unix who has initiated the restore

[bill0621]

Hi All,

We have NBU 6.5 in one of our site.(extended support).

In our backup team,we have 25 team members.

Now I as a Backup team manager/Lead needs to know whoch NBU admin out of that 25 team member has initiated the restore.

i have the job id with me only.and the job details.

NBU 6.5.6

Solaris.

we have different user id  for all those 25 NBU admin.

eg .Rick stone   :NBU user id : q121321

     Travez nicole :NBU user id :q121322

and so on

Any help will be appreciated.

[RamNagalla]

if they triggred the restore from GUI, there will be an opiton to save the progress log, if the person do not change the default log location at the time of restore they will be located in below location

go to /usr/openv/netbackup/logs/user_ops/

there you will find the user id who tired to access the Masterserver using the java console.

look into each user id/logs folder and find the restore job details and logs..

[bill0621]

There are 25 NBU admin.there are 25 entries for this.

I have to manually look for each id?

Or is there any other method?

https://www-secure.symantec.com/connect/forums/logs-find-out-who-changed-things-netbackup
 

[Marianne · Accepted solution]

You can probably use 'find' command to see which user had updated log files. 
restore logs will be created under /usr/openv/netbackup/logs/user_ops/<user-name>/jobs

e.g. 
find /usr/openv/netbackup/logs/user_ops -mtime 0 
will look for files modified today.

find /usr/openv/netbackup/logs/user_ops -mtime -1 
will look for files modified since 1 day ago.

You can also try bprd log.
browse and restore activities are logged here along with user name.
Have a look at the bprd log in this TN http://www.symantec.com/docs/TECH3733 :

17:40:16 [21028] <2> restorefiles:    requesting_user = root
17:40:16 [21028] <2> restorefiles:    requesting_group = other
17:40:16 [21028] <2> restorefiles:    progress_file = /bplog.rest.007

This TN is VERY old... these days the progress file is written under user directory in user_ops.