Search <book_title>...

Veritas NetBackup™ Security and Encryption Guide

Last Published: 2017-09-25

Product(s): NetBackup (8.1)

About NetBackup auditing

An audit trail is a record of user-initiated actions in a NetBackup environment. Essentially, auditing gathers the information to help answer who changed what and when they changed it. Auditing NetBackup operations can help provide information in the following areas:

General tracking	Customers can gain insight from audit trails while they investigate unexpected changes in a NetBackup environment. For example, it might be found that the addition of a client or a backup path has caused a significant increase in backup times. The audit report can indicate that an adjustment to a schedule or to a storage unit configuration might be necessary to accommodate the policy change.
Regulatory compliance	Auditing creates a record of who changed what and when it was changed. The record complies with guidelines such as those required by the Sarbanes-Oxley Act (SOX).
Corporate change management	For customers who must adhere to internal change management policies, NetBackup auditing offers a method to adhere to such policies.
Troubleshooting	The information from NetBackup auditing helps NetBackup Support to troubleshoot problems for customers.

About the NetBackup Audit Manager

The NetBackup Audit Manager (nbaudit) runs on the master server and audit records are maintained in the Enterprise Media Manager (EMM) database. By default, auditing is enabled.

The Audit Manager provides the mechanism to query and report on auditing information. For example, an administrator can search specifically for information based on the following:

When an action occurred
The actions that a specific user performed
The actions that were performed in a specific content area
Changes to the audit configuration

Actions that NetBackup audits

You can view the actions NetBackup audits with the nbauditreport command or in NetBackup OpsCenter.

See Viewing the audit report.

When auditing is enabled, NetBackup records the following user-initiated actions.

Policies actions	Adding, deleting, or updating policy attributes, clients, schedules, and backup selections lists.
Activity monitor actions	Canceling, suspending, resuming, restarting, or deleting any type of job creates an audit record.
Storage units actions	Adding, deleting, or updating storage units. Note: Actions that are related to Storage Lifecycle Policies are not audited.
Storage servers actions	Adding, deleting, or updating storage servers.
Disk pools and Volume pools actions	Adding, deleting, or updating disk or volume pools.
(Conditional) Host properties actions	Updates to the host properties. You must enable NetBackup Access Control (NBAC) to audit these changes.
Catalog information	Verifying and expiring images. Read requests sent for the front-end usage data.
Certificate management	Creating, revoking, renewing, and deploying of certificates and specific certificate failures.
Certificate Verification Failures (CVFs)	Any failed connection attempts that involve SSL handshake errors, revoked certificates, or hostname validation failures.
Token management	Creating, deleting, and cleanup of tokens and specific token issuing failures.
User management	Adding and deleting users in the Enhanced Auditing mode.
Hold operations	Creating, modifying, and deleting hold operations.
Host database	NetBackup host database related operations.
Login attempts	Any successful or failed login attempts for NetBackup Administration Console and NetBackup API.
Security configuration	Information related to changes made to the security configuration settings.
Starting a restore job	NetBackup does not audit when other types of jobs begin. For example, NetBackup does not audit when a backup job begins.
Enabling or disabling NetBackup Auditing
Starting and stopping the NetBackup Audit Manager (nbaudit).	Starting and stopping of the nbaudit manager is always audited, even if auditing is disabled.
User action that fails to create an audit record	If auditing is enabled but a user action fails to create an audit record, the audit failure is captured in the nbaudit log.
Changes to the bp.conf file (UNIX) or the registry (Windows).	To audit changes to the bp.conf file or the registry, you must enable NetBackup Access Control (NBAC). Manual changes to the bp.conf file or the registry are not audited. See Auditing host property changes. See Configuring NetBackup Access Control (NBAC).
Authorization failure	When you enable Enhanced Auditing, authorization failure is audited. See About Enhanced Auditing.

Actions that NetBackup does not audit

The following actions are not audited and do not display in the audit report:

Any failed actions.	NetBackup logs failed actions in NetBackup error logs. Failed actions do not display in audit reports because a failed attempt does not bring about a change in the NetBackup system state.
The effect of a configuration change.	The results of a change to the NetBackup configuration are not audited. For example, the creation of a policy is audited, but the jobs that result from its creation are not.
The completion status of a manually initiated restore job.	While the act of initiating a restore job is audited, the completion status of the job is not audited. Nor is the completion status of any other job type, whether initiated manually or not. The completion status is displayed in the Activity Monitor.
Internally initiated actions.	NetBackup-initiated internal actions are not audited. For example, the scheduled deletion of expired images, scheduled backups, or periodic image database cleanup is not audited.
Storage Lifecycle Policy actions	Actions that are related to Storage Lifecycle Policies are not audited.