NetBackup Integration via API

Purpose

This guide explains how to locate or generate each configuration value your NetBackup master server administrator needs to provide, and how Logsign USO uses them to ingest Veritas NetBackup security audit logs (logins, policy changes, configuration changes, and other administrative actions) via the NetBackup REST API.

NetBackup is an on-premises enterprise backup product. Unlike SaaS integrations, there is no vendor-hosted tenant to register with: the API host is your own NetBackup master server, reachable only from your network.

Prerequisites

You need network reachability from the Logsign collector to your NetBackup master server on TCP port 1556 (HTTPS). No public internet access is required or used; this is a fully on-premises, direct connection.

You need a NetBackup user account that can authenticate through your environment's configured authentication domain (NetBackup Access Control / NBAC, or local OS accounts) and that has permission to view security audit records. Logsign recommends a dedicated service account with read-only/audit-viewer privileges rather than a full administrator account.

Step 1: Identify Your Master Server Address

This is the hostname or IP address of your NetBackup master server, the same one your NetBackup administrators use to reach the NetBackup Web UI or CLI. Logsign automatically appends the fixed API port (:1556) and HTTPS scheme, so enter only the hostname or IP, for example nbu-master01.acme.local.

Step 2: Determine Your Authentication Domain Type and Domain Name

NetBackup authenticates API logins against a configured identity domain, the same mechanism used for NetBackup Access Control (NBAC). Your NetBackup administrator determines the correct values from your existing authentication configuration:

• Domain Type: commonly vx (NetBackup's own local/NIS+ authentication), NIS, or unixpwd (native OS user/password), depending on how your environment is configured. This value is environment-specific; it is not something Logsign can guess. Your NetBackup administrator can confirm the configured authentication domains from NetBackup Web UI > Security > Authentication, or via the vssat showpdauthdomains command on the master server.
• Domain Name: the specific domain identifier tied to the Domain Type above (for example, your NIS domain name, or the local NetBackup domain name).

Step 3: Obtain a Username and Password

Request a NetBackup account (or have one created) with permission to query security audit records. This is the Username and Password Logsign will use to log in and obtain an access token on the first poll.

Step 4: Choose the Audit Category to Monitor

NetBackup organizes audit records into 23 categories. You choose one Category ID per Logsign data source; to cover multiple categories, configure multiple data sources against the same master server, each with a different Category ID.

Note: Logsign's built-in event library for this poller currently recognizes operation values (CREATE, MODIFY, DELETE, START, STOP, CANCEL, RESUME, ACCESS) associated with category 1 (POLICY). If you select a different category, events are still ingested and normalized, but fall back to a generic Identity/User/Info classification rather than a category-specific one.

Step 5: Configure the Integration in Logsign USO

Log in to Logsign USO and add a new NetBackup data source. You will be asked for:

Logsign logs in to your master server's REST API (POST /netbackup/login) to obtain an access token automatically on the first poll, and re-authenticates whenever the token expires (tokens are valid 24 hours per Veritas's documentation) or is rejected. You do not need to generate or refresh a token yourself. Logsign then periodically queries the NetBackup Security API (GET /netbackup/security/auditlogs) for new audit records in your selected category, using the record's auditTime as the sync cursor, and normalizes each record's operation, message, reason, and acting user into a Logsign event.

Notes and Limits

• This integration is on-premises only by design: the "Base URL" is your own master server, not a Veritas-hosted endpoint. There is no cloud/SaaS variant of this connection.
• This poller covers security audit records only (who did what, and when, within NetBackup administration). It does not cover backup job status/completion logs (success/failure of individual backup jobs); that data lives under a different NetBackup API surface and is not part of this integration.
• Known limitation, unverified against a live system: a review of this integration found that it currently sends the audit query's time-range and category filters as an HTTP request body on a GET call, whereas Veritas's official API reference defines these as URL query parameters. If your NetBackup REST layer disregards body content on GET requests (as many REST implementations do), these filters may not take effect as expected. If you notice that returned audit records do not appear to respect the expected time window, please contact Logsign support so this can be verified against your environment.
• Known limitation, unverified against a live system: the integration does not currently set NetBackup's datalimit parameter or check the isDataTruncated response flag, and does not paginate. In environments with very high audit volume within a single poll interval (Veritas's documented default page size is 500 records), records beyond that limit may not be retrieved. If you run a large, high-activity NetBackup environment, consider a shorter poll interval and/or narrower category scoping, and contact Logsign support if you suspect missed records.
• If polling stops and the source logs authentication failures, first check with your NetBackup administrator whether the service account's password was changed or the account was disabled, and whether the configured Domain Type/Domain Name still matches your NetBackup authentication configuration.