Proxmox Backup to NAS: NFS vs SMB Setup and Restore Checklist

Preparation date: September 17, 2026. Scope: This is a documentation-based implementation and verification guide, not a claim about a completed customer incident. It covers ordinary Proxmox VE VZDump backups written to NAS storage. A Proxmox Backup Server datastore is a different architecture and is called out separately. The short answer is: choose NFS when Proxmox is the main consumer and your NAS can restrict the export to the Proxmox node addresses. Choose SMB/CIFS when the same share must also fit a Windows-oriented operating model or your NAS administration is already built around named users and SMB permissions. The protocol choice matters, but the restore test matters more. A green backup task proves that an archive was written; it does not prove that you can recover a VM on replacement storage. Proxmox backup to NAS verification flow A Proxmox node writes a VZDump backup over NFS or SMB to a NAS, then a separate restore test validates recovery. ...
Post a Comment

UAG Unrecognized Request: Classify the Traffic Before Changing Health Checks

Documentation-based triage guide. Revised September 12, 2026. No exact build or event record is available to establish the meaning of the original warning. Unsupported health-check URLs and the claim that an unknown source is automatically harmless have been removed.

An “unrecognized request” message needs context: exact wording, emitting component, build, timestamp, and affected request. The text alone does not prove a broken gateway, a successful security block, or a harmless health probe.

Preserve the warning and classify its source

Collect the original log entry with adjacent events and timezone. Identify the listener and request path, where available. Correlate with load-balancer and client records. The visible source may be a proxy or NAT address, so an unfamiliar IP is not enough to distinguish an attacker from a legitimate user.

  • A monitor is suspected: compare the event cadence, selected member, and request with the configured monitor. Coincident timing supports further testing, not an immediate conclusion.
  • A user transaction is suspected: reproduce one approved login and launch with timestamps. Determine whether the warning coincides with an actual failure.
  • Unsolicited traffic is suspected: retain the source and request evidence for the security owner. The absence of help-desk reports does not establish that the traffic is benign.

Do not copy a generic health-check path

Check the supported monitor guidance for the installed UAG release, service, and load balancer. A path returning HTTP 200 can still test the wrong component. Do not expose an administration endpoint to the public network or substitute a favicon response for application readiness without documented justification.

Before changing a monitor, record its protocol, port, path, expected response, interval, thresholds, and pool action. Have the owner test one pilot member and confirm both healthy and failed-member behavior. A monitor that stops generating warnings but routes users to an unusable node has failed the acceptance test.

Separate monitoring from mitigation

If the warning has no demonstrated user impact, continue collecting representative events rather than rebuilding UAG or suppressing all alerts. If it aligns with failed logins, preserve the failing request and compare a working path. Any routing test must retain hostname and certificate validation and respect live-session capacity.

Record the decision as confirmed monitor mismatch, confirmed user-path issue, security investigation, or unresolved warning. Define the next evidence needed. Roll back a monitor change if member health or user access worsens. Region-wide blocking can exclude legitimate users; it requires a separately reviewed security decision, not a generic troubleshooting step.

References and limits

The following documents describe architecture and connection tracing; they do not identify a root cause for an unprovided log message. Use the exact release's documentation or vendor support for that interpretation.

Related troubleshooting guides

Comments

Post a Comment

Popular posts from this blog

Horizon vdpConnect_Failure: Connection-Stage Triage Before Reinstalling

vdpConnect_Failure is a starting symptom, not a root-cause diagnosis. Before reinstalling Horizon Agent or opening firewall ports, establish whether the failure occurs during authentication, desktop launch, or an established session. This documentation-based triage guide does not report a reproduced incident or a universal fix. Corrected September 12, 2026: The earlier guide suggested restarting the Windows RPC service and treated a local netstat listing as a test for blocked ports. Those instructions have been removed. A socket listing does not demonstrate end-to-end reachability. Classify the failure before making changes Observation First evidence to collect Avoid assuming Authentication never completes Exact login error, identity provider or broker event, timestamp That the display protocol is the failing component. Desktop selection succeeds, launch fails Assigned desktop, chosen protocol, Client/Agent and gateway logs That a successful HTTPS login proves the session path ...
Read more

Horizon Agent Unreachable: Registration and Desktop-Health Triage

Start an “Agent Unreachable” investigation by separating desktop health, Agent registration, and session traffic. Do not begin with a pool rebuild. This documentation-based triage guide helps decide which team should act and what evidence to preserve. Correction, September 12, 2026: The earlier guide mixed display ports with Agent communication, tested Blast against the Connection Server, and offered generic service restarts and image rebuilds. Those instructions have been replaced with path-specific investigation. First-response decision table Check Evidence Investigation owner Is the guest responsive? Approved console access, OS health, resource and disk observations Desktop/virtualization team if the OS is unavailable. Is this one desktop or a whole image family? Affected pool, image revision, Agent version, start time Image owner if failures align with a deployment. Does registration fail? Agent and Connection Server events for the same desktop and time Horizon team, then netw...
Read more

Horizon Protocol Error: Trace the Display-Session Handoff

A desktop can authenticate successfully and still fail to establish its display session. This guide investigates that handoff. Use it after identifying the actual console/client error, not as a claim that every “Protocol Error” means a firewall failure. Correction, September 12, 2026: The previous version combined a general checklist with an unverified incident narrative, conflated gateway and desktop port directions, and recommended blanket endpoint-security exclusions. Those instructions have been removed. This is a documentation-based diagnostic plan. Draw the attempted connection Record the selected protocol, assigned desktop, Client and Agent versions, gateway route, and attempt time. Distinguish a direct internal connection from an external UAG connection or a Connection Server tunnel. Use Omnissa's connection guide to identify where the failed handoff occurs. Stage Question Useful comparison Authentication Did the user receive desktop entitlement? Failed login versus ...
Read more