Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Security and Encryption Guide
  3. Backup anomaly detection
  4. Detecting backup anomalies on the media server
NetBackup™ Security and Encryption Guide

Detecting backup anomalies on the media server

This topic provides the workflow and the procedure that enable the media server to detect backup anomalies.

Note:

By default, the anomaly detection algorithm runs on the NetBackup primary server. If you see any impact on the primary server because of the anomaly detection process, you can configure a media server to detect anomalies.

To enable the media server to detect backup anomalies

  1. Install the NetBackup media server software on your system (or upgrade the media server software).
  2. On the primary server, add anomaly proxy server details. The proxy server should be the media server where you want the anomaly algorithms to be run.

    See Configure anomaly detection settings.

  3. (Optional) If you want to preserve the data that the primary server has gathered earlier, do the following:
    • Ensure that the nbanomalymgmt service is disabled using the web UI.

    • Ensure that the nbanomalymgmt service on the media server is stopped.

    • Go to the following directory:

      On Windows: Install_Path\NetBackup\var\global

      On UNIX: /usr/openv/var/global

      The directory resides on the shared disk on a clustered primary server.

    • Copy the NB_Anomaly.db, NB_Anomaly.db-shm, and NB_Anomaly-wal files from the anomaly_detection folder on the primary server to the anomaly_detection folder on the media server.

      You can copy the anomaly_config.conf file to preserve the automatic malware scan settings.

    • Start the nbanomalymgmt service on the media server.

  4. On the media server, start the nbanomalymgmt service manually. Use the following script:

    nbanomalymgmt -start

  5. Configure the backup anomaly settings in the NetBackup web UI. NetBackup takes these settings into account during anomaly detection.

    See Configure anomaly detection settings.

    See How a backup anomaly is detected.

    If any anomalies are detected, they are notified using the NetBackup web UI.

    See View anomalies.

Feedback

Was this page helpful?
Previous

Detecting backup anomalies on the primary server

Next

Configure anomaly detection settings

Feedback

Was this page helpful?