Veritas NetBackup™ Security and Encryption Guide

To view the NetBackup audit report

1. From a command prompt, locate the nbauditreport command on the master server in the following directory:

   • On Windows:

     Install_path\Veritas\NetBackup\bin\admincmd

   • On UNIX:

     /usr/openv/netbackup/bin/admincmd

2. In its simplest form, enter the nbauditreport command using the following syntax:

   nbauditreport

   The nbauditreport can also be used with a number of options.

   Note:

   The options are case-sensitive.

   -help	Use for assistance with the command at the command prompt.
   -sdate <"MM/DD/YY [HH:[MM[:SS]]]">	Use to indicate the start date and time of the report data you want to view.
   -edate <"MM/DD/YY [HH:[MM[:SS]]]">	Use to indicate the end date and time of the report data you want to view.
   -ctgy POLICY	Use -ctgy POLICY to display information pertaining to policy changes.
   -ctgy JOB	Use -ctgy JOB to display information pertaining to jobs.
   -ctgy STU	Use -ctgy STU to display information pertaining to storage units.
   -ctgy STORAGESRV	Use -ctgy STORAGESRV to display information pertaining to storage servers.
   -ctgy POOL	Use -ctgy POOL to display information pertaining to storage pools.
   -ctgy AUDITCFG	Use -ctgy AUDITCFG to display information pertaining to audit configuration changes.
   -ctgy AUDITSVC	Use -ctgy AUDITSVC to display information pertaining to the starting and stopping of the NetBackup Audit service (nbaudit).
   -ctgy BPCONF	Use -ctgy BPCONF to display information pertaining to changes in the bp.conf file.
   -ctgy CERT	Use -ctgy CERT to display information pertaining to changes in certificate deployment.
   -ctgy LOGIN	Use -ctgy LOGIN to display information that is related to NetBackup Administration Console and NetBackup API login attempts.
   -ctgy TOKEN	Use -ctgy TOKEN to display information that is related to authorization tokens.
   -ctgy SEC_CONFIG	Use -ctgy SEC_CONFIG to display information that is related to changes made to the security configuration settings.
   -ctgy HOLD	Use -ctgy HOLD to display information that is related to creating, modifying, and deleting hold operations.
   -ctgy AZFAILURE	Use -ctgy AZFAILURE to display information that is related to authorization failure when Enhanced Auditing is enabled.
   -ctgy CATALOG	Use -ctgy CATALOG to display information that is related to verifying and expiring images; and read requests sent for the front-end usage data.
   -ctgy HOST	Use -ctgy HOST to display NetBackup host database related operations.
   -ctgy CONNECTION	Use -ctgy CONNECTION to display information about the host connections that were dropped.
   -ctgy USER	Use -ctgy USER to display information pertaining to addition and deletion of users in the Enhanced Auditing mode.
   -ctgy DATAACCESS	Use -ctgy DATAACCESS to display information that is related to restore and browse image content audit records.
   -ctgy SLP	Use -ctgy SLP to display information that is related to creating, modifying, or deleting storage lifecycle policies (SLPs). Note: Activating and suspending an SLP using the nbstlutil command are not audited. These operations are audited only when they are initiated from a NetBackup graphical user interface or API.
   -ctgy ASSET	Use -ctgy ASSET to display information that is related to deleting an asset, such as a vCenter server or a virtual machine, as part of the POST /asset-cleanup process in the Asset Database API.
   -ctgy ASSETGROUP	Use -ctgy ASSETGROUP to display information that is related to creating, modifying, or deleting an asset group as well any action on an asset group for which a user is not authorized.
   -user <username[:domainname]>	Use to indicate the name of the user for whom you'd like to display audit information.
   -fmt SUMMARY	If no report output format option (-fmt) is specified, the SUMMARY option is used by default.
   -fmt DETAIL	The -fmt DETAIL option displays a comprehensive list of audit information. For example, when a policy is changed, this view lists the name of the attribute, the old value, and the new value.
   -fmt PARSABLE	The -fmt PARSABLE option displays the same set of information as the DETAIL report but in a parsable format. The report uses the pipe character (|) as the parsing token between the audit report data.
   [-notruncate]	Use the -notruncate option to display the old and new values of a changed attribute on separate lines in the details section of the report. Note: -notruncate is valid only with the -fmt DETAIL option.
   [-pagewidth <NNN>]	Use the -pagewidth option to set the page width for the details section of the report. Note: -pagewidth is valid only with the -fmt DETAIL option.
   [-order <DTU|DUT|TDU|TUD|UDT|UTD>]	The -order option is valid only with -fmt PARSABLE. Use it to indicate the order in which the information appears. Use the following parameters: D (Description) T (Timestamp) U (User)

3. The audit report contains the following details:

   DESCRIPTION	The details of the action that was performed. The details include the new values that are given to a modified object and the new values of all attributes for a newly created object. The details also include the identification of any deleted objects.
   USER	The identity of the user who performed the action. The identity includes the user name and the domain of the authenticated user. See User identity in the audit report.
   TIMESTAMP	The time that the action was performed. The time is given in Coordinated Universal Time (UTC) and indicated in seconds. (For example, 12/06/11 10:32:48.) Note: For certificate verification failures (CVFs) that involve SSL handshakes and revoked certificates, the timestamp indicates when the audit record is posted to the master server rather than when an individual certificate verification fails. A CVF audit record represents a group of CVF events over a time period. The record details provide the start and end times of the time period as well as the total number of CVFs that occurred in that period.
   CATEGORY	The category of user action that was performed. The CATEGORY displays only with the -fmt DETAIL|PARSABLE options. Examples include the following: AUDITSVC START, AUDITSVC STOP POLICY CREATE, POLICY MODIFY, POLICY DELETE
   ACTION	The action that was performed. The ACTION displays only with the -fmt DETAIL|PARSABLE options. Examples include the following: START, STOP CREATE, MODIFY, DELETE
   REASON	The reason that the action was performed. A reason displays if a reason was specified in the command that created the change. The bpsetconfig and the nbsetconfig commands accept the -r option. See Using the command line -reason or -r option. The reason displays only with the -fmt DETAIL|PARSABLE options.
   DETAILS	An account of all of the changes, listing the old values and the new values. Displays only with the -fmt DETAIL|PARSABLE options.