NetBackup™ Web UI Security Administrator's Guide

General tracking

Customers can gain insight from audit trails while they investigate unexpected changes in a NetBackup environment. For example, it might be found that the addition of a client or a backup path has caused a significant increase in backup times. The audit report can indicate that an adjustment to a schedule or to a storage unit configuration might be necessary to accommodate the policy change.

Regulatory compliance

Auditing creates a record of who changed what and when it was changed. The record complies with guidelines such as those required by the Sarbanes-Oxley Act (SOX).

Corporate change management

For customers who must adhere to internal change management policies, NetBackup auditing offers a method to adhere to such policies.

Troubleshooting

The information from NetBackup auditing helps NetBackup Support to troubleshoot problems for customers.

Policies actions

Adding, deleting, or updating policy attributes, clients, schedules, and backup selections lists.

Activity monitor actions

Canceling, suspending, resuming, restarting, or deleting any type of job creates an audit record.

Storage units actions

Adding, deleting, or updating storage units.

Storage servers actions

Adding, deleting, or updating storage servers.

Disk pools and Volume pools actions

Adding, deleting, or updating disk or volume pools.

Catalog information

Certificate management

Creating, revoking, renewing, and deploying of certificates and specific certificate failures.

Certificate Verification Failures (CVFs)

Any failed connection attempts that involve SSL handshake errors, revoked certificates, or host name validation failures.

Token management

Creating, deleting, and cleanup of tokens and specific token issuing failures.

User management

Adding and deleting Enhanced Auditing users in the Enhanced Auditing mode.

Hold operations

Creating, modifying, and deleting hold operations.

Host database

NetBackup host database related operations.

Login attempts

Any successful or failed login attempts for the NetBackup Administration Console, the NetBackup web UI or the NetBackup APIs.

Security configuration

Information related to changes made to the security configuration settings.

Starting a restore job

NetBackup does not audit when other types of jobs begin. For example, NetBackup does not audit when a backup job begins.

Starting and stopping the NetBackup Audit Manager (nbaudit).

Starting and stopping of the nbaudit manager is always audited, even if auditing is disabled.

User action that fails to create an audit record

If auditing is enabled but a user action fails to create an audit record, the audit failure is captured in the nbaudit log. NetBackup status code 108 is returned (Action succeeded but auditing failed). The NetBackup Administration Console does not return an exit status code 108 when auditing fails.

Authorization failure

Authorization failure is audited when you use the NetBackup web UI, the NetBackup APIs, or Enhanced Auditing .

Any failed actions.

NetBackup logs failed actions in NetBackup error logs. Failed actions do not display in audit reports because a failed attempt does not bring about a change in the NetBackup system state.

The effect of a configuration change

The results of a change to the NetBackup configuration are not audited. For example, the creation of a policy is audited, but the jobs that result from its creation are not.

The completion status of a manually initiated restore job

While the act of initiating a restore job is audited, the completion status of the job is not audited. Nor is the completion status of any other job type, whether initiated manually or not. The completion status is displayed in the Activity Monitor (Administration Console) and in the Jobs (web UI).

Internally initiated actions

NetBackup-initiated internal actions are not audited. For example, the scheduled deletion of expired images, scheduled backups, or periodic image database cleanup is not audited.