Veritas NetBackup™ Virtual Appliance Documentation
- Getting to know the NetBackup Virtual Appliance
- NetBackup Virtual Appliance product description
- Preparing to deploy the appliance
- Deploying and configuring the appliance
- How to deploy and configure a NetBackup Virtual Appliance combined master and media server
- How to deploy and configure a NetBackup Virtual Appliance media server
- How to deploy and configure a NetBackup Virtual Appliance master server
- How to deploy and configure a NetBackup Virtual Appliance CloudCatalyst
- How to deploy and configure a NetBackup Virtual Appliance combined master and media server
- Post initial configuration procedures
- Appliance common tasks
- Storage management
- About NetBackup Virtual Appliance storage configuration
- About viewing storage space information using the Show command
- About NetBackup Virtual Appliance storage configuration
- Network connection management
- Managing users
- About authenticating LDAP users
- About authenticating Active Directory users
- About authenticating Kerberos-NIS users
- About user authorization on the NetBackup Virtual Appliance
- Creating NetBackup administrator user accounts
- Using the appliance
- About configuring Host parameters for your appliance on the NetBackup Virtual Appliance
- About Copilot functionality and Share management
- About NetBackup Virtual Appliance as a VMware backup host
- About running NetBackup commands from the appliance
- About mounting a remote NFS
- About Auto Image Replication from a NetBackup Virtual Appliance
- Monitoring the appliance
- About SNMP
- About Call Home
- Appliance security
- About Symantec Data Center Security on the NetBackup Virtual Appliance
- Setting the appliance login banner
- Upgrading the appliance
- About upgrading to NetBackup Virtual Appliance software version 3.1.2
- Requirements and best practices for upgrading NetBackup appliances
- Methods for downloading appliance software release updates
- Appliance restore
- Decommissioning and Reconfiguring
- Troubleshooting
- About disaster recovery
- About NetBackup support utilities
- Appliance logging
- Commands overview
- Appendix A. Appliance commands
- Appendix B. Manage commands
- Appendix C. Monitor commands
- Appendix D. Network commands
- Appendix E. Reports commands
- Appendix F. Settings commands
- Appendix G. Support commands
Log Forwarding feature overview
The Log Forwarding feature lets you send appliance logs to an external log management server. Starting with software version 3.1, NetBackup Virtual Appliance support forwarding syslogs. A syslog is an OS system log that contains user and system level activities in the form of events. Use this feature to help increase security and to help achieve general compliance initiatives such as HIPPA, SOX, and PCI. The currently supported log management servers are HP ArcSight and Splunk.
NetBackup appliances use the Rsyslog client to forward logs. In addition to HP ArcSight and Splunk, other log management servers that support the Rsyslog client can also be used to receive syslogs from the appliance. Refer to the log management server documentation to verify Rsyslog client support.
To secure the log transmission from the appliance to the log management server, you can use the TLS (Transport Layer Security) option. NetBackup Virtual Appliance currently supports only TLS Anonymous Authentication for log forwarding.
To enable TLS, the appliance and the log management servers each require unique preparation as follows:
Appliance requirements
Before you configure and enable the log forwarding feature, the appliance requires the following certificate and private key files in the X.509 file format:
ca-server.pem
A root CA certificate from which the log management server certificate is derived.
nba-rsyslog.pem
A certificate for the appliance to communicate with a log management server, that also includes any intermediary CA certificates.
nba-rsyslog.key
A private key that corresponds to the certificate used to communicate with the
syslog
management server.
You can upload these files to the appliance through an NFS or a CIFS share.
Configuration requirements for HP ArcSight servers
You must set up an Rsyslog server with TLS settings on the HP ArcSight server to receive encrypted logs from the appliance. Then, configure the Rsyslog server to forward the decrypted logs to the HP ArcSiight server. See the www.rsyslog.com website for guides on setup and configuration.
Configuration requirements for Splunk servers
You must first configure TLS on these servers, and then configure the log forwarding feature on the appliance. Refer to your Splunk documentation for the appropriate TLS configuration details.
The feature must be configured from the shell menu with the following Main > Settings > LogFowarding command options:
LogForwarding Enable
Configures the feature functionality.
LogForwarding Disable
Deletes the configuration and disables the feature.
LogForwarding Interval
Sets how often logs are forwarded. Select from 0 (continuous), 15, 30, 45, or 60 minutes.
LogForwarding Share
Opens or closes an NFS or a CIFS share on the appliance for obtaining the required certificate and private key files. The share paths are the following:
NFS:
<appliance.name>:/inst/logforwarding
.CIFS:
\\<appliance.name>\logforwarding
LogForwarding Show
Shows the current configuration and status.
After you enter the LogForwarding > Enable command, prompts appear to guide you through the configuration as described in the following table:
Table: LogForwarding > Enable command prompts
Prompt | Description |
---|---|
Server name or IP | Enter the name or the IP address of the external log management server. |
Server port | Enter the appropriate port number on the external log management server. |
Protocol | Select either UDP or TCP. |
Interval | Set how often logs are forwarded. |
Enable TLS | Select to enable TLS for secure log transmissions to the log management server. Currently, only the X.509 file format is supported. The following certificate and private key files must be uploaded to the appliance to use TLS:
|
For complete configuration and command information, refer to the following: