Create NetBackup Data Collector Role, Service Account, and API Key
A Data Collector Service Account and API key is used while configuring the Cohesity NetBackup Data Collector policy. This must be configured to enable complete collection from NetBackup. Create a Data Collector Service Account and add an RBAC custom role in the NetBackup Web UI. This option of applying permissions to a custom role is applicable for NetBackup 9.0 and later. If you enter a non-root user, you must create a custom role in the NetBackup Web UI RBAC screen with the following permissions and attach the role to a service account.
To create the custom role within the NetBackup Web UI:
- On the left, click Security > RBAC.
- Under the Roles tab, click Add.
- Select Custom role and click Next.
- Enter the Role Name and Role Description.
- Under Permissions, click Assign.
Select all the View permissions for all the objects under NetBackup Management, Protection, and Storage sections of the NetBackup web UI.
From the NetBackup Management > CLI Sessions section, enable CLI Execute.
From the NetBackup Management > Malware section, enable View scan results.
From the RBAC > (Edit RBAC customs role) > Global Permission tab > Security > enable View permission for Global Security Settings.
From the RBAC > (Edit RBAC customs role) > Global Permission tab > Security > enable View permission for Security Events.
- Select Users tab and Add to List service account to be associated with this role.
Copy the API key generated with these steps for future use. It will be required while configuring the NetBackup Collection Policy.
To add an API key:
- Select Security > Access keys on the NetBackup Web UI.
- Enter the Username and Description.
The service account associated with the API key and the Role, must be the same service account that is associated with the Veritas NetBackup Collection Policy in IT Analytics.
- Click ADD.
If you are configuring a Centralized Data Collector with SSH access to the NetBackup primary, then you must create a second user in addition to the account created in the steps above. This second user must be an OS user with an identical username, same as the account you just created. See the section Linux Centralized Data Collector: SSH for instructions on how to create the second account.