NetBackup™ Commands Reference Guide
- Introduction
- Appendix A. NetBackup Commands
- acsd
- backupdbtrace
- backuptrace
- bmrc
- bmrconfig
- bmrepadm
- bmrprep
- bmrs
- bmrsrtadm
- bp
- bparchive
- bpbackup
- bpbackupdb
- bpcatarc
- bpcatlist
- bpcatres
- bpcatrm
- bpcd
- bpchangeprimary
- bpcleanrestore
- bpclient
- bpclimagelist
- bpclntcmd
- bpclusterutil
- bpcompatd
- bpconfig
- bpdbjobs
- bpdbm
- bpdgclone
- bpdown
- bpduplicate
- bperror
- bpexpdate
- bpfis
- bpflist
- bpgetconfig
- bpgetdebuglog
- bpimage
- bpimagelist
- bpimmedia
- bpimport
- bpinst
- bpkeyfile
- bpkeyutil
- bplabel
- bplist
- bpmedia
- bpmedialist
- bpminlicense
- bpnbat
- bpnbaz
- bppficorr
- bpplcatdrinfo
- bpplclients
- bppldelete
- bpplinclude
- bpplinfo
- bppllist
- bpplsched
- bpplschedrep
- bpplschedwin
- bppolicynew
- bpps
- bprd
- bprecover
- bprestore
- bpretlevel
- bpschedule
- bpschedulerep
- bpsetconfig
- bpstsinfo
- bpstuadd
- bpstudel
- bpstulist
- bpsturep
- bptestbpcd
- bptestnetconn
- bpup
- bpverify
- cat_convert
- cat_export
- cat_import
- configureCerts
- configureMQ
- configureWebServerCerts
- create_nbdb
- csconfig cldinstance
- csconfig cldprovider
- csconfig meter
- csconfig reinitialize
- csconfig throttle
- duplicatetrace
- importtrace
- jbpSA
- jnbSA
- ltid
- mklogdir
- msdpcldutil
- nbauditreport
- nbcallhomeproxyconfig
- nbcatsync
- NBCC
- NBCCR
- nbcertcmd
- nbcertupdater
- nbcldutil
- nbcmdrun
- nbcomponentupdate
- nbcplogs
- nbcredkeyutil
- nbdb_admin
- nbdb_backup
- nbdb_move
- nbdb_ping
- nbdb_restore
- nbdb_unload
- nbdb2adutl
- nbdbms_start_server
- nbdbms_start_stop
- nbdc
- nbdecommission
- nbdelete
- nbdeployutil
- nbdevconfig
- nbdevquery
- nbdiscover
- nbdna
- nbemm
- nbemmcmd
- nbepicfile
- nbfindfile
- nbfirescan
- nbfp
- nbftadm
- nbftconfig
- nbgetconfig
- nbhba
- nbholdutil
- nbhostidentity
- nbhostmgmt
- nbhypervtool
- nbidpcmd
- nbimageshare
- nbinstallcmd
- nbjm
- nbkmiputil
- nbkmscmd
- nbkmsutil
- nboraadm
- nborair
- nboracmd
- nbpem
- nbpemreq
- nbmariadb
- nbmlb
- nbperfchk
- nbplupgrade
- nbrb
- nbrbutil
- nbreplicate
- nbrepo
- nbrestorevm
- nbseccmd
- nbserviceusercmd
- nbsetconfig
- nbshvault
- nbsmartdiag
- nbsnapimport
- nbsnapreplicate
- nbsqladm
- nbsqlite
- nbstl
- nbstlutil
- nbstop
- nbsu
- nbsvrgrp
- netbackup_deployment_insights
- resilient_clients
- restoretrace
- stopltid
- tldd
- tldcd
- tpautoconf
- tpclean
- tpconfig
- tpext
- tpreq
- tpunmount
- verifytrace
- vltadm
- vltcontainers
- vlteject
- vltinject
- vltoffsitemedia
- vltopmenu
- vltrun
- vmadd
- vmchange
- vmcheckxxx
- vmd
- vmdelete
- vmoprcmd
- vmphyinv
- vmpool
- vmquery
- vmrule
- vmupdate
- vnetd
- vssat
- vwcp_manage
- vxlogcfg
- vxlogmgr
- vxlogview
- W2KOption
Name
nbauditreport — Generate and view an audit report
SYNOPSIS
-sdate "MM/DD/YY [HH:[MM[:SS]]]" [-edate "MM/DD/YY [HH:[MM[:SS]]]" [-ctgy | -exclude_ctgy] [ALERT | ANOMALY | ANOMALY_EXTENSIONS | ANOMALY_EXTENSIONS_DETAILS | ANOMALY_NEW | ANOMALY_RULES_RESULTS | ASSET | ASSETGROUP | AUDITCFG | AUDIT_LOG_FORWARD | AUDITSVC | AZFAILURE | BMR | BPCONF | CATALOG | CERT | CONFIG | CONNECTION | DATAACCESS | EVENT_AUDIT | HOLD | HOST | IRE | JOB | LICENSING | LOGIN | MALWARE_IMPACTED | MALWARE_SCAN_STATUS | MALWARE_SCAN_TRIGGER | PAUSED_CLIENTS | POLICY | POOL | PROTECTION_PLAN_SVC | RETENTION_LEVEL | SEC_CONFIG | SLP | STORAGESRV | STU | TOKEN | UI_CONFIG | USER] -user username[:domainname] -fmt [SUMMARY | DETAIL | PARSABLE] [-notruncate] [-iso_std_tfmt] [-pagewidth NNN] [-order [DTU | DUT | TDU | TUD | UDT | UTD]]
On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/admincmd/
On Windows systems, the directory path to this command is install_path\NetBackup\bin\admincmd\
DESCRIPTION
The nbauditreport command lets you create and view a NetBackup audit report.
When auditing is configured in a NetBackup environment, the following user-initiated actions in NetBackup are recorded and available to view in an audit report:
Actions that change the NetBackup configuration. Examples are policy creation, deletion, and modification, and changing the audit settings.
Actions that change NetBackup run-time objects. These actions include initiating a restore job and starting or stopping the audit service.
This command only creates and displays the audit report. You must use the nbemmcmd -changesetting -AUDIT ENABLED and nbemmcmd -changesetting -AUDIT DISABLED commands to enable and disable auditing itself.
For more about auditing and audit reports, see the NetBackup Administrator's Guide, Volume I and NetBackup Security and Encryption Guide.
OPTIONS
- [-ctgy | -exclude_ctgy] [ALERT | ANOMALY | ANOMALY_EXTENSIONS | ANOMALY_EXTENSIONS_DETAILS | ANOMALY_NEW | ANOMALY_RULES_RESULTS | ASSET | ASSETGROUP | AUDITCFG | AUDIT_LOG_FORWARD | AUDITSVC | AZFAILURE | BMR | BPCONF | CATALOG | CERT | CONFIG | CONNECTION | DATAACCESS | EVENT_AUDIT | HOLD | HOST | IRE | JOB | LICENSING | LOGIN | MALWARE_IMPACTED | MALWARE_SCAN_STATUS | MALWARE_SCAN_TRIGGER | PAUSED_CLIENTS | POLICY | POOL | PROTECTION_PLAN_SVC | RETENTION_LEVEL | SEC_CONFIG | SLP | STORAGESRV | STU | TOKEN | UI_CONFIG | USER]
Specifies the type of information to be displayed in the audit report. The audit function records and displays information on the use-initiated actions for the pertinent area (job, pool, etc.). The following are the possible values for this option and the items that are audited for each value:
ALERT - failure in alert generation or failure in sending email notifications.
ANOMALY - anomaly status changes such as report as false positive.
ANOMALY_EXTENSIONS - for a new anomaly that is generated through a specific anomaly extension.
ANOMALY_EXTENSIONS_DETAILS - for a modification that was done to a specific anomaly extension.
ANOMALY_NEW - for any new anomaly generated.
ANOMALY_RULES_RESULTS - for an output of a specific anomaly rule.
ASSET - deleting an asset, such as a vCenter server or a virtual machine, as part of the POST /asset-cleanup process in the Asset Database API.
ASSETGROUP - creating, modifying, or deleting an asset group as well any action on an asset group for which a user is not authorized.
AUDITCFG - auditing configuration changes
AUDIT_LOG_FORWARD - auditing events specific to the third-party tools that are configured for audit.
AUDITSVC - starting and stopping the NetBackup Audit service (nbaudit)
AZFAILURE - authorization failures
BMR - Create, modify, and delete Bare Metal Restore operations.
BPCONF - changes to the
bp.conffile (UNIX only).CATALOG - verifying and expiring images; and reading front-end usage data
CERT - certificate deployment
CONFIG - changes made to the configuration settings (for example SMTP server configuration) or to the excluded status codes list for alerts
CONNECTION - dropped host connections
DATAACCESS - the audit messages that are related to success and failure of access to different NetBackup operations. Audit messages are displayed for restore and browse images operations only.
EVENT_AUDIT - All the events that are logged are captured as audit records under this audit category. Any user-initiated actions using commands and NetBackup Administration Console (through commands or user services) are event logged. Note the following points:
Actions that require the primary server daemons are audited.
Any scheduled NetBackup actions like scheduled backup, are not audited.
Any user-initiated actions using the NetBackup web UI are not audited.
The events that are associated with the first daemon that receives the request are logged.
Events that are associated with the subsequent daemons are not logged.
HOLD - create, modify, and delete hold operations.
HOST - NetBackup host database-related operations
IRE - Isolated recovery environment-related operations
JOB - job changes
LICENSING - track any access to information that is related to licensing
LOGIN - logon attempts
MALWARE_IMPACTED - any client detected as impacted through malware scan.
MALWARE_SCAN_STATUS - malware scan job status such as failed, completed.
MALWARE_SCAN_TRIGGER - malware scan that is triggered automatically or manually.
PAUSED_CLIENTS - for any clients that are added or deleted from the pause protection list.
POLICY - Adding, deleting, or updating policy attributes, clients, schedules, and backup selections lists.
POOL - disk storage pool changes.
PROTECTION_PLAN_SVC - modifications to the protection plan.
RETENTION_LEVEL - changes to the retention level.
SEC_CONFIG - changes made to the security configuration settings.
SLP - Creating, modifying, or deleting a storage lifecycle policy (SLP) when initiated through a NetBackup graphical user interface, API, or the nbstl command. Successful attempts to activate or suspend an SLP from a NetBackup graphical user interface or API are also audited and logged. Activating and suspending an SLP using the nbstlutil command are not audited.
STORAGESRV - storage server information and user actions
STU - storage unit changes
TOKEN - authorization tokens
UI_CONFIG - changes made for the NetBackup web UI.
USER - adding or deleting users
The default condition, when none of the options are specified, is to display the audit report of all categories.
- -exclude_ctgy [audit_category]
Use this option to exclude a specific category from the list of audit records.
- -fmt [SUMMARY | DETAIL | PARSABLE]
Specifies the output format of the audit report.
SUMMARY is the default condition (no option used). The audit report is a summary only. It displays the audit report in columnar format using the description, user, and timestamp headings.
DETAIL displays a comprehensive list of auditing information. For example, when a policy is changed, this view lists the name of the attribute, the old value, and the new value.
PARSABLE displays the same set of information as the DETAIL report but in a parsable format. The report uses the pipe character (|) as a separator of the audit data. Use keywords available with the report (DESCRIPTION, ACTION, OLDV, NEWV, etc.) to parse the audit record.
The parsable report contains the following fields:
DESCRIPTION. The details of the action that was performed. The details include the new values that are given to a modified object and the new values of all attributes for a newly created object. The details also show any deleted objects.
TIMESTAMP. The time that the action occurred. The time is displayed in Coordinated Universal Time (UTC) and is indicated in seconds.
CATEGORY. The category of user action that was performed. Categories such as POLICY may contain several sub-categories such as schedules or backup selections. Any modifications to a sub-category are listed as a modification to the primary category. The categories are as follows:
ALERT - failure in alert generation or failure in sending email notifications.
AUDITCFG - Auditing configuration changes
AUDIT_LOG_FORWARD - Auditing events specific to the third-party tools that are configured for audit.
AUDITSVC - Starting and stopping the NetBackup Audit service (nbaudit)
AZFAILURE - Requests that fail authorization checks
BPCONF - Changes to the
bp.conffile (UNIX only)CATALOG - Verifying and expiring images; and reading front-end usage data
CERT - Creating, revoking, renewing, and deploying of certificates and specific certificate failures
CONFIG - changes made to the configuration settings (for example SMTP server configuration) or to the excluded status codes list for alerts
DATAACCESS - The audit messages that are related to success and failure of access to different NetBackup operations. Audit messages are displayed for restore and browse images operations only.
HOLD - Create, modify, and delete hold operations.
HOST - Information that is related to NetBackup host database operations.
IRE - Isolated recovery environment configuration and state changes.
JOB - Job changes such as cancelations or deletions
LICENSING - track any access to information that is related to licensing
LOGIN - The success and failure that is related to NetBackup Administration Console and NetBackup API logon attempts.
POLICY - Modification to policy attributes, clients, schedules, or backup selections
POOL - Disk storage pool changes
PROTECTION_PLAN_SVC - modifications to the protection plan
RETENTION_LEVEL - changes to the retention level
SEC_CONFIG - Information that is related to changes that are made to the security configuration settings
SLP - Creation, modification, or deletion SLP attributes or windows when they are initiated through a NetBackup graphical user interface, API, or the nbstl command.
STORAGESRV - Storage server creation, modification, or deletion. User actions on the storage server.
STU - Storage unit creation, modification, or deletion
TOKEN - Creating, deleting, and cleanup of tokens and specific token issuing failures
UI_CONFIG - Information that is related to changes that are made for the NetBackup web UI.
USER - Adding or deleting users
CONNECTION - Information about the dropped host connections.
ACTION. The activity that was performed. The following actions are possible for all categories: Detailed descriptions of the specific activities that are performed for each action are found in the DESCRIPTIONS and the DETAILS fields of the command output.
REASON. Reason that is given for the performed action if any. If the audit reason for host and host ID-to-host name mapping operations contains more than 512 characters, the reason text is truncated to 512 characters.
DETAILS. Detailed information on the activity that is separated into attributes (ATTR_num), each with a descriptive name followed by OLDV/NEWV (old value/new value) pair.
Example for a policy deletion: ATTR_1: Policy Type OLDV: Standard NEWV:
- -iso_std_tfmt
Use this option to display the time in ISO8601 and RFC 3339 formats.
- -notruncate
Displays the old and new values of a changed attribute on separate lines in the details section of the report. This option is used with the -fmt DETAIL option.
- -order [DTU | DUT | TDU | TUD | UDT | UTD]
Specifies the order in which the information is displayed in the parsable format of the audit report. This option can be used only with the -fmt PARSABLE option. The D, T, and U designators represent the following:
D - description
T - timestamp
U - user
- -pagewidth NNN
Specifies the page width for the details section of the audit report. This option is used with the -fmt DETAIL option.
- -sdate mm/dd/yyyy-hh:mm:ss | mm/dd-hh:mm -edate mm/dd/yyyy-hh:mm:ss | mm/dd-hh:mm
Sets the start date-time (-sdate) or the end date-time (-edate) of the audit report data that you want to view. No time indication is necessary.
If the start date is specified and the end date is not, the displayed audit data is from the specified start time to the present. If the end date is specified and the start date is not, the displayed audit data is up to the end date.
- -user username[:domainname]
Indicates the name of the user for whom you want to display audit information.
EXAMPLES
Example 1 - Display all audit events that are reported from April 1, 2013 to the present.
# nbauditreport -sdate 04/01/13 USER DESCRIPTION TIMESTAMP Admin@entry Schedule 'test1' was added to Policy 'test1' 04/06/13 Admin@entry Audit setting(s) of master server 'server1' were modified 04/06/13 Admin@entry Audit setting(s) of master server 'server1' were modified 04/06/13 sys@server1 The nbaudit service on master server 'server1' was started 04/06/13 sys@server1 The nbaudit service on master server 'server1' was stopped 04/06/13 sys@server1 The nbaudit service on master server 'server1' was started 04/06/13 Audit records fetched: 7
Example 2 - Display a detailed audit report for when Joe modified a set of policy attributes. Because the policy was changed only one time since 6/8/13, one audit record is retrieved.
# nbauditreport -fmt DETAIL -ctgy POLICY -sdate 6/8/13
DESCRIPTION: Attributes of Policy 'pol_stugrp' were modified
USER: joe
TIMESTAMP: 06/08/2013 19:14:25
CATEGORY: POLICY
ACTION: MODIFY
DETAILS:
ATTRIBUTE OLD VALUE NEW VALUE
1 Proxy Client
2 Residence stu_grp
3 Collect TIR info 2 0
4 Checkpoint Restart 0 1
5 Checkpoint Interval 0 15
6 Data Mover Type 2 -1
7 Collect BMR Info 1 0
8 Policy Generation 1 2
Audit records fetched: 1
The DETAILS entry shows the old value and new value of all the attributes that Joe changed.
Example 3 - Display an audit report for all hold operations that were performed since August 30, 2013.
# nbauditreport -ctgy HOLD -sdate "08/30/13 22:46:50" -fmt DETAIL
DESCRIPTION: Hold with hold name test hold for report1 is created
USER: root@aellora.mydomain.com
TIMESTAMP: 08/30/13 22:47:56
CATEGORY: HOLD
ACTION: CREATE
REASON:
DETAILS:
ATTRIBUTE OLD VALUE NEW VALUE
1 On-hold image list nakul2.mydomain.co
DESCRIPTION: Hold with hold name test hold for report1 is created
USER: root@aellora.mydomain.com
TIMESTAMP: 08/30/13 22:47:54
CATEGORY: HOLD
ACTION: CREATE
REASON:
Audit records fetched: 2
Example 4 - Display a detailed audit report for all security operations.
# nbauditreport -ctgy SEC_CONFIG -fmt DETAIL DESCRIPTION: Updated 'Role' 'Default VMware Administrator' USER: secadmin@domain TIMESTAMP: 05/02/2021 10:38:24 CATEGORY: SEC_CONFIG ACTION: MODIFY REASON: DETAILS: ATTRIBUTE OLD VALUE NEW VALUE 1 User principal domain:vmadmin:nt Audit records fetched: 1