How to trace the admin who cancelled all jobs at once (Cancel all jobs)

[Soumyaa]

Hi,

Is there any way to find out the admin who cancelled all the active jobs in Activity monitor using the option 'Cancel all jobs' instaed of 'Cancel job'. Yesterday someone from my team cancelled all the active jobs which are in 600 + number and I want to know who cancelled these all.

In other words my question is 'How to track the person who cancelled an job?'

Thanks in advance,

Suresh.  

[J_H_Is_gone]

heard they are planning on it, might be in 7.1 but I have not read the specs yet.

But if you are on a vesion below - nope - the question has been asked before.

[Soumyaa]

Yes we are using 7.1 only

[JHeaton]

And of course, no one is fessing up, right?

Do you have that many people that access backups to have a long list of people that may have done it?

[rizwan84tx]

you may check the nbconsole log for that day to see the NetBackup Console activity.

[RiaanBadenhorst]

Hi,

Auditing does not provide that function yet. See the note https://www-secure.symantec.com/connect/blogs/netbackup-71-features-opscenter-and-opscenter-analytics-reporting-enhancements

What you could do is configure NBAC. This will allow users to log into NBU with their AD accounts and then when they perform actions you should be able to see who did what.

[Soumyaa]

NBAC is configured with user accounts and we are logging with user IDs only. Any way to find out now?

[watsons]

Audit trail is a new feature in NB7.1, according to this: http://www.symantec.com/docs/HOWTO34380 , it can actually track who "cancels the job in activity monitor". However, I believe this feature may need to be enabled first.

As for NBAC, not sure what you mean by userID, isn't that same as user account? NBAC is just to prevent unauthorized change but it won't give you any change record, AFAIK.