View backup anomalies
NetBackup can now detect anomalies in backup metadata. It can detect any unusual job data in the data backup flow. For example, it can detect a file count or a file size that is different than the usual count or size.
Consider the following example:
An anomaly of the image size type is displayed as 100MB (Usual 350MB, 450MB). This information implies that the current image size that is reported as anomaly is 100 MB. However, the usual image size range is 350 MB - 450 MB that is derived from the analysis of past data. Because of the significant difference between the current image size and usual image size range, NetBackup notifies it as an anomaly.
See About backup anomaly detection.
Note:
Anomaly count of 0 indicates that there are no anomalies generated or that the anomaly detection services are not running.
To view backup anomalies
- In the NetBackup web UI, select Detection and reporting > Anomaly detection > Backup anomalies.
The following columns are displayed:
Job ID - ID of the job for which the anomaly is detected
All child jobs and the associated anomaly details are also shown when you expand the parent job.
Severity - Severity of the anomalies that are notified for this job
Asset name - Name of the NetBackup client where the anomaly is detected
Summary - For the parent job, details like types of anomalies, number of anomalies, and increase or decrease in the number of anomalies are shown.
For child jobs, types of anomalies are shown, such as Database corruption.
Anomaly type - Type of the anomaly such as Image entropy, Job metadata, Suspicious file extension, Client offline
Backup selection - The backup selection (client or file to be backed up) that is specified in the policy
Policy name - The policy name of the associated backup job
Policy type - The policy type of the associated backup job
Schedule type - The schedule type of the associated backup job
Impacted number of jobs - The number jobs for which anomalies are detected
Review status - The anomaly status that indicates whether the detected anomaly is reported as a false positive or an actual anomaly, or it can be ignored.
Last updated - The date and time when the anomaly status is updated
- Select the job ID to see the job details in the Activity monitor. Expand a parent job to see the details of each child job.
- You can perform the following actions on the anomaly record:
Select Report as false positive if the anomaly is a false positive. Similar anomalies are not shown in the future.
The Review status of the anomaly record appears as False positive.
Select Confirm as anomaly when you want to take some action on the anomaly condition.
The Review status of the anomaly record appears as Anomaly.
Select Mark as ignore when you can ignore the anomaly condition.
The Review status of the anomaly record appears as Ignore.
Select View modified files to view the files that changed in an anomalous backup job. You can view the files that changed relative to the anomalous backup date, filtered by a selected time frame. You can download the results as a CSV for deeper analysis in your security tools.
Note:
The View modified files option is available only for entropy-based anomalies on Standard or MS-Windows policies, and only if the backup image has not expired.