Veritas NetBackup™ Appliance Security Guide
- About the NetBackup appliance Security Guide
- User authentication
- About user authentication on the NetBackup appliance
- About configuring user authentication
- About user name and password specifications
- User authorization
- Intrusion prevention and intrusion detection systems
- Log files
- Operating system security
- Data security
- Web security
- Network security
- Call Home security
- About AutoSupport
- About Call Home
- About SNMP
- Remote Management Module (RMM) I security
- STIG and FIPS conformance
- Appendix A. Security release content
Log Forwarding feature overview
The Log Forwarding feature lets you send appliance logs to an external log management server. Starting with software version 3.0, NetBackup appliances support forwarding syslogs. A syslog is an OS system log that contains user and system level activities in the form of events. Use this feature to help increase security and to help achieve general compliance initiatives such as HIPPA, SOX, and PCI. The currently supported log management servers are HP ArcSight and Splunk.
NetBackup appliances use the Rsyslog client to forward logs. In addition to HP ArcSight and Splunk, other log management servers that support the Rsyslog client can also be used to receive syslogs from the appliance. Refer to the log management server documentation to verify Rsyslog client support.
To secure the log transmission from the appliance to the log management server, you can use the TLS (Transport Layer Security) option. NetBackup appliance currently supports only TLS Anonymous Authentication for log forwarding.
To enable TLS, the appliance and the log management servers each require unique preparation as follows:
Before you configure and enable the log forwarding feature, the appliance requires the following certificate and private key files in the X.509 file format:
A root CA certificate from which the log management server certificate is derived.
A certificate for the appliance to communicate with a log management server, that also includes any intermediary CA certificates.
A private key that corresponds to the certificate used to communicate with the
You can upload these files to the appliance through an NFS or a CIFS share.
Configuration requirements for HP ArcSight servers
You must set up an Rsyslog server with TLS settings on the HP ArcSight server to receive encrypted logs from the appliance. Then, configure the Rsyslog server to forward the decrypted logs to the HP ArcSiight server. See the www.rsyslog.com website for guides on setup and configuration.
Configuration requirements for Splunk servers
You must first configure TLS on these servers, and then configure the log forwarding feature on the appliance. Refer to your Splunk documentation for the appropriate TLS configuration details.
The feature must be configured from the shell menu with the following Main > Settings > LogFowarding command options:
Configures the feature functionality.
Deletes the configuration and disables the feature.
Sets how often logs are forwarded. Select from 0 (continuous), 15, 30, 45, or 60 minutes.
Opens or closes an NFS or a CIFS share on the appliance for obtaining the required certificate and private key files. The share paths are the following:
Shows the current configuration and status.
After you enter the LogForwarding > Enable command, prompts appear to guide you through the configuration as described in the following table:
Table: LogForwarding > Enable command prompts
Server name or IP
Enter the name or the IP address of the external log management server.
Enter the appropriate port number on the external log management server.
Select either UDP or TCP.
Set how often logs are forwarded.
Select to enable TLS for secure log transmissions to the log management server. Currently, only the X.509 file format is supported.
The following certificate and private key files must be uploaded to the appliance to use TLS:
For complete configuration and command information, refer to the following documents:
NetBackup Appliance Administrator's Guide
NetBackup Appliance Commands Reference Guide