Overview
This article explains how to forward the operating system syslog of a Veritas NetBackup master server or appliance (Linux daemon and system messages such as dbus, systemd, kernel, smbd, and NetBackup's own bpbkarv process) to Logsign Unified SecOps Platform via syslog.
Note: this is a separate integration from NetBackup Integration via API, which pulls NetBackup's own security audit trail (logins, policy changes, configuration changes) through the NetBackup REST API. This syslog integration instead collects the underlying Linux host's own system log, useful for host-level troubleshooting and security monitoring of the master server itself. The two can be configured together and do not conflict.
Prerequisites
- All Logsign versions support this integration.
Configure On Veritas NetBackup
Unverified: the exact steps for forwarding the master server/appliance's system syslog have not been verified against a live NetBackup appliance during this research. Consult Veritas's own appliance/administration documentation for your version.
- On the NetBackup master server or appliance, configure the operating system's syslog daemon (or the appliance's own syslog forwarding setting) to forward system log messages to your Logsign collector's IP address and port.
- Leave the log format at the host's default syslog output (standard BSD syslog or RFC 5424); Logsign's parser recognizes both.
Add Device in Logsign USO
Open the Logsign Unified SecOps Platform web interface and click the + Device button under Settings > Data Collection. In the Source Type Selection page, choose Syslog as the collection method, select Veritas as the vendor, and NetBackup Audit as the product.
| Field | Description |
|---|---|
| Host | IP address of the NetBackup master server/appliance sending the logs. |
| Encoding | utf_8 (default). |
| Offset | Time offset in minutes, if the source's clock differs from the collector's. |
| Data Policy | Filter which incoming logs are kept; Default Policy collects everything. |
| Check Health | Enable to monitor whether the source is actively sending logs. |
| Device Name / Tag | A descriptive name and optional tag for the source, used in search and reporting. |
Click Save to add the source. Once the NetBackup host is forwarding syslog to the configured host/port, events should begin appearing under Search.
Log Format and Supported Events
Logsign recognizes both standard BSD syslog and RFC 5424 structured syslog from the host, for illustration only (not captured live samples):
Dec 22 16:44:23 nbu-master01 dbus[3208]: [system] Successfully activated service 'org.freedesktop.hostname1'
Dec 22 16:28:01 nbu-master01 systemd: Started Session 162611 of user root.Each event carries the generated timestamp, source hostname, the reporting process/daemon name, and the message text. Logsign recognizes specific message patterns such as user login/logout, audit setting changes, policy and database changes, certificate issuance and renewal, and dropped network connections, and classifies them accordingly. Other system messages from the host are still collected and searchable even when they do not match one of these specific patterns.
Verification
- Confirm the source is receiving data under Settings > Data Collection (event count should increase).
- Search for the source's Device Name/Tag under Search to confirm parsed fields (Source Hostname, Event Info, Event Action, etc.) are populating correctly.