Viewing the audit report
To view the audit report, use either the nbauditreport command on a NetBackup master server or view the settings using NetBackup OpsCenter.
Within OpsCenter, the Monitor > Audit Trails section provides the details of the Audit logs and lets you export that information to Excel or save as a .pdf file.
See the Veritas NetBackup OpsCenter Administrator's Guide for more details.
If auditing is enabled but a user action fails to create an audit record, the audit failure is captured in the nbaudit log.
The Alert Notification button in the NetBackup Administration Console can notify administrators when an audit failure occurs.
See Audit alert notification for audit failures.
The failure to create an audit record has no effect on the user action that was performed.
If the user action succeeds, an exit code is returned that reflects the successful action. If auditing of the action fails, NetBackup status code 108 is returned (Action succeeded but auditing failed).
Note:
The NetBackup Administration Console (Windows and UNIX (jnbSA)) does not return an exit status code 108 when auditing fails.
To view the NetBackup audit report
- From a command prompt, locate the nbauditreport command on the master server in the following directory:
On Windows:
Install_path\Veritas\NetBackup\bin\admincmd
On UNIX:
/usr/openv/netbackup/bin/admincmd
- In its simplest form, enter the nbauditreport command using the following syntax:
nbauditreport
The nbauditreport can also be used with a number of options.
- The audit report contains the following details:
DESCRIPTION
The details of the action that was performed. The details include the new values that are given to a modified object and the new values of all attributes for a newly created object. The details also include the identification of any deleted objects.
USER
The identity of the user who performed the action. The identity includes the user name, the domain, and the domain type of the authenticated user.
TIMESTAMP
The time that the action was performed. The time is given in Coordinated Universal Time (UTC) and indicated in seconds. (For example, 12/06/11 10:32:48.)
Note:
For certificate verification failures (CVFs) that involve SSL handshakes and revoked certificates, the timestamp indicates when the audit record is posted to the master server rather than when an individual certificate verification fails. A CVF audit record represents a group of CVF events over a time period. The record details provide the start and end times of the time period as well as the total number of CVFs that occurred in that period.
CATEGORY
The category of user action that was performed. The CATEGORY displays only with the -fmt DETAIL|PARSABLE options.
Examples include the following:
AUDITSVC START, AUDITSVC STOP
POLICY CREATE, POLICY MODIFY, POLICY DELETE
ACTION
The action that was performed. The ACTION displays only with the -fmt DETAIL|PARSABLE options.
Examples include the following:
START, STOP
CREATE, MODIFY, DELETE
REASON
The reason that the action was performed. A reason displays if a reason was specified in the command that created the change. The bpsetconfig and the nbsetconfig commands accept the -r option.
See Using the command line -reason or -r option.
The reason displays only with the -fmt DETAIL|PARSABLE options.
DETAILS
An account of all of the changes, listing the old values and the new values. Displays only with the -fmt DETAIL|PARSABLE options.
If an exit status appears in the output, look up the code in the NetBackup Administration Console (Troubleshooter), the online Help, or the Status Codes Reference Guide.
Figure: Summary audit report example shows the default contents of an audit report that was run on server1.
