Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  2. NetBackup™ Commands Reference Guide
  3. Appendix A. NetBackup Commands
  4. nbshvault
NetBackup™ Commands Reference Guide

Name

nbshvault — performs the data vaulting operations according to the Sheltered Harbor specification

SYNOPSIS

nbshvault -h | --help

nbshvault -b [filename] | -b filename [--force] | -b [filename] [--config-dir config-dir-path] [--force]

nbshvault -r [filename] | -r [filename] [--config-dir config-dir-path]

nbshvault --report | --report -n | --report -n number[--config-dir config-dir-path]

nbshvault --show-config -i institution ID [--config-dir config-dir-path]

nbshvault - register -i institution ID -reg-key registration ID [--config-dir config-dir-path]

nbshvault --attest [-k keyword] -i institution ID [--config-dir config-dir-path]

nbshvault --configure [filename] [--config-dir config-dir-path]

nbshvault --generate-template -path path

nbshvault --export-key -i institution ID -path path [--config-dir config-dir-path]

nbshvault --import-key -i institution ID -key-file filename [--config-dir config-dir-path]

On UNIX systems, the directory path to this command is /usr/openv/netbackup/bin/

On Windows systems, the directory path to this command is install_path\NetBackup\bin\

DESCRIPTION

Use the nbshvault command to perform NetBackup Sheltered Harbor solution data vaulting operations. Possible data vaulting operations include configuration, registration, backup, and restore operations. You can perform these operations in either interactive mode or non-interactive mode.

In interactive mode, you must specify the inputs manually on console. The data vaulting operations are performed using an interactive CLI process.

In non-interactive mode, the inputs are given in a JSON file. The JSON file name is passed as an argument to command line. The data vaulting operation goes into interactive mode if you do not specify the JSON file name in the command.

OPTIONS

--attest

Use this option to attest the backup message with the provided institution ID or the keyword. If the institution ID or the keyword is not provided, attestation is done for the latest backup. If you have provided the config-dir option during configuration, use the config-dir option also to attest the backup message.

-b | --backup

Reads the configuration that is provided in the given backup JSON file and backs up the data as per the Sheltered Harbor compliance specifications. If the file name is not provided, you must provide the inputs when prompted by the interactive CLI process. If you provided the config-dir option during configuration, you must use the config-dir option also to back up the data. Use the force option to continue the backup even if attestation for last backup failed.

--config-dir config-dir-path

Use this option to provide a custom configuration directory to store the solution configuration.

--configure

Use this option to add the configurations that are related to NetBackup, Vault, and KMS from the specified file. If the file name is not provided, you must provide the inputs as prompted by the interactive CLI process. You can also use the config-dir option at the time of configuration to specify the custom path for configuration files.

--export-key

Use this option to copy the attestation message signing key from the NetBackup path to the specified path. If the institution ID and path are not provided you must provide the inputs as prompted by the interactive CLI process. If you provided the config-dir option during configuration, use the config-dir option to copy the signing key of the attestation message from the custom path to the specified path.

--force

Use this option to continue the backup even if attestation for the last backup failed.

--generate-template

Generates the JSON templates for the configure, backup, and restore options. The JSON templates are created at the specified -path location.

-h | --help

Displays the usage of the utility.

-i institution ID

Institution ID of a given financial institution for which you want to configure the solution.

--import-key

Use this option to copy the attestation message signing key from the specified path to the NetBackup path. If the institution ID and key file are not provided, you must provide the inputs as prompted by the interactive CLI process. If you provided the config-dir option during the configuration use the config-dir option to copy the signing key of the attestation message from the specified path to the custom path.

-k keyword

The keyword phrase that was used during the backup for the solution. It is seen in the report option.

-n number

The number of records that are present in the report option.

-path path

The path where the attestation message signing key is exported.

-reg-key registration ID

The registration ID that Sheltered Harbor has provided to each financial institution.

-r | --restore

Reads the configuration that is provided in the given restore JSON file and performs data restoration as per the Sheltered Harbor compliance specifications. If the file name is not provided, you must provide the inputs as prompted by the interactive CLI process. If you have provided the config-dir option during configuration, you must use the config-dir option also to restore the data.

- -register

Use this option to register the institution with Sheltered Harbor using the institution ID and the registration ID provided by Sheltered Harbor. If the institution ID and registration ID are not provided, you must provide the inputs as prompted by the interactive CLI process. If you have provided the config-dir option during configuration, you must use the config-dir option also to register the institution with Sheltered Harbor.

--report

Displays the latest given number of records for backup or restore operation in report. Default number is 10. If you have provided the config-dir option during the configuration, you must use config-dir to display the latest given number of records for backup or restore operation.

--show-config

Use this option to view the configuration of given institution ID in Sheltered Harbor solution. If you have provided the config-dir option during configuration, you must use the config-dir option also to view the configuration for a given institution ID.

EXAMPLES

Example 1: Perform the backup operation.

nbshvault -b
This command backs up the data as per the Sheltered Harbor compliance 
specifications. Do you want to continue? [y,n] (y)
Enter the institution ID provided by the Sheltered Harbor:
Enter the input storage path:
Enter the transfer storage path:

Example 1: Perform the restore operation.

nbshvault -r
This command performs data restoration as per the Sheltered Harbor 
compliance specifications. Do you want to continue? [y,n] (y)
Enter the institution ID provided by the Sheltered Harbor:
Enter the recovery storage path:
Enter the restored data storage path:

Feedback

Was this page helpful?
Previous

nbsetconfig

Next

nbsmartdiag

Feedback

Was this page helpful?