NetBackup™ Web UI Administrator's Guide
- Introducing NetBackup
- Section I. Monitoring and notifications
- Monitoring NetBackup activity
- Activity monitor
- Job monitoring
- Notifications
- Monitoring NetBackup activity
- Section II. Configuring hosts
- Managing host properties
- Managing credentials for workloads and systems that NetBackup accesses
- Managing deployment
- Section III. Configuring storage
- Section IV. Configuring backups
- Section V. Managing security
- Security events and audit logs
- Managing security certificates
- Managing host mappings
- Managing user sessions
- Managing the security settings for the primary server
- About trusted primary servers
- Using access keys, API keys, and access codes
- Configuring authentication options
- Managing role-based access control
- Configuring RBAC
- Add a custom RBAC role
- Section VI. Detection and reporting
- Detecting malware
- Detecting anomalies
- Usage reporting and capacity licensing
- Detecting malware
- Section VII. NetBackup workloads and NetBackup Flex Scale
- Section VIII. Disaster recovery and troubleshooting
How a backup anomaly is detected
Consider the following example:
In an organization, around 1 GB of data is backed up every day for a given client and backup policy with the schedule type FULL. On a particular day, 10 GB of data is backed up. This instance is captured as an image size anomaly and notified. The anomaly is detected because the current image size (10 GB) is much greater than the usual image size (1 GB).
Significant deviation in the metadata is termed as an anomaly based on its anomaly score.
An anomaly score is calculated based on how far the current data is from the cluster of similar observations of the data in the past. In this example, a cluster is of 1 GB of data backups. You can determine the severity of anomalies based on their scores.
For example:
Anomaly score of Anomaly_A = 7
Anomaly score of Anomaly_B = 2
Conclusion - Anomaly_A is severer than Anomaly_B
NetBackup takes anomaly detection configuration settings (default and advanced if available) into account during anomaly detection.