“Failed to create backup directory” does not prove that a vCenter backup account lacks write permission. The adjacent CompleteFTP case presents as a directory-reading failure, not that same creation error. In documented SFTP failures, the directory error wraps an earlier SSH-session problem or a destination-specific response to a missing path. Read the first meaningful failure in the same backup attempt before changing the repository. A26-S1, A26-S2
This article covers vCenter Server 8.x appliance file-based backup diagnosis. The CompleteFTP example is bounded to the documented 8.0.x case. No backup, SFTP connection, script patch or service operation was executed.
Why the final error can mislead
A VAMI backup involves more than saving a destination string. The appliance must establish the required connection, resolve the remote directory and create the backup destination before transferring the intended data. Successful configuration submission does not prove that every later operation works.
Broadcom KB 405687 describes a workflow that attempts SSH tunnel setup and can then fall back to curl. Multiple earlier connection requests can encounter server or network restrictions. A later connection failure can surface as a target-directory creation error. A26-S2
This is a VMware implementation sequence, not a general statement that every SFTP server needs relaxed connection limits. The correct remedy depends on the actual build and matching failure evidence.
Inspect one attempt from start to finish
Prerequisites are the exact vCenter build, backup destination product/version, an existing failed task identifier or time, and the associated /var/log/vmware/applmgmt/backup.log interval. Use existing authorised logs. Do not start another backup to generate an example.
Keep the records for one attempt together. A cleanup error from one job and an authentication error from another can form a convincing but false story when timestamps are omitted.
Read backwards from the final failure to the first meaningful connection or path error, then reconstruct the sequence forwards. Record the operation stage: session establishment, remote-root discovery, target-directory creation, data transfer or cleanup.
Logs may include usernames, internal destinations and command arguments. Retain only the necessary redacted evidence in a shared report. Do not copy a logged credential-bearing command into a shell to replay it.
Two worked interpretations
In the first synthetic record, the log contains:
Failure establishing ssh session: -43, Failed getting banner
Failed to create backup directory on backup server
This matches the connection-failure class described in KB 405687. The directory operation could not proceed, but the evidence does not establish an ordinary filesystem write denial. Changing directory ownership would not address the demonstrated failure boundary. A26-S2
In the second record, CompleteFTP server-side SFTPSubsystemServer / SSH_FXP_STATUS logs return code=10 invalid path or code=3 permission denied for a non-existent path. The vCenter backup.log sequence includes a BrokenPipeError and sftp quote cmd failed. Err: curl: (9) Could not open directory for reading: Permission denied. KB 444248 documents this distinct directory-read failure. Correlate both sides by attempt and time; “permission” alone does not establish an ordinary ACL error. A26-S1
Neither example authorises dismissing genuine permission failures. If existing destination logs show a concrete denied create operation for the same account, path and time, retain that evidence and investigate it with the repository owner. The objective is to locate the failed operation, not choose a favourite explanation.
Use the build boundary before choosing a remedy
KB 405687 explicitly states that its attached-script workaround is no longer compatible with vCenter 8.0 U3k or higher and points to KB 366953. That replacement procedure has not been reviewed for this article and is not adopted here. This is a material exclusion, not a minor wording difference. Do not apply a historical replacement script merely because its error text resembles the current incident.
The CompleteFTP article also contains appliance patch and service-restart instructions. Those changes are outside this diagnostic and require a qualified, version-matched support plan. Reading the KB does not establish that its attachment is suitable for another SFTP server or patch level.
Keep server restrictions in the evidence as well. KB 444248 names concurrent SSH-session limits and consecutive-login-failure lockout as checks for the repository owner. Removing login protections or increasing session allowances without matching logs changes the repository's security behaviour while the original cause may remain unresolved.
Acceptance, cleanup and reversal limits
A satisfactory diagnostic identifies the first supported failure, the task interval, vCenter build and destination product. It states whether the evidence supports session establishment, path-status handling or a concrete permission denial. An unknown first failure stays unknown.
After a separately approved correction, acceptance would require a completed backup with the intended scope and destination, followed by the organisation's independent recovery validation. Saving the backup configuration or opening one SFTP session is not equivalent to either result. No acceptance test was performed here.
A failed job can leave cleanup warnings or partial files. Do not delete those files simply because the job failed; preserve the incident record and let the backup owner assess the exact partial set.
Inspection needs no rollback. Appliance patches, repository policy changes and transfer-mode modifications each require their own recorded previous state and supported reversal plan.
Learning notes
- The last error often describes the failed workflow stage, not its cause.
- Destination product and exact vCenter build change the applicable explanation.
- A successful backup and a proven restore remain separate outcomes.
References
- A26-S1: vCenter server's file level backup fails with 'ERROR: sftp quote cmd failed. Err: curl: (9) Could not open directory for reading: Permission denied' when using 'completeFTP' as backup solution.
- A26-S2: Error: "Failed to create backup directory on backup server" when performing a vCenter scheduled or manual backups