My migration failed, finished partial or cannot be finalized
Read the run's Report. A partial migration can be re-synced and finalized; a failed one cannot. Common causes are the target's port 8087 being unreachable, no recent backup of the account, a licence refusal, a database not named after the account, and a web server the cutover proxy does not support.
Statuses
A migration ends completed, partial or failed. A failed one sends a migration_failed alert. A partial run can be re-synced and finalized; a failed one cannot. BackupWall never deletes an account it created, so a failed run leaves the new account on the target for you to clean up.
Common causes
| Symptom | What to check |
|---|---|
| Cannot register the peer, or the push cannot connect | The target's port 8087 must be reachable from the source, in the server and cloud firewalls. If you use CSF, add 8087 to TCP_IN. Check the TLS fingerprint on the target matches what the source pinned. |
| Peer shows "Insecure" | A link made before TLS existed. Pin it again in Settings → Peering. |
| A rebuilt target stopped working with the source | A rebuilt server has a new certificate and fingerprint; pin the new one. |
| "Did not complete within 30 minutes" / the sync fails to start | A re-sync and the final sync take a fresh backup first. The migration gives up only if that backup has not started 30 minutes after it was requested (time behind another running backup does not count) or it stops making progress. Try again. |
| Old data on the target | The first run uses the newest completed backup and does not take a new one. Run Re-sync. |
| Run ends partial: databases "not migrated" | Databases are imported only if named <source account>_*. Others are reported; typical for free-named Plesk databases. |
| Seed transfer refuses | Seed refuses encrypted backups and local destinations. Use Direct push. |
| Both servers must be licensed | Once enforcement is on, an Unlicensed source refuses to start or continue, and an Unlicensed target refuses the transfer. See What happens if your licence lapses. |
| Different releases on the two servers | Both must run the same release; nothing checks it. Upgrade the older one. |
| FTP logins lost their passwords | Only crypt-hash passwords cross panels; others get a new password listed in the Report. |
| DNS not changed | Records are edited only where the source is authoritative; otherwise BackupWall tells you which to change. DirectAdmin can take about a minute. |
| Cutover proxy refused | The web proxy works only on some web servers: DirectAdmin needs Apache; cPanel needs Apache with rewrite, proxy and proxy_http; Plesk was tested on nginx. DNS is still repointed. Switch the proxy off and repoint DNS only. |
| Mail went to the old server | Mail arriving during DNS propagation is not handled. Run Re-sync after DNS has moved, before you remove the source account. |
| Interrupted by an upgrade | A migration that was running is marked failed. Start it again. |
Get the details
Open the migration and read its Report. Run tail -n 200 /var/log/backupwall/worker.log on both servers. If you cannot work it out, make a support bundle on both ends. See Report a problem and make a support bundle.