Which user deleted a job ?

[Schwarzkopf]

Is there any way to discover which user deleted a backup job ?

[Marianne · Accepted solution]

Which NBU version? Have you enabled audit trails?

Phase 1 of auditing was introduced with NBU 7.0.1:

http://www.symantec.com/docs/TECH135812

Audit Trails Phase 1 - Track policy changes and restore jobs. Will be CLI only for this release.  Subsequent NetBackup release will leverage the OpsCenter interface.
Customer Benefit:   Better understand who changed what policies and when. Also details who executed which restore jobs and what did they restore.  When troubleshooting backup jobs - helps answer the question "what has changed"?

NBU 7.1 Release Notes has the following:

With NetBackup audit trail you can keep a record of user activities in a NetBackup
environment. With this release, you can audit many more categories than were
covered with policies and restore jobs in NetBackup 7.0.1. In addition, you can
configure and view audit trails with OpsCenter. This feature enables customers
to track who made changes, when the changes were made, and the types operations
were changed in a backup environment.
To complete this feature, OpsCenter now offers the ability to manage auditing,
monitor audit trails, and view audit trail reports.

Also read the "NetBackup audit trail limitations" topic in Release Notes.

[Schwarzkopf]

Please tell me how to know if my environment haves audit enabled.

[Marianne]

You have not yet told us which NBU version.

[Schwarzkopf]

NBU 7.0 I think (I'm in my home now). - Linux

Regards.

[Marianne]

If auditing is enabled, NBU 7.0.1 will only track policy changes and restore jobs.

Viewing the current audit settings on UNIX/Linux : http://www.symantec.com/docs/HOWTO33304

[RiaanBadenhorst]

You need to have NBAC enabled to really use Audit Trails, otherwise it only shows that the job was cancelled by administrator/root.