Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Web UI Administrator's Guide
  3. Section X. Detection and reporting
  4. Detecting anomalies
  5. About backup anomaly detection
NetBackup™ Web UI Administrator's Guide

About backup anomaly detection

NetBackup can now detect anomalies in backup metadata. It can detect any unusual job data in the data backup flow. For example, it can detect a file count or a file size that is different than the usual count or size.

Note:

By default, the anomaly detection algorithm runs on the NetBackup primary server. If you see any impact on the primary server because of the anomaly detection process, you can configure a media server to detect anomalies.

The following backup job metadata, attributes, or features are verified during backup anomaly detection:

  • Backup image size

  • Number of backup files

  • Data that is transferred in KB

  • Deduplication rate

  • Backup job completion time

Any unusual deviation in these backup job attributes is considered to be an anomaly and is notified using the NetBackup web UI.

Starting with 10.4, NetBackup can detect anomalies for Oracle workload only for the image size attribute. If an Oracle workload job fails multiple times with status code 5407, NetBackup flags it as an anomaly.

Workflow of backup anomaly detection and notification

The workflow of the backup anomaly detection and notification is as follows:

Table: Workflow

Step

Description

Step 1

Install or upgrade NetBackup software on the primary server and the media server.

See the NetBackup Installation or Upgrade Guide.

Step 2

Enable the primary server to detect backup anomalies.

By default, the anomaly detection algorithm runs on the NetBackup primary server. If you see any impact on the primary server because of the anomaly detection process, you can configure a media server to detect anomalies.

See the NetBackup Security and Encryption Guide.

Step 3

Configure anomaly detection settings using the NetBackup web UI.

See Configure backup anomaly detection settings.

Step 4

View the anomalies using the NetBackup web UI.

See View backup anomalies.

Feedback

Was this page helpful?
Previous

Detecting anomalies

Next

How a backup anomaly is detected

Feedback

Was this page helpful?