

Problem: The SEP sesam Server has no privileges to access the client.

Solution: Enter the value in the [___] into the client's <SESAM_VAR>/var/ini/sm_ctrld.auth.

Error message:

Test backup from pc2 does not restore to pc1 - please verify ( ping, DNS, local STPD)

Problem: The connection between SEP sesam Client and Server is not functioning.

Solution: Check DNS resolution. SEP sesam recommends using the sm_setup check_resolution command, as described in How to check DNS configuration. Make sure that you have set up a SEP sesam profile before running the command; for details, see FAQ: What happens when I set a profile?

How can I install the freeware version of SEP sesam on SuSE LINUX 10.0 Prof. Community Version?

The installation can be accomplished using YasT. If there is no SUN Java currently running on your computer, it will be automatically selected by YasT. In addition, SEP sesam can be installed using the rpm -U <sesam serverpackage>.

How do I use the Nagios plugin from Netway to query and monitor the SEP sesam database?

Attention – Disclaimer

Open source monitoring tools like Nagios are not part of, nor are they supported by, SEP AG and/or its partners and subsidiaries. Neither are other programs or scripts which query data from the SEP sesam DB or any other SEP sesam module that are not specifically distributed by SEP AG. SEP cannot and will not make any guarantees or warranties as to the usability or functionality of such scripts. Therefore, for obvious reasons, SEP cannot offer support for any of these customer and client designed and implemented tools or programs. Consequently, there is no support for the client specific programs.

NETWAYS GmbH has developed an open source database query routine for SEP sesam – the Nagios plugin. In accordance with the OSF foundation rules, this is a free software package and comes with the standard disclaimers regarding warranty, usability and functionality. In other words, use it for free at your own risk.


Since many names of parameters in the SEP sesam database have changed in version 4.0, you have to choose the relevant version of the plugin. You can download it from SEP Download Center.

Demo scripts from projects Various scripts have been written for specific projects to allow customers to query (retrieve information from) the SEP sesam DB. These scripts are very specific to the client environments and are in no way guaranteed to work in other environments. Sample scripts to query the SEP sesam database have been written illustrating the use of the Nagios methodology and are meant to be used for demonstration purposes only. They can be found at SEP Download Center.

How do I configure a command event?

You can configure the command events in the SEP sesam GUI. Note that you might need to set the permissions to execute the commands. For details, see Creating a Command Event.

How do I configure a follow-up event?

As of SEP sesam version ≥ 4.4.3, you can configure follow-up events that are triggered on the SEP sesam Server once the initial event is completed. You can set up migration, save set verify and other actions to be triggered immediately after backup or other event is completed. For details on configuring such events, see Follow-up events.

How do I change data size units?

As of SEP sesam v. 4.4.3 Tigon, you can change the default unit for data size. Data size can be specified either with decimal (KB, MB, GB, TB) or binary prefix (KiB, MiB, GiB, TiB). You can also set different data size unit for the individual table. For details, see Changing data size units.


How do I set a specific language for the SEP sesam GUI?

By default, the SEP sesam GUI always starts with the language of the operating system. This can be changed by adjusting the parameter -r of the GUI client. The parameter can be used when calling the GUI directly (i.e. on Linux) or when editing the link itself. The following settings are possible (do not use space after the parameter!):


The first option represents German. The other three options represent English: the first English option shows time in 24-hour format whereas the second and the third option show time in the 12-hour format (AM and PM).

How to set Chinese fonts?

The default GUI font type Tahoma does not supply Chinese characters. The default type can be modified with the entry 'key= default_font[_...]' in the SEP sesam Defaults table.

As the available Chinese font sets depend on the operating system, the following platform specific keys are provided:

  • Windows: 'default_font_windows'
  • Linux: 'default_font_linux'
  • Common setting: 'default_font'

Example to set 'MS Song' as 'default_font_windows':

sm_db "INSERT INTO defaults (key,user_name,value,host,protection)
VALUES ('default_font_windows','sesam','MS Song',NULL,NULL);"

Can I administer more than one SEP sesam Server via the GUI?

To administrate more that one SEP sesam Server, enable the Master GUI functionality.


  • Important! All SEP sesam Servers must be of the same version to use this functionality!
  • No special license is required.
  • Use the switch -M1 to enable this function.

On a Windows system, edit the SEP sesam desktop shortcut and add the parameter -M1 to the target:

"C:\Program Files\Java\jre6\bin\java.exe" -classpath sm_gui.jar;sm_lib.jar;
de.sep.sesam.gui.client.Frame -ucr -sbackupserver -lwindows -p11401 -P local -v2 -ren -M1

On a Linux system, start the GUI executable /opt/sesam/bin/gui/sesam_gui with the parameter -M1:

./opt/sesam/bin/gui/sesam_gui -M1


How can I verify that the SEP sesam server has full access to a specific client?

Even if you can reach a client from the SEP sesam Server with nslookup and pingover DNS names, it is still possible that the SEP sesam Server cannot connect to the client. In this case, check the availability of the client from the SEP sesam Server with the following command:

For Linux/UNIX client:

sm_ctrlc -l root {nameofclient} sbc
sm_ssh -l root {nameofclient} sbc

For Windows client:

sm_ctrlc -l system {nameofclient} sbc
sm_ssh -l system {nameofclient} sbc

The output should be similar to the following standard output of the sbc command (example for a Linux client):

  smsrv:~ # sm_ctrlc -l root dbsrv.local sbc
2016-11-22 13:11:44: sbc-3036: Info:     # @(#)SESAM BACKUP CLIENT FOR UNIX FILE SYSTEMS, VERSION: 4.4R3 Build: 3ed0977 20161122 11:34:51 Linux x86_64 sles11fix #
2016-11-22 13:11:44: sbc-3162: Info:     Client Host name: buildfix11
2016-11-22 13:11:44: sbc-3253: Info:     Sesam version: [server,,20161122114206]
2016-11-22 13:11:44: sbc-3257: Info:     Sesam package: [sesam_srv-4.4.3-24_pg.sles11.x86_64.rpm]
2016-11-22 13:11:44: sbc-3019: Info:     OS info:          SUSE Linux Enterprise Server 11 (x86_64)
2016-11-22 13:11:44: sbc-3000: Info:

 sbc -b|r|g|p|k|h   [-C <control_host>] [-d <device>] [-f <list_source>]
          [-F <data_format>] [-i <saveset_info>] [-j <job_name>]
          [-l <level>] [-L <control_target>] [-n <segment_number>]
          [-o {options}] [-O <STOR/RETR_direct>]
          [-R <restore_target>] [-s <saveset_spec>][-S <storage_node>]
          [-t <tape_spec>] [-T <since_time>][-x <exclude_patterns>]
          [-X <exclude list>] [-v <level>] [-V <throughput_interval>]
# Backup  #   [<backup_source1>[ <backup_source2> <backup_sourceN>]] |
# Restore #   [<restore_source1>[ <restore_source2> <restore_sourceN>]] |
# Get     #   [<remote_file> [<local_file>]] |
# Put     #   [<local_file> [<remote_file>]]
{options}: comma separated list of
                     compress, encrypt[_plain]=[{aes}|{bf}]<passwd>
                     noacl                 # process without ACL (Trustees)
 only for backup:    verify                # verify data after backup
                     plain                 # do not descend into subdirectories
                     hard=defer            # defer hardlinks
                     hard=sort             # expect i-node sorted input
                     ignore_finderr        # ignore errors from sbc_find
 only for restore:   rename, overwrite     # rename/overwrite if file exists
                     over=new, over=old    # overwrites newer/older files
                     plain, tree           # restore plain/tree in target dir
                     next                  # start from subsequent tape
2016-11-22 13:11:44: sbc-3001: Info:     Exiting.

When a network problem occurs, the output may look like:

  2007-10-26 13:25:59: scc-1128: Error: Network communication problem: STDLIB
  error: 110 - Connection timed out. connect() call failed for host:

Or a connection from SEP sesam Server to the SEP sesam Client may be forbidden:

  2007-10-26 13:28:29: scc-1128: Error: Network communication problem: CTRLD
  reply: 2007-10-26 13:37:55: scd-1136: Error: Host [smsrv.local] is not
  allowed to connect or security problem for user: [root].

Which are SEP sesam default TCP ports?

SEP sesam client-server communication requires certain TCP ports to be open to enable SEP sesam components to communicate with each other through a firewall. The required ports may be SEP sesam version-specific; as of version ≥ 4.4.3 Beefalo SEP sesam uses fewer ports than in the previous versions. For the complete list of SEP sesam ports and their configuration, see List of Ports Used by SEP sesam.

Why do I get the error: "Network communication problem: SOCKET error: 10038 – The descriptor is not a socket" when I try to connect to a client?

The Layered Service Provider (LSP) chain is defective or damaged. The cause can be an antivirus program or a virus. Another option is that the DLLs were switched during installation or uninstallation. This results in sub-processes not being able to inherit/open your socket handles.

In this example, the SEP sesam CTRL connection takes the SM_CTRLD_MAIN daemon call from SM_CTRLC, opens the necessary sockets and passes them onto the newly created sub-process SM_CTRLD. Due to the defective LSP, the sockets cannot use this information and return the following error during an operation such as setsockopt():

10038 – The descriptor is not a socket.

Use the following free tools on the SEP sesam Client:

* lspfix.exe – identifies blocked DLL's, for example, bmnet.dll and removes them
* listdlls.exe – checks the chain of DLLs (alternatively use sm_list -f {PID of SM_CTRLD_MAIN})

Corrective measures:

  1. Check if the Layered Service Provider (LSP) links with lspfix.
  2. Check the sm_ctrld[_main].exe indirectly used DLLs with listdlls.
  3. Remove the conflicting DLL with lspfix.

An example of a correct listdlls for an environment:

      #> listdlls.exe sm_ctrld
      D:\kit\su\src\gui>listdlls sm_ctrld
      ListDLLs v2.25 - DLL lister for Win9x/NT
      Copyright (C) 1997-2004 Mark Russinovich
      sm_ctrld_main.exe pid: 4872
      Command line: D:\programme\SEPsesam\bin\sesam\sm_ctrld_main.exe -D
      Base Size Version Path
      0x00400000 0x23000
      0x7c910000 0xb7000 5.01.2600.2180 D:\WINDOWS\system32\ntdll.dll
      0x7c800000 0x106000 5.01.2600.2945 D:\WINDOWS\system32\kernel32.dll
      0x71a10000 0x17000 5.01.2600.2180 D:\WINDOWS\system32\WS2_32.dll
      0x77be0000 0x58000 7.00.2600.2180 D:\WINDOWS\system32\msvcrt.dll
      0x71a00000 0x8000 5.01.2600.2180 D:\WINDOWS\system32\WS2HELP.dll
      0x77da0000 0xaa000 5.01.2600.2180 D:\WINDOWS\system32\ADVAPI32.dll
      0x77e50000 0x91000 5.01.2600.2180 D:\WINDOWS\system32\RPCRT4.dll
      0x719b0000 0x40000 5.01.2600.2180 D:\WINDOWS\system32\mswsock.dll
      0x66710000 0x59000 5.01.2600.2180 D:\WINDOWS\system32\hnetcfg.dll
      0x77ef0000 0x47000 5.01.2600.3099 D:\WINDOWS\system32\GDI32.dll
      0x7e360000 0x90000 5.01.2600.3099 D:\WINDOWS\system32\USER32.dll
      0x719f0000 0x8000 5.01.2600.2180 D:\WINDOWS\System32\wshtcpip.dll

After removing the defective DLL, the socket can be inherited by the sub-process SM_CTRLD.

Why is the throughput for local backups very low?

In some Linux systems, e.g., SLES 12, the local loopback device lo is often configured with MTU (Maximum Transmission Unit) size 65536 (64K). This may decrease the local transfer throughput because the MTU size is equal to the transfer buffer size used in SEP sesam.

Proceed as follows to check and modify the MTU size for local loopback:

  1. To check the local loopback MTU size: ifconfig lo
  2. To set the MTU size to 16K: ifconfig lo mtu 16384
  3. Add or change MTU='16384' in /etc/sysconfig/network/ifcfg-lo for SLES12


 srv1:/ # ifconfig lo
lo        Link encap:Local Loopback
          inet addr:  Mask:
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:61869492 errors:0 dropped:0 overruns:0 frame:0
          TX packets:61869492 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:5001500685 (4769.8 Mb)  TX bytes:5001500685 (4769.8 Mb)
 srv1:/ # ifconfig lo mtu 16384
 srv1:/ # grep MTU ifcfg-lo /etc/sysconfig/network/ifcfg-lo
 srv1:/ # echo MTU=16384 >> /etc/sysconfig/network/ifcfg-lo

See also:


What is SEP sesam Newday?

SEP sesam Newday is a predefined SEP sesam daily event that resets the backup event calendar and is managed by SEPuler. A Newday event is used by SEP sesam to reorder its database and enable uninterrupted activity of SEP sesam processes, therefore it must never be completely deactivated or it will cause SEP sesam to stop working properly. It also gives system administrators the flexibility to extend backup routines to run after midnight and retain the backup date of the prior day. This is very useful when the clients requiring backup exceed the time allotment between the end of day and midnight. For details, see Newday Event.

Is there an overview of SEP sesam services?

There are different services depending on whether you are dealing with a SEP sesam Server, a SEP sesam Client or a SEP sesam Remote Device Server.

The services can be found in the SEP sesam installation directory <SESAM_ROOT>/bin/sesam. To check the status of the services, use the following commands:

  • Linux/UNIX:
./sm_main status
  • Windows:
sm_main status

SEP sesam Server services

sm_qm_main   SEP sesam main processes, provides also the qm service
sepuler      SEP event calendar to control all tasks
db           SEP sesam databank services
qm           Queue Manager, administers backups, restores and devices
rmi          server part of the graphical user interface
sms          read/write of SEP sesam media
stpd         linking protocol from the SEP sesam Client to the SEP sesam Server
passd        security administration for SEP sesam
ctrl         linking protocol from the SEP sesam Server to the SEP sesam Client
sshd         secure linking protocol from the SEP sesam Server to the SEP sesam Client

SEP sesam Client services

sm_qm_main    SEP sesam main processes
ctrl          linking protocol from the SEP sesam Server to the SEP sesam Client
sshd         secure linking protocol from the SEP sesam Server to the SEP sesam Client

SEP sesam Remote Device Server services

sm_qm_main    SEP sesam main processes
ctrl    linking protocol from the SEP sesam Server to the SEP sesam Client
sms     read/write of SEP sesam Media
stpd    linking protocol from the SEP sesam Client to the SEP sesam Server
passd   security administration for SEP sesam
sshd         secure linking protocol from the SEP sesam Server to the SEP sesam Client

In Backups by state, what do the flags in the column type mean?

The first letter shows the type of backup:

F/D/I/C:  Backup level (full, differential, incremental, copy)
M:        Media event
N:        SEP sesam NEWDAY
S:        SEP sesam startup
X:        SEP sesam command event

The second letter is used when a database backup is performed. It has no significance for regular path backups.

 H:  Hot - online backup of a database
C:  Cold - offline backup of a database

What happens when I set a profile?

By setting a profile:

  • the <SESAM_ROOT>/bin and <SESAM_ROOT>/var/db/ directories (and their subdirectories) are added to the "$PATH" environment variable so that SEP sesam commands can be executed globally,
  • you do not need to be in the actual "run directory".

Set the profile as follows:


Go to the directory <SESAM_VAR>/var/ini and call:

. sesam2000.profile

Important! Do not forget the dot and the space!

Alternatively, use:

source sesam2000.profile

This sets the profile only for the current session. To set it permanently under Linux, see How do I configure SEP sesam profile to run automatically during login?

Microsoft Windows

Open a command window, then go to the directory <SESAM_ROOT>\var\ini and call:


Alternatively, use the link <SESAM_ROOT>\var\ini\sm_prof.bat.lnk

Why does the SEP sesam GUI create so many Java processes under Linux?

On some Linux Systems, the threads created by the SEP sesam GUI are shown in the process table. These are not real processes but only threads. There is a large number of processes because Java creates threads for all objects with Listener functionality.

Why does SEP sesam Server use so much disk space on the local hard disk?

One of the essential advantages of SEP sesam is that not all information is filed in a database but, instead, in simple text files. The largest files are usually the *.lis files which contain information about the backup's unique files and are used by the restore wizard to select and restore unique files. *.lis files are stored in the following directories:



Microsoft Windows:


SEP sesam can compress *.lis files automatically. See Compressing SEP sesam Listing Files.

Before compressing the files, set the SEP sesam profile as follows:


 source /var/opt/sesam/var/ini/sesam2000.profile

Microsoft Windows:


Use the "sm_newday" command to run file compression immediately. The files will be compressed directly by the NEWDAY schedule.

As predefined in the command, *.lis files are not compressed immediately but three days after they are created. This is because most restores are triggered within three days after a backup.

All *.lis files are converted into a compressed file format and are uncompressed by SEP sesam automatically whenever necessary.

BACKUP (general overview)

Is data that is collected for backup stored in a flat file or a database?

Data is stored in a flat file but information about the backup is stored in the SEP sesam database, including index pointers for fast and easy data recovery.

Does SEP sesam back up open files?

Yes, SEP sesam can back up open files on both Linux and Microsoft Windows.

Microsoft Windows

Open files can be backed up with Microsoft's Volume Shadow Copy Service. To perform an open file backup, a Windows snapshot is made of the data and partition intended for backup and the partition is backed up. Databases should be backed up using the relevant SEP sesam database module.

System requirements:

  • Client O/S: Microsoft Windows 2003
  • SEP sesam Server Version 3.0 or higher
  • SEP sesam Client Version 3.0 or higher

Does SEP sesam perform incremental backups after the initial backup?

Depending on your backup strategy, SEP sesam can be set to perform any backup level in the desired sequence.

The following backup levels are available:

A FULL backup always copies all data specified by the backup task, regardless of whether it has been changed or not. A saveset created as FULL is the basic saveset for subsequent DIFF or INCR savesets. While the backup time of a full backup can be significant, restore is fast and simple since only one backup saveset is required. Information about the backup status is stored in the SEP sesam database. Note that the archive bits are not deleted on Windows systems. If you want to force-reset of the archive bits, you can enter the command -o clear_archive in the backup options.

A DIFF (differential) backup saves only data which was created or changed after the last FULL saveset had been created (of the same task). A differential backup is faster than a full backup, however, to restore the whole data source, first the saveset of the full backup has to be restored followed by restore of the DIFF saveset. For this, SEP sesam provides generation restore that enables browsing for and selecting for restore all generations of backed up files since the last full backup.

An INCR (incremental) backup saves only data which was created or changed after the last backup (FULL, DIFF or INCR) of the same task. This is the fastest backup method and requires the least storage space. Restoring from incremental backups is the slowest, because it requires all related savesets to be copied back – the saveset of the last full backup as well as all INC backups. You should consider the advantages of time and resources when planning your backup strategy. A combination of FULL backups stored to tape drives, and DIFF or INC backups stored to virtual disk media is a common method.

A COPY backup is a full backup that has no influence on following differential (DIFF) or incremental (INCR) backups. For the treatment of archive bits, see FULL backup above. COPY backup is usually used for additional full backups, e.g., monthly backups, or backups for archiving, i.e. removal from storage.

Information sign.png Note
In case no initial FULL backup exists, differential (DIFF) or incremental (INCR) backups are automatically performed as FULL backups.

Are backups performed directly to disk or tape?

Backups can be written directly to either tape or disk. SEP sesam version supports disk-to-disk-to-tape (D2D2T) functionality. Additionally, it can write directly from the backup tape to the server. This is beneficial and saves a lot of time when performing a disaster recovery.

All backup functions are written and/or controlled by the server and may be written directly to the backup disk, tape or remote tape server. SEP sesam supports virtual tape libraries on disk with a pseudo autoloader function. Removable disk media are also supported.

When several users save the same file on separate clients, does SEP sesam backup all the files?

For example, if members of a workgroup save the same file to their respective desktops, does SEP sesam make separate copies of the file or a single file with pointers to the changes?

Typically, SEP sesam stores separate files for each user, unless you are using the SEP Si3 target deduplication. With SEP Si3 target deduplication only one instance of the same data is stored directly on backup media. Si3 deduplication can be easily configured, but it also requires a special license. For explanation, see SEP Si3 target deduplication and SEP sesam extensions.

How to set up an Si3 deduplication store for replication?

The easiest way is to use the initial seed functionality - you can import the preconfigured Si3 deduplication store and use it for the purpose of replication. When replicating from origin to new Si3 store, the save sets on the new Si3 deduplication store are recognized and the content of the new Si3 store is updated in the SEP sesam database. For details, see Seeding Si3 Deduplication Store.

How are archive bits processed?

As of SEP sesam version, archive bits are no longer used for incremental and differential backups on Microsoft Windows. This can be changed if necessary.

Note: As of SEP sesam version 4.2.1, file system backups on Microsoft Windows are always executed as a backup level COPY. Two new options were introduced:

  • "-o add_archive_ready" to add files with the Archive ready attribute
  • "-o clear_archive" to reset the Archive ready attribute.

If "with_archive_bit" is set to the value 'yes', then all FULL/DIFF/INCR backups will be executed as COPY. The following are additional options:

  • FULL: -o clear_archive
  • DIFF: -T {since_last_full} -o add_archive_ready
  • INCR: -T {since_last_backup} -o add_archive_ready,clear_archive

You can set the use of archive bits with the command:

sql "update defaults set value= 'yes' where key= 'with_archive_bit'"

After setting the value to 'yes', the Windows archive bits are treated as follows, depending on the backup level:

Saves all files without regard to the archive bit, archive bit is not reset.
Saves all files without regard to the archive bit, resets archive bit.
Only files with archive bit are saved, archive bit is not reset.
Only files with archive bit are saved, resets archive bit.

The following issues must be considered when selecting a backup strategy:

  1. A backup sequence FULL-DIFF-INCR-DIFF... is not logical. Following an INCR backup with a DIFF will not save files saved by the INCR backup because the archive bit is reset!
  2. If the file archive bits are reset manually or by other programs, a following DIFF or INCR backup may not save the files!
  3. If archive bits are not changeable, for example, if they cannot be reset because they are in Read only directories, warnings will be returned during FULL and INCR backups.

Can I back up MS SQL/MS Exchange with the Volume Shadow Copy (VSS) functionality of Microsoft Windows?

Yes, the VSS functionality can be used to back up MS SQL or MS Exchange environments but it is only recommended for small installations.

There are two strategies for consistently backing up a running MS Exchange or MS SQL environment:

  1. Using the SEP sesam online extensions for MS Exchange or MS SQL. For details, see MS Exchange Backup and MS SQL Backup.
  2. A regular file system path backup with the activated VSS writer for MS Exchange or MS SQL. For details, see SEP sesam Volume Shadow Copy Service (VSS) for Windows.

SEP sesam online extensions

  • Dedicated backup of Groupware data/database data, independent of the files in the file system.
  • Available are FULL, DIFF (differential) and INCR (incremental) backup levels.
  • Provide granular backup of single databases and database instances.
  • Backup of the transaction log – other systems accessing the database are aware that a backup is performed.
  • Restore of the database/Groupware data only (without files from the file system)
  • Provide granular restore of single instances and databases. In a restore scenario, there is no need to restore the complete database – this is beneficial for larger databases/Groupware systems.
  • Perform online restore.

Backup via the Microsoft VSS Writer

  • The Volume Shadow Copy (VSS) functionality of Microsoft Windows is included in the regular SEP sesam file backup agent for Microsoft Windows. It also supports the VSS backup of MS Exchange and MS SQL.
  • A VSS-based backup of a database/Groupware system is always a file system backup. If the file backup agent starts backing up a file system with a MS SQL / MS Exchange database, the VSS functionality is used to inform the database about the backup. The database/Groupware system delivers the data consistently.
  • A VSS backup of a database/Groupware system always backs up all of the data. Incremental or differential backups are not supported and the backup of single databases or single instances is also not supported.
  • A database-only restore cannot be performed because the database/Groupware system is part of the complete file system backup, therefore the complete file system backup must be restored in order to restore the database.
  • Restore of single instances or single databases is not supported.
  • The transaction log file is not backed up – other applications are not informed about the backup of the database.

To enable a consistent restore in distributed environments, the different components must be informed if a backup of one of the systems is performed. For example, in a SharePoint Server environment, the database and mail server run on different servers. A VSS backup of a single server will result in an inconsistent restore. In this case, only the backup with the SEP sesam dedicated online extension can guarantee consistent data.

In summary, the backup of MS Exchange or MS SQL environments via VSS is a viable option to get a consistent backup of the running environment as long as the data volume is not too large. It is an alternative for small environments with 1-5 users. In critical productive environments, the use of the SEP sesam online extensions for MS Exchange/MS SQL is highly recommended.

What is the difference between a Groupwise backup with the SEP sesam online extension and one without the extension on an OES Server?

There are two ways to back up a Micro Focus (formerly Novell) Groupwise Server with SEP sesam. You can use the SEP sesam Groupwise extension or the administrator can perform a TSA based file-level backup of the Groupwise Server.

In general, the backup of a Groupwise Server is always performed via TSA interface, either via tsafsgw or tsafs (gw-enabled). There is no difference between the two backup options. The difference is in the management of the backup and restore jobs.

To find out more about SEP sesam's backup in a Micro Focus (formerly Novell) Netware/OES environment, read Backup principles using SEP sesam in a Micro Focus OES environment.

For file-based backup and restore, you will need qualified knowledge of the Groupwise environment and the management of Groupwise systems. With the SEP sesam Groupwise online extension, the backup and – more importantly – restore of Groupwise systems can be performed by an administrator without any knowledge of the Groupwise environment.

Backup with SEP sesam Groupwise extension

When a new backup job is being defined for a client, the SEP sesam extension automatically recognizes that Groupwise is running on the client and offers the administrator a Groupwise backup. The administrator does not need to know where the Groupwise data is stored or which files are to be backed up.

The backup is started as a Groupwise backup process and is clearly identified as such. The SEP sesam Server recognizes that this is a Groupwise backup and not a normal file backup. This makes management and problem location (in the event of a problem) much easier. Technically, it is only a file backup but the SEP sesam agent ensures that the right files are backed up from the right directories.

The scenario for a restore is similar. The SEP sesam Groupwise extension recognizes the backup (technically a file backup) and is aware that all the files belong together to a Groupwise system. The SEP agent then restores all the relevant files to the Groupwise restore area on the Groupwise Server. Based on the data in the Groupwise restore area, Groupwise can start a recovery process to restore the data (mail or mailboxes). The administrator does not need to know which files need to be restored or where they should be restored to.

Backup without SEP sesam Groupwise extension

Backing up a Groupwise system without the SEP sesam Groupwise extension is performed much like a regular file backup. Groupwise is shown as a regular NSS volume in the file system with its volume name. The administrator needs to know:

  • which is the Groupwise volume
  • which files within the volume need to be backed up

The backup process itself starts as a file backup process. For the restore, the administrator needs to know:

  • which files need to be restored
  • the location of the Groupwise restore directory


How do I set up a UNC path backup from a CIFS share?

This example assumes that the SEP sesam Server or the SEP sesam Client is on a Microsoft Windows system. Not all rights of the backed up files and ACLs are considered. For a NetApp CIFS share backup, see NetApp CIFS backup.

In Microsoft Windows, services – and therefore the SEP sesam processes – usually run under the special SYSTEM account. This account has all local access rights but, for security reasons, no access rights for non-local or network drives. To access network drives, the following configurations must be modified:

  • For SEP sesam Clients to which the backup task is assigned, the SEP sesam service should run under an administrator account (services.msc -> SEP sesam Server-> logon under an administrator account) with full read and write privileges for the network drive.
  • Share the network drive in such a way that it is not necessary to login for read and write privileges. This can be tested by opening the shared path on the SEP sesam Server in Windows Explorer. If the content of the share is displayed without a user and password request, the UNC path can be used as a source for the backup task.

Because of the enhanced security introduced after Microsoft Windows 2000, you cannot assign a dedicated drive letter (for example, e:\). Instead, the path must be entered using UNC notation. The backup is performed over the UNC names, for example, //fileserver/install/Driver.

The image below is an example of a backup task configured in SEP sesam GUI:

NetApp CIFS 4.4.3.jpg


The VSS option must be disabled when backing up UNC paths. You can only use one path for each task.

Testing with the command line

The SEP sesam service must be running under an administrator account. In the command line, enter the following for a backup:

C:\Programme\SEPsesam\bin\gui>sm_ctrlc -l system rmpc1(hostname of the system) sbc -b -s @test.save
-v 2 \\fileserver\pub\customers

For a restore command, enter:

C:\Programme\SEPsesam\bin\gui>sm_ctrlc -l system rmpc1(hostname of the system) sbc -r -s @test.save
-v 2 -R \\fileserver\pub\customers_restore

This saves the files from \pub\customers to the file (save set) test.save, i.e., it restores them from the saveset test.save to the folder \pub\customers_restore.

Excluding a UNC directory

The excluded UNC path in this example is: \\server\share\subfolder1\subfolder2.

  • UNC path exclude syntax using / (slash) is: //server/share/subfolder1/subfolder2.
  • UNC path exclude syntax using \ (backslash) (works from version is: \\\\server\\\share\\\subfolder1\\\subfolder2.

How can I configure a backup using another network or interface?

You must first establish an IP address for the new interface. The IP address is then automatically entered to the properties table of the SEP sesam Remote Device Server under Components -> Topology -> Clients, field Interfaces. In the backup events, the IP name must be selected from the Parameter tab in the field Interfaces.

For example, the computer "testme" has a 2nd interface module with the name "testmeb". In the backup task properties, select "testmeb" in the Interfaces field.

How can I enter a backup source with more than 256 characters?

If you want to define a backup source with more than 256 characters in the complete filename (path and filename), create a text file with a list of all the paths as the backup source (for example, /opt/sesam/var/ini/large_source.txt). Each path must be written below the previous one, resulting in a fully qualified file or directory name on each line.

Enter the backup option -f {file} in the backup task properties -> tab Options -> Backup options (previously Save options):

-f /opt/sesam/var/ini/large_source.txt

The SEP sesam Server reads this file during backup and stores the additional files and directories listed in the source directories.

How do I get backups to ignore archive bits and use creation/modification time?

As of SEP sesam version, archive bits are not used for incremental and differential backups on Microsoft Windows.

To set the use of creation/modification time, go to the <SESAM_ROOT>/bin/sesam directory and call:

sm_db "INSERT INTO defaults (key,user_name,value) VALUES ('with_archive_bit','sesam','no');"

FULL, DIFF and INCR backups will now ignore archive bits. DIFF and INCR backups use the start time of the last referenced backup – for DIFF, the preceding FULL backup and for INCR, any preceding backup.

The option below executes optional resetting of archive bits when it is inserted in the backup task properties in the Options tab of the Backup options (previously Save options) field:

-o clear_archive

How do I set up a backup to disk?

SEP sesam uses a data store to back up data directly on one or several configured storage locations. The default data store type is Path, also available are SEP Si3 deduplication store and (depending on version) NetApp Snap Store, HPE StoreOnce and HPE Cloud Bank Store.

Data stores are easily configured. Note that prerequisites differ depending on the selected data store type. For details, see Data Store Overview.

How do I perform a file backup of a Linux/Windows cluster?

To perform a file backup of a Linux/Windows cluster:

  1. Install the standard SEP sesam Client on each physical node.
  2. Check if every node and every resource of the cluster can be correctly resolved using DNS forward and reverse lookup.
  3. Add each physical node and each cluster resource as a backup client under Components -> Topology.
  4. After the clients have been successfully recorded, a backup task can be created for each cluster resource. During backup, the data is automatically transferred from the active node.

How can I exclude a directory from a backup?

You can exclude a directory by creating a special file – .nosbc (UNIX) or nosbc (Windows) in the directory itself. The behavior can be switched off for a specific backup task by entering the -o noexcl switch under the backup task properties, tab Options -> Backup options (previously Save options).

Can I exclude specific VSS writers from a backup?

Yes, it is possible to manually exclude a VSS writer from the backup. For details, see Manually excluding a VSS writer from backup.

How can I specify an exclude list that is longer than 150 characters?

Create a text file where all the paths are listed one below the other (for example, /opt/sesam/var/ini/large_exclude.txt) and save this file to a folder of your choice. During the creation of a backup, enter the folowing statement.

-X /example/directory/text file.txt

Example for a Linux client:

  -X /opt/sesam/var/ini/large_exclude.txt

Example for a Windows client:

  -X "C:\Program Files\SEPsesam\var\ini\large_exclude.txt"

During backup, all directories in the .txt file will also be excluded.

File exclude 4.4.3.png

See also How can I set the SBC so that the exclude list always uses the file pattern (?,*) instead of using regular expressions?.

How do I include or exclude a large number of files/folders for backup? How do I use a file for in- or exclude of files/folders?

If several directories or files are to be included in or excluded from a backup task, you can exceed the character count limit of the field:

  • SEP sesam version ≥ 4.4.3: max. 1024 characters
  • SEP sesam version ≤ 4.4.2: max. 255 characters

Use a file to define a backup source or an exclude list. This file must be created on the backup client on which the backup will be executed.

Include list

Note that an include list, introduced by option -f, behaves differently on different platforms.

On Windows
The -f <list_source> option overrides the backup source specified in the backup task. For example, creating a backup task with source g:\x and specifying an SBC option -f C:/sesam/backup_file_list.txt will back up only the data from the backup_file_list.txt while ignoring the directory g:\x, which was specified as a backup source.
On Unix/Linux
Both, the source and the data from the backup_file_list.txt are considered for backup. At least one item must be entered in the Source field. It is therefore recommended that the specified <list_source> file is specified as a source in the Source field (to be included in the backup set, for example, etc/sesam/backup_file_list.txt) and entered again with a -f switch in the Backup options (previously Save options) field: -f C:/sesam/backup_file_list.txt.

When creating an include list, create a separate line for each directory or file item in a file (for example, /etc/sesam/backupfiles.txt):


Wildcards are not allowed in file or directory entries.

Exclude list

The procedure for exclude is similar. The exclude file may be called /etc/sesam/excludefiles.txt, for example. Each file or directory that you want to exclude from the backup must be entered on a separate line in the file, for example:

 \./home/John Doe/videos.zip$
 \./home/John Doe/Business Documents/YearEnd Closing for business year 2006$

The exclude entries have to be set up with a regular expressions syntax.

If, for instance, all is entered in the source of the task definition, the complete system is backed up, excluding the items in the exclude file. Leave the exclude list empty.

Set up the following entry in the Backup options (previously Save options) field of the Options tab in the backup task properties:

 -X /etc/sesam/excludefiles.txt

SEP sesam will exclude all listed files and directories from the backup.

How do I use an exclude file in Microsoft Windows?

To exclude several directories from a backup source, create a .txt file that contains all the directories you want to exclude from the backup. This file should be created on the computer that you want to backup. For example:

Create the file exclude.txt on the client in the directory C:\Programme\SEPsesam\var\ini. The exclude.txt may, for example, contain the following:


The backup task source is set to D:. In the backup task window, tab Options -> Backup options (previously Save options) field, enter:

-X C:\Programme\SEPsesam\var\ini\exclude.txt


  • Use only "/" (slash) in the exclude file and NOT "\" (backslash)!
  • Every directory and file must be entered in a new line. This also applies to paths that contain spaces. Quotation marks (") must not be used in the in-/exclude lists.
  • Known bug: in the SEP sesam version 4.3.1-69, you must use a double backslash (\\) instead of a single slash (/)!

In this example, the entire drive D: is backed up except the directories that are listed in the exclude.txt.

How can I set the SBC so that the exclude list always uses the file pattern (?,*) instead of using regular expressions?

In the configuration file <SESAM_VAR>/var/ini/sm.ini on the SEP sesam Client, the entry


must be changed to


How do I exclude files and folders during a TSA based backup?

You can use the Exclude list field on the first – Task tab of the backup task. If several directories or files are to be excluded from a backup task, it may be possible that the count or character limit of the field (max. 255 character) will be exceeded. To solve this problem, use a file to define an exclude list. This file must be created on the backup client on which the backup is to be executed.


Only a pattern format can be used for exclude. Wildcards are allowed in the file or directory entries. An exclude folder must end with a slash.

Create a separate line for each directory or file item in a file (for example, /etc/sesam/backupfiles.txt):


For instance, /media/nss/VOL1 is entered in the source of the task definition. This means that the complete VOL1 is backed up, excluding the items in the exclude file. Next, set up the following entry in the Backup options (previously Save options) field of the Options tab in the backup task definition:

 -X /etc/sesam/excludefiles.txt

SEP sesam will exclude all the files and directories from the backup that are listed in the file.

How do I back up the eDirectory on Novell OES2 Linux without SP2?

Starting with OES2 SP2, a TSA-NDS (Target Service Agent – NetWare Service Directory) is available for eDirectory on Novell OES Linux. Note that it is recommended to update to SP2. A special task type called OES Novell Directory is only provided for OES2 without SP2. This task type uses SEP's sbc_nds and Novell's ndsbackup to back up the eDirectory. Using sbc_nds generates the appropriate command line for backup levels FULL/DIFF and INCR. The ndsbackup function requires user and password information. These values must be defined in the properties of the backup task as Backup option and Restore option with -a user= {your user},pass= {your password}.

For example:

-a user= cn= admin.o= novell,pass= novell

Selective restore is not supported but you can filter specific subtrees. To do this, choose Expert options in the restore wizard and enter the requested subtree under the Filter tab.

Availability of backup task type OES Novell directory
Provided for OES2 without SP2.
Availability of recent sbc_nds
Use the recent version : https://download.sep.de/netware/ sbc_nds_*.* or sesam-novell-client-*.*
Is sbc_nds in bin/sesam on client side available and executable?
Backup task with user and password
If it doesn't exist, define a backup user and password for eDirectory backup in Novell iManager.
Define a backup task with the task type OES Novell directory. The source is the identifier of your eDirectory tree or subtree. You may check this with thendsbackup scan function.
Set the Backup option and Restore option to: -a user= {your user},pass= {your password}
Use the target '/' to restore into the original tree.
With Expert options you may set the filter to the requested subtree.

Path for ndsbackup after eDirectory 8.8.1

As of eDirectory version 8.8.1, ndsbackup is no longer located in /usr/bin but instead in /opt/novell/eDirectory/bin/ndsbackup. Therefore you have to link to the SEP sesam bin directory to enable SEP sesam operation. Use the following command (note that this for default SEP sesam installation):

 ln -sf /opt/novell/eDirectory/bin/ndsbackup /opt/sesam/bin/sesam

Which mode should I use for TSAFS backup of OES Novell file systems?

The TSAFS should generally be loaded in Linux mode. The Netware mode and Dual mode are only intended for mixed environments (backup of native Netware servers) or for a Novell cluster in mixed mode.

  • On cluster nodes of a pure Linux OES cluster, use the TSAFS ONLY in Linux mode.
  • On a mixed cluster (OES Netware and OES Linux nodes), the TSAFS must be loaded in Netware or Dual mode. For the backup of the cluster volumes, the Netware Cluster filesystem target must be used.

How can I set or modify a retention time (EOL) for backup

When configuring SEP sesam environment, you set up media pools and define the retention time. The retention time period starts with the date a saveset is written to the medium (at the end time of the first backup) and thus defines the expiration date of the saveset (saveset EOL). The EOL property can be managed for three object types: Saveset EOL (the expiration date for each saveset), Backup EOL (the expiration date for all data that belongs to the same backup), and tape media EOL. If a saveset is part of a backup chain, its EOL follows the rules of dependency-based retention to retain the consistency of backed up data and ensure successful restore.

However, you can check or modify the expiration date (EOL) manually by setting the exact expiration date; for this you can use the calendar function to extend or shorten the saveset's/backup retention under all media-related views, e.g., in the Media, Media Pools and Data Stores properties. You can also directly expire the saveset or backup by clicking the Expire -> Saveset EOL/Backup EOL button. You should only expire the saveset (individual EOL) or backup (EOL of the entire backup set) if you know what the Expire function does and are aware that the expired savesets and backups are irrevocably lost! For details, see Managing EOL.


How to deal with a failed backup

There are various causes why the backups fail, e.g., file-size issues, insufficient permissions, etc. When a backup fails check the day log and search for errors. Then identify the problem by following the basic troubleshooting procedure in the Troubleshooting Guide. After fixing the problem, restart your backup to ensure that all your data is properly protected.

Information sign.png Note
In case of a failed backup, SEP sesam will delete the backup automatically after 3 days. If you want to keep any failed backup for a longer time, you may manually extend the backup EOL of a particular saveset. For details, see section Manually extending EOL.

A client backup did not function properly. How can I determine where the problem is?

The following test commands should help you isolate the problem. You can run a test backup for the target client from a SEP sesam Server or Client without writing data to a tape drive or disk drive. Run the following commands in the directory <SESAM_ROOT>/bin/sesam/.


The following commands produce a high network load.

Backup server Unix, client Windows

sm_ctrlc -l system  {client name} sbc -b -s -  f:/test  >/dev/null

Data from the F:/ directory on Windows is written over the network to the directory /dev/null on Unix.

To display this, append -v 1 to the command above. Everything written to /dev/null will be displayed.

sm_ctrlc -l system  {client name}   sbc  -b -s  -  -v 1      f:/test  >/dev/null

Backup server Unix, client Unix

sm_ctrlc -l root  {client name}   sbc  -b -s -  /usr  >/dev/null

To display the read data:

sm_ctrlc -l root  {client name}   sbc  -b -s -  -v  1   /usr  >/dev/null

Backup server Windows, client Unix

sm_ctrlc -l root  {client name}   sbc  -b -s -             /usr    > NUL

With backup data logging:

sm_ctrlc -l root  {client name}   sbc  -b -s -  -v  1   /usr    > NUL

If the test backup is to be run on the target backup client only, execute the following command:

In the Unix directory <sesam>/bin/sesam/:

sbc -b -s  -  /usr   >/dev/null

In the Windows directory <SESAM_ROOT>\bin\sesam\:

sbc  -b -s  -  f:/test    > NUL

Enter -v 1 to show the backed up data on your monitor.

Why do I receive the message: "Login incorrect. Password incorrect." during backup?

Check your name resolution (DNS or etc/hosts file). The SEP sesam Server and SEP sesam Client must be reachable with or without FQDN and should be able to resolve each other correctly, including the reverse lookup. In case you have changed an entry in your DNS configuration, but Windows still reports a wrong hostname/IP, try to run "ipconfig /flushdns" as administrator. If the resolution is correct, do the following:

  1. In the SEP sesam GUI, go to Main Selection -> Tasks -> By clients, and select the client where the backup problem is.
  2. Open the properties of the backup and click the tab the Options.
  3. Insert -v 4 in the Backup options (previously Save options) field.
  4. Start the backup again. Then go to Main Selection -> Job state -> Backups, and double-click the backup task to open its properties.
  5. Go to the Logging -> Day log, and search for the line Login incorrect. Password incorrect., then correct the respective name resolution.

What should I do when a client backup fails with a WIN32 API error: "1450 - Not enough system resources to execute the requested service"?

The backup of a client may end with the following error message in the backup log:

sbc-1148: Error:   W2KSS Error: [WIN32 API error: 1450 - Not enough system resources to execute the requested service.
Cannot store registry key: [SOFTWARE]. RegSaveKey() call failed in BackupRegistry().].

This is caused by insufficient size of the registry/paged memory area. This problem affects SEP sesam as well as other backup tools, such as NTBackup. The following Microsoft article explains approaches for different versions of Microsoft Windows: http://support.microsoft.com/kb/304101/en-us

Why does the backup of encrypted data fail on Microsoft Windows 2000 with the message "The network path was not found"?

Microsoft released a hotfix for older Microsoft Windows 2000 versions for the backup of encrypted data (Encrypting File System - EFS). See: http://support.microsoft.com/?scid=kb%3Ben-us%3B843198&x=10&y=8

Beginning with this hotfix, there is support for the Unicode patch convention with the \\?\ prefix.

What does the warning "The system cannot find path. RegLoadKey()..." during System_State backup mean?

You may see the following output in NOT-Log:

C:\Program Files\SEPsesam\var\tmp\usr_wf_S-1-5-21-220523388-1123561945-839522115-1003].

2010-04-13 02:04:20: sbc-2074: Warning: W2KSS Warning: [WIN32 API error: 3 -
The system cannot find path. RegLoadKey() call failed for
file: [C:\Documents and Settings\nn\ntuser.dat] in BackupUserProfiles().].

There are inconsistencies in the OS configuration. The reason is that a user profile has been deleted but the user account still exists. The System_Statebackup is looking for files corresponding to the user in the file system but the files no longer exist. To resolve the problem, delete the user in question or restore the profile date in the file system.

Check the following in your registry to see whether it still includes references to usernames which no longer exist:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList

Why is the Powershell script not executed on a target machine?

By default, Microsoft installs Windows Powershell with the permission set to Restricted. This setting only allows the execution of commands in Powershell but no scripts.

This can be changed with following command in Powershell:

Set-ExecutionPolicy RemoteSigned

For more information, see http://technet.microsoft.com/en-us/library/ee176961.aspx

Why does a Microsoft Windows backup via VSS stop with "[CVssBaseObject::CreateVssBackupComponents] - Access denied?"

SEP sesam is not allowed to create a snapshot with the current user. Check the user running the SEP sesam daemon and make sure that the user has all permissions to access the volume(s).

What does "Stream data length bigger than buffer can accept. Input buffer length = [65536], Stream data size = (High part)[0] (Low part)[65564]" mean?

SEP sesam uses 64 kB to back up Windows ACL files and folders and one object exceeds this buffer. You can use the Windows command icacls to display the ACL of a file or folder. The output looks like this:

 C:\>icacls "C:\Documents and Settings\LocalService\Local Settings\Temp"
 C:\Documents and Settings\LocalService\Local Settings\Temp NT AUTHORITY\LOCAL SERVICE:(I)(F)
                                                          NT AUTHORITY\LOCAL SERVICE:(I)(OI)(CI)(IO)(F)
                                                          NT AUTHORITY\SYSTEM:(I)(F)
                                                          NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
 Successfully processed 1 files; Failed processing 0 files

If you get several hundred or thousand lines, there is something wrong with the ACL. You should reset the permissions of the file's respective folder by using the command:

 C:\>icacls "C:\Documents and Settings\LocalService\Local Settings\Temp" /reset

This command inherits the permissions of the parent object. You may have to adjust the permissions after running this command if manual settings have been applied for this object.


Can users perform their own backup and restore?

Typically, users cannot backup their own computers, but it can be done by installing a SEP sesam Server license on the target client (the user's computer). This way, the user becomes the SEP sesam administrator of the respective client/server and can backup and restore the files on this computer.

Can the Master schedule be changed by a user?

Essentially, no. The most efficient method of handling this is for the user to convey his needs to the system administrator. Upon initial installation, the backup periods are established and entered into the Master GUI. This would be an appropriate time to have input from the users when any special backup and restore commands are required and have them administered centrally. If necessary, a SEP sesam Server license can be added.

The sesam Master GUI can be installed on the client but this would give the client/user all privileges. Another solution that requires greater overheads (more work on the part of the administrator) is to install a GUI with restricted privileges.

How do I get access to SEP sesam Server?

SEP sesam uses the authentication module to grant and restrict access to SEP sesam Server. You can connect to SEP sesam Server only if you are granted appropriate user permissions. Your user rights depend on the specified user type (admin, operator or restore). For details on how to configure authentication, see About Authentication and Authorization.


What encryption types are available with SEP sesam?

SEP sesam provides data encryption types on different levels: backup-task encryption for savesets (set in the backup task), Si3 encryption for Si3 deduplication store, and hardware-based LTO encryption for LTO tape drives (generation 4 and higher), which is done on a media pool level. For every encryption you must create and store an encryption key.

How to encrypt an Si3 deduplication store?

As of SEP sesam v. 4.4.3 Tigon, you can encrypt an Si3 deduplication store by creating the deduplication security password file and specifying it in the relevant drive properties. If the encryption key is not available, the Si3 encrypted data cannot be read. For details, see Encrypting Si3 Deduplication Store.

When encryption is selected before transferring data to the server, does SEP sesam do a compression before it encrypts the data?

Data encrypted by the system and transferred to the server will be compressed if stored to tape using the manufacturer's compression algorithms.

Where is the encryption key stored?

The encryption key is stored in the SEP sesam database. If the encryption key is changed, the subsequent task will be executed with the new key and the new key will be stored in the SEP sesam database.

A restore uses the stored encryption key.

How to set compression?

Compression for backup to virtual tape media

To activate compression for backing up to a Path data store, modify the file sms.ini under /var/opt/sesam/var/ini/ on the RDS. The Compresslevel option under the caption [SMS_Server] can be enabled with


Note that Si3 deduplication store always uses compression for the deduplicated data.

Compression on tape drives

Compression is done by the drive itself. Use the SEP sesam tool slu to check whether compression is activated or deactivated.

Step 1: Display a list of attached SCSI devices

slu topology is a SEP sesam SCSI loader utility that provides information about the loaders and drives connected to the system and their relation. To be able to run the SEP sesam commands globally, you must first set up a profile as described in FAQ: What happens when I set a profile?
Then run slu topology to list all attached SCSI devices.

 <SESAM_BIN>/sesam/slu topology

For details on the output, see Using slu topology for detecting devices.

Step 2: Check the tape drive settings

 [root@sinus sesam]# ./slu 0020 -s
 Tape Info
 Read Attribute not supported
 internal_status_byte= 0x0
 buffered_mode= 1
 block_length= 0 (variable)
 media_type= unknown (0)
 write_protect= 0
 density_code= 44
 compression= 1

If compression is set to 1, drive compression is active. Setting the compression can also be done with slu or alternatively with the Linux tool mt.

Step 3: Activate compression

 [root@sinus sesam]# slu 0020 -c 1
 DCE= 1
 compression= 1

On Windows systems, check if the compression is enabled in the Device Options. When performing a check, make sure that the tape is in the drive.



Is it possible to restore only single files if the SEP sesam listing file is no longer available ?

Yes. In order to do this, enter the file patterns into the restore wizard. First, the desired save set is selected in the registry tasks and the optionComplete restore is selected. Click the Expert options button to open the Expert options window. Click the Filter tab and enter the file patterns. Separate each entered pattern with a space. Only files which fit into specified pattern will be restored. All others are ignored.


 /*.xls          -> restores all files with the ending ".xls"
 /*/X11/XF86*    -> restores all files from the directory "/X11" which start with
 /*.ini /*.conf  -> restores all files which end on ".ini" or ".conf"

Note: is is essential to use '/' when writing the pattern.

How do I use the selective restore commands?

  1. Create a new directory root in the <SESAM_ROOT>\var\work directory.
  2. You will need the .sgm and .lis files from the backup.
  3. Execute "Sesamprofile".

In the root directory, create a text file with the name "selected.txt" and extract the desired lines from the .lis file, for example:

     "C :/WINDOWS/system32/config/AppEvent.Evt" f 8.10.2004 13:26:54 8.8.2005 15:56:07 1 4096 540672

In the command line of the SEP sesam Server, enter:

sm_restore -s SC20050809155617 -R c:/temp -v 1 -l s -c client -d 1 -V


 -j Original task name of the backup job
 -s The save set name of the backup job must be entered. You can find this in the .sel file from the restore job.
 -r Restore target (note the slash "/"!)
 -l The "s" is used for selective restore
 -S The hostname of the SEP sesam servers
 -v 1 increase the log levels
 -V Suppress output to the background
 -c Hostname of the client to be restored
 -d Disk drive entry of the drive where the SEP sesam media is kept, for example, "1"

How do I restore all the data from tape media without the SEP sesam DB?

To restore data without a current license from SEP sesam, follow the restore procedure described below (SESAM DB restore):

Change to the <SESAM_ROOT>/bin/sesam directory and run the program sm_recover. In the first response, all known devices currently active on the system will be displayed. You can choose one of these drives.

azurix:~ # sm_recover
num device          name            typ
 1  disk1           Drive-1         DISK_HARD
 2  /dev/nst0       Drive-2         DLT
Enter drive number, (r) to repeat list, (q) to quit:

By entering "2", sm_recover will look for the desired data on the physical tape drive. The following question should be answered with yes ("y") if no other backups or restores are active:

Analyse media: restore data or listings of savesets

Restoring data while SEP sesam is active may cause conflicts due to concurrently running tasks on the drive. If you're sure that there are no activities scheduled during recovery, you do not need to block SEP sesam. Blocking SEP sesam during recovery prevents the execution of backup activities scheduled for the other devices.

Do you want to block SEP sesam ? (y|n] >

Confirm by typing "y"

wait until SEPuler - the timecontrol of SEP sesam - finishes its current work ...
SEPuler is blocked ...

The following question should be answered with no ("n") unless you wish the data search to continue with a desired filter.

Do you wish to enter label, saveset-name and segment-number directly ( no searching on media ) (y/n) > n

You will then be notified that the tape is rewinding.

The tape will now rewind and scanned to the end EOT...

In the next step, you may choose the desired save sets. By entering the save set number, you can insert further instructions to restore the data. After finishing, restart all SEP sesam services.

How do I restore all the data from a disk/data store media without the SEP sesam DB?

Microsoft Windows:

sbc.exe -r -S $SERVER_HOSTAME -s @SF.....data -v 1 -R c:\target\


sbc -r -S $SERVER_HOSTAME -s @SF.....data -v 1 -R /target/

How can I restore a backup that has errors? The backup log file reported that the backup was partially successful.

If a backup has failed but some or most of the data was backed up, you can update the SEP sesam database manually to show the backup in the restore wizard. First, the save set ID is required. This can be found in the GUI under Backups -> State -> failed backup -> Properties -> save set. Proceed as follows:

  1. Source the sesam profile from $SESAM_ROOT/var/ini/sesam2000.ini.
  2. Modify the entry in the DB. The save set must be changed below.
  3. In the command line use the following commands:
sm_db "update results set state= '1',blocks= 1 where saveset= 'SC20060101121314'"

After this change, the save set for this backup should be shown in green on the status display and appear in the recovery wizard. Nevertheless, you should still verify whether the data was backed up successfully.

Why don't the data lists appear in the restore wizard?

If the data lists don't appear in the restore wizard, verify whether the CTRLD switch permission is set to <on>, and if not, activate it.

How do I avoid the problem "553 RETR Failed. Data Synchronization lost - Restore terminating"?

Linux/UNIX data is stored in CPIO save set which is checked during the restore to ensure that the CPIO format is correct. If a format error is detected, the restore is aborted and ends with

'BSA Call BSAEndData (closing saveset) failed: System detected error, operation aborted.
TRANSIENT or PERMANENT NEGATIVE reply: 553 RETR Failed. Data Synchronization lost - Restore terminating'

The following settings allow you to avoid a premature termination of the restore.

Avoid the current restore task
Enter the sbc option '-F none' to the restore command in the last tab of the restore wizard -> Expert options -> Restore options.
Avoid all further CPIO restores on the RDS
Set the SEP sesam GLBV restore_no_abort at the RDS with 'sm_glbv w restore_no_abort yes'. If the suspicious (non-CPIO) bytes lead to further problems, they can be skipped with 'sm_glbv w restore_no_junk yes'.

How can I restore Active Directory subtrees in a clustered environment?

  1. Boot into Directory Services Restore Mode. This ensures that the directory is offline. In order to do this during the normal boot menu while restarting the computer, press F8 when the message "For troubleshooting and advanced startup options for Microsoft Windows 2000, press F8" appears at the bottom of the screen. After pressing F8, select Directory Services Restore Mode from the Safe Mode and Other Startup Options list.
  2. Restore the System_State backup by using the SEP sesam GUI.
  3. To authoritatively restore Active Directory data, you need to run the ntdsutil utility. See the following example (subtree organizational unit Marketing in the domain Anitpodes.com):
    #> ntdsutil
       ntdsutil: authoritative restore
     authoritative restore: restore subtree OU= Marketing,DC= Antipodes,DC= COM

Refer to the Microsoft publication Windows 2000 Server Disaster Recovery Guidelines - Active Directory and Disaster Recovery: Active Directory Users and Groups section "Performing an Authoritative Restore".

Can I use path reduction of a TSA backed up volume/directory when restoring data ?

Path relocation has been available as of Sesam Novell Client version 4.2.1-37.

With older versions of the Sesam Novell client, this functionality is not available when using a TSA backup or restore operation. You must always select no relocation in Expert options of the restore wizard (this is the default value).

Thus, the complete directory structure is re-created to the target directory using the directory from the selected backup. Using the command Restore to original target path, the directory is restored to the original storage space with all of the files.

Restore relocation 4.4.3.png

Is it possible to restore flat files/directories from multiple locations when restoring a TSA backed up file?

This functionality is not possible with TSA backups/restores. You should select Original tree structure in the restore wizard, regardless of whether Restore to original target path or a New restore target is desired.

Novell restore path 4.4.3.png


Use a NAS/CIFS (QNAP, Synology ...) storage as backup target

The below prerequisites must be met to use a NAS or a CIFS share as a backup storage. Depending on whether your SEP sesam Server or SEP sesam Remote Device Server (RDS) is Windows or Linux based, proceed as follows:

  • To avoid double network traffic, connect the storage via an additional network card to the SEP sesam Server or RDS.
  • If your SEP sesam Server or RDS is a Windows system, create a valid user in your AD/LDAP with administrative rights. Then add this new user to your storage (NAS/CIFS) with full access to the storage part for SEP sesam. Adjust the SEP sesam system service and specify it to run under your newly created user account. Restart the service. Now you can create a data store with a path, such as \\192.168.x.x\sepsesam.
  • If your SEP sesam Server or RDS is a Linux system, create a permanent mount point to the server and use this mount point as a backup target for your data store.

How do I set up automatic archive adjustment?

  1. Go to Scheduling -> Schedules and create a new schedule. For details, see Creating a schedule.
  2. Link the event to the schedule. For details, see Creating an event. Then enter the following:
Priority:      Standard set to 1.
Name:          Enter a description that is easily recognizable.
Command:       Example for tape loader 1, drive 2 and 10 slots: sm_robot -l 1 -d 2 -s 0-9
Client:        Choose the desired SEP sesam Server name
User:          For a Unix System enter: root. For Microsoft Windows: system.

Note: No explicit permissions are required for the simple activation of SEP sesam commands.

Does SEP sesam support removable or USB media for backup?

There is limited support for removable disk media, including USB drives.

How can I determine whether a tape is a SEP sesam tape or not?

Place the tape into a drive, select the drive in the GUI under Components -> Drives and execute the Identify label drive action. If the label is found, it will be diplayed under the drive in the Current messages display.

Alternatively, go to the command line, change to the directory <SESAM_ROOT>/bin/sms and execute the following:


 ./sm_sms_interface getlabel -d /dev/nst0

Microsoft Windows

 sm_sms_interface getlabel -d Tape0

The necessary device (switch -d) can be found in GUI under Components -> Drives.

How can I manually write a label on a tape (e.g. to overwrite an existing label without performing a check of the SEP sesam database)?

Go to the command line, change to the <SESAM_ROOT>/bin/sms directory and execute the following:


./sm_sms_interface init -d /dev/(z.B. nst0) -t testpool00001:1

Microsoft Windows

sm_sms_interface init -d Tape0 -t testpool00001:1

Note: The tape will be overwritten without warning!

The media label consists of three parts:

  1. Name of the pool (in the above example, the name is "testpool").
  2. The tape ID, a 5-digit number.
  3. A number after the colon (':') that complies with the preceding number.

How do I automatically remove a tape after a backup is finished?

The best way of removing a tape after the backup is by using the sm_notify interface. You can find a complete description of this command interface with examples of how to unload tapes following backups in the SEP sesam Administration Manual.

The standard unload command is:

sm_drive dismount 2 unload

This command refers to the selected drive, in this case drive 2.

Where do I install the cleaning tape?

Currently, a cleaning tape is not explicitly identified. When selecting an Archive adjustment, the cleaning tape will automatically be loaded in sequence and an unwanted cleaning operation may be initiated. To prevent an unwanted cleaning operation from initiating, select the last (highest numbered) slot for the cleaning tape and reduce the number of slots by one (1).

Cleaning may take place by manually entering the cleaning tape or by following the manufacturer's instructions.

Why does SEP sesam lock tapes that were not involved in a backup?

This is related to FULL->DIFF or FULL->INC->INC->INC-> ... backups.

The following example explains this problem:

  • full backup -> requires three tapes (backup00001, backup00002, backup00003)
  • inc backup -> requires one tape (backup00004)
  • inc backup -> requires one tape (backup00005)
  • inc backup -> requires one tape (backup00006)

The first backup merely changes the EOL (end of lifetime) for the three tapes (backup00001 to backup00003), the second backup changes the EOL for the first four tapes (backup00001 to backup00004) and the third backup changes the EOL for the first five tapes (backup00001 to backup00005), and so on.

If the next full backup fails, the succeeding incremental backup will use the chain from the last successful backup(s) and so the chain expands. This is necessary for a generation restore because an incremental backup includes only the changes from the last backup, regardless of whether it was a full, differential or incremental backup. All tapes are needed to perform a successful restore.

With a differential rather than an incremental backup, SEP sesam locks the tapes from full backup and the tapes that were used by the differential backup.

How do I get information on the oldest tape in a pool before backup starts?

It is sometimes very useful to know which the next free medium in a pool will be before a backup starts. To get this information, type the folowing command:

sm_arch_getoldest 1 full-disk

The command shows the next free medium of pool full-disk in drive 1.

How do I check the consistency of a data store?

The following command allows you to check the consistency of a data store:

sm_data_store check_db -L {datastore} | -d {drive_num}

Example 1: The example shows a data store check that detects 2 save sets with the wrong data file size (sizes smaller than stored in the SEP sesam database). The state of both backup operations is either a fail ('X') or broken data transfer ('3') and the result status is therefore 'SUCCESS'.

#>sm_data_store check_db -L DATA_STORE2
2014-08-28 14:39:59: $Id: sm_data_store.py,v 1.105 2013/08/18 18:06:36 sesam Exp $
2014-08-28 14:39:59: Arguments: sm_data_store check_db -L DATA_STORE2
2014-08-28 14:39:59: $Id: sm_data_store.py,v 1.105 2013/08/18 18:06:36 sesam Exp $  Sesam Id: None
2014-08-28 14:39:59: Arguments: sm_data_store check_db -L DATA_STORE2
2014-08-28 14:39:59: DB:               select * from data_stores where name= 'DATA_STORE2'
2014-08-28 14:39:59: DB:               select * from hw_drives where data_store= 'DATA_STORE2' order by drive_num
2014-08-28 14:39:59: DB:               select results.saveset,fdi_type,state,task,sesam_date,cnt,media_pool,results.uuid,data_size from results,result_lbls where
 results.saveset= result_lbls.saveset and results.saveset in (select saveset from result_lbls where label in (select label from media where location= 'DATA_STORE2'))
 and results.data_size>0 and results.state not in ('a','q') order by start_time
2014-08-28 14:39:59: DB:               select results.saveset,fdi_type,state,task,sesam_date,cnt,media_pool,results.uuid,data_size from results,result_lbls where
 results.saveset= result_lbls.saveset and results.saveset in (select saveset from result_lbls where label in (select label from media where location= 'DATA_STORE2'))
 and results.data_size= 0 and results.state not in ('a','q') order by start_time
2014-08-28 14:39:59: DB:               select label,pool from media where location= 'DATA_STORE2'
2014-08-28 14:39:59: Looking for savesets: sm_client dir "G:/DATA_STORE2/DATA_STORE2/DataStore1/DataStore100002"
2014-08-28 14:40:00: Looking for savesets: sm_client dir "G:/DATA_STORE2/DATA_STORE2/I_DS_POOL/I_DS_POOL00001"
2014-08-28 14:40:00: ==================================================================================
2014-08-28 14:40:00: Savesets in Sesam DB:          187.
2014-08-28 14:40:00: Saveset files found:           187.
2014-08-28 14:40:00: Saveset in DB and on FS:       187.
2014-08-28 14:40:00: Savesets not found on disk:      0.
2014-08-28 14:40:00: Saveset files not in DB:         0.
2014-08-28 14:40:00: -------------- List of savesets with wrong data file size ------------------------
2014-08-28 14:40:00: 3  SF20140826212205682@gp_o1hNIc8g  miraculix_dev 2014-08-26 00:00:00 4430717952 > 4430686656
2014-08-28 14:40:00: X  SC20140825083202946@iW9ZD7vcSw2  SESAM_BACKUP 2014-08-21 00:00:00 1323736064 > 1323385536
2014-08-28 14:40:00: -------------------- List of savesets without data file --------------------------
2014-08-28 14:40:00: -------------------- List of files without DB entry ------------------------------
2014-08-28 14:40:00: -------------------- List of files without data file -----------------------------

Example 2: A data store check that detects a save set with the wrong data file size and with a successful backup state ('0'). The result status shows 'ERROR'.

G:\DATA_STORE2\DATA_STORE2\DataStore1\DataStore100002>sm_data_store check_db   -L DATA_STORE2
2014-08-28 15:03:05: $Id: sm_data_store.py,v 1.105 2013/08/18 18:06:36 sesam Exp $
2014-08-28 15:03:05: Arguments: sm_data_store check_db -L DATA_STORE2
2014-08-28 15:03:06: Looking for savesets: sm_client dir "G:/DATA_STORE2/DATA_STORE2/DataStore1/DataStore100002"
2014-08-28 15:03:06: Looking for savesets: sm_client dir "G:/DATA_STORE2/DATA_STORE2/I_DS_POOL/I_DS_POOL00001"
2014-08-28 15:03:06: ==================================================================================
2014-08-28 15:03:06: Savesets in Sesam DB:          188.
2014-08-28 15:03:06: Saveset files found:           188.
2014-08-28 15:03:06: Saveset in DB and on FS:       188.
2014-08-28 15:03:06: Savesets not found on disk:      0.
2014-08-28 15:03:06: Saveset files not in DB:         0.
2014-08-28 15:03:06: -------------- List of savesets with wrong data file size ------------------------
2014-08-28 15:03:06: 0! SI20140826150006895@ch-Gdm3Id_6  miraculix_dev 2014-08-26 00:00:00 106962944 > 1274932
2014-08-28 15:03:06: -------------------- List of savesets without data file --------------------------
2014-08-28 15:03:06: -------------------- List of files without DB entry ------------------------------
2014-08-28 15:03:06: -------------------- List of files without data file -----------------------------
2014-08-28 15:03:06: ERROR: File size does not match:        1.
STATUS= ERROR MSG= ERROR: File size does not match: 1.

In this case, the save set is corrupted. You have to determine the reason for the corrupted save set (disk IO problem, file system with limited file size, etc.). To avoid the corrupted save set from being used, its result state must be changed to broken data transfer ('3').

sm_db "update results set state= '3', msg= 'corrupt saveset (size)' where saveset= 'SI20140826150006895@ch-Gdm3Id_6'"

If the data is still available on the backup source, the backup operation must be restarted.

Why can't I find my Exabyte single tape drive in the list of devices when I try to initialize it?

First, inspect the media pool to which you tried to enter the tape drive. If there is no number (0,1,2, etc.) behind Tape, the drive was not detected by SEP sesam. You can also check this by entering slu topology in the command line prompt.

If the device is not listed, the driver is not installed correctly. Look for the appropriate driver at the manufacturer's site or elsewhere on the internet, download it to your computer and run the program to install the driver. The media pool should now show the Tape (0). Finally, initialize the tapes. For details, see Media Strategy.

Why do I get the error message skipping blocks when I try to perform a SEP sesam backup with an Exabyte VXA172?

Some manufacturers often require a different driver for each tape model they manufacture. In this case, the VXA tape you initialized is not recognized by SEP sesam in the Exabyte tape drive. Go to the tape type selection in the GUI and change [VXA] to [EXA]. This will fix the problem.

Why does SEP sesam not write to my LTO drive on my x86 system?

The OS enables PAE (Physical Address Extension) automatically on x86 systems if more than 3.25 GB RAM are in use. With PAE, the OS cannot write more than 32 KB to a tape drive whereas SEP sesam needs 64 KB for LTO. The most efficient solution is to switch to an x64 OS. Decreasing the RAM to a maximum of 3.25 GB should also solve the problem.


What does the notification "Disk space for listings and logging below critical threshold" mean?

In the NEWDAY task, SEP sesam Server checks the free disk space on the partition where the log files and listings are stored.


If free space falls below the critical threshold value, the server sends an email notification.

The threshold value (default = 5000, 5000 MB) can be configured in sm.ini under the [Params] section <SESAM_ROOT>\var\ini\sm.ini.

gv_min_free= 5000

If there is no more disk space available on the partition, the server cannot write additional logs and listings. This can result in critical errors and lead to data loss. This error should be addressed at the earliest possible opportunity.

How do I set a higher logging level?

You can increase the logging level for specific backup or restore task in the GUI: Main selection -> Tasks -> By Clients -> double-click the backup or restore task to open the Properties. You can also set the logging level globally for SEP sesam kernel modules, as described in Setting log level globally for SEP sesam kernel modules in debug.ini. Note that running SEP sesam with a higher logging level than default (0 for backup and restore) increases the amount of information being logged and may negatively affect the performance of SEP sesam. For details, see Setting Log Level.

Is it possible to generate audit logs?

As of SEP sesam v. 4.4.3 Beefalo, it is possible to use the sm_gui_server_requests.log as a source for audit logs by generating a more readable version of the log file with evidence of each action that was triggered by a user. Audit trail records may contain the following details:

  • date and time
  • API request for the executed action
  • user associated with the activity
  • user IP address

The below example shows that the restore task was deleted by the user Administrator.

2021-02-03 10:55:08,592 - [GET] /sep/api/restoreTasks/rs_task01/forceRemove [User: Administrator, IP:]

For detailed procedure, see Audit Logging.

Why do the request status or daily protocol (log files) return "Host SEP sesam is not allowed to connect or security problem for user"?

Typically, there is an issue with client's access privileges. The error message reads:

scd-1136: Error: Host [{SEPsesam}] is not allowed to connect or security problem for user: [{user}].

There is a problem with the RMI GUI Server on the SEP sesam Server. The system requires CTRL or SMSSH privileges to complete the SEP sesam commands. On the backup client add permission for the SEP sesam server so the server is allowed to connect to the client.

Execute the following command at the client:

 sm_setup set_client <SEP sesam server hostname>

For example, if the SEP sesam Server hostname is backup01:

  • On Microsoft Windows, in the directory C:\Program Files\SEPsesam\bin\sesam, call:
 sm_setup set_client backup01
  • On Linux, call:
 /opt/sesam/bin/sesam/sm_setup set_client backup01


How can I access SEP sesam dashboard?

SEP sesam dashboard (Web UI) is an online monitoring tool that allows you to check if all your backups and restores have been completed successfully. You can access it online at the following address: http://[servername]:11401/sep/ui or https://[servername]:11401/sep/ui. For example, on the SEP sesam Server the following 'localhost' link will open the SEP sesam dashboard: http://localhost:11401/sep/ui. The dashboard (Web UI) is also available in the GUI. For details, see SEP sesam Web UI.

Can special reports be generated for backups, backup time, performed restores, etc.?

Yes. Special scripts can be written and inserted for the execution of both pre- and post-operations using the commands execute_pre or execute_post. For details, see Using Pre and Post Scripts.

Due to stringent EU requirements for reporting, data security and data restore, many required reports may already be included without additional administrator intervention.

I would like to generate both summary and detailed reports for backups. Does SEP sesam provide this extra granularity?

SEP sesam provides both a summary of and detailed information on every backup executed. In addition, the system can send a summary report over the SEP sesam notify interface to an email account after finishing the last backup. SEP sesam summarizes the backup information on a daily basis. The time schedule and sequence can be selected by the user or system manager and may be set to any 24-hour period. For example, if you specify a backup time of Monday 11 p.m. to 8 a.m. on Tuesday, all backups performed within this window will be recorded as Monday.

How can I send a SEP sesam daily protocol to an email account?

We recommend that you configure support accounts and use sm_notify templates from




Copy the templates to:


and modify them as necessary, especially in the line:

sm_smtp -A sesam -M gv_dayfile: -a gv_prot: -s "Sesam backup status: "+%1+" "+%2+

"A" {account} must be changed to the email account that was configured with the GUI.

After the execution of the last backup or command event, the sm_notify interface is called with the module "ALL_JOBS_DONE" and the SEP sesam daily protocol will be sent to the specified email account.