I need a solution
Hi, I have a NetBackup 5220 Appliance on 2.5.4 acting as a Media Server.
Every weekend the Netbackup processes get stopped and I have to start them up again on Monday.
The only clue I have found so far is in the SCSP Audit Logs found on the Appliance web page. Would this be the likely reason for the processes getiing stopped? And how do I reeconfigure SCSP to prevent it happening again. I checked the SCSP admin guides found here but there's nothig obvious...
SCSP Audit Logs
| 2014-05-11 11:19:50 BST | Information | IDS Status | IA_0023: Symantec IDS Service has started |
| 2014-05-11 11:19:50 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/passwd". |
| 2014-05-11 11:19:50 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/group". |
| 2014-05-11 11:19:50 BST | Warning | IDS Error | FWC_0018: Invalid path(s) will not be monitored: /opt/NBUAppliance/scripts/*/* Blank Value |
| 2014-05-11 11:19:51 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/shadow". |
| 2014-05-11 11:19:51 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/gshadow". |
| 2014-05-11 11:19:52 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/user_attr". |
| 2014-05-11 11:19:52 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/security/passwd". |
| 2014-05-11 11:19:52 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/security/user". |
| 2014-05-11 11:19:52 BST | Information | IDS Status | PE_0110: Execute command called: "/opt/Symantec/scspagent/IDS/bin/user_monitor.sh /etc/security/group". |
| 2014-05-11 11:19:55 BST | Notice | SysLog | successful SU to another user Event source: SYSLOG [auth facility] To Username: sisips Port: none Complete message: May 11 11:19:55 xxxxxxmds002bk su: (to sisips) root on none |
| 2014-05-11 11:20:00 BST | Notice | SysLog | successful SU to another user Event source: SYSLOG [auth facility] To Username: sisips Port: none Complete message: May 11 11:20:00 xxxxxxmds002bk su: (to sisips) root on none |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (103 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/client_configure.pl |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (121 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/nbapp_client.pm |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (114 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/nbapp_nbutils.pm |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (179 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/nbapp_storage.pm |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (145 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/nbcplogs.pl |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (118 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/nbu_sf.pm |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (119 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/patch.pl |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (124 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/util.pm |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (3007 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/Intel_RAID_1.41.372-2527_Installer.pl |
| 2014-05-11 11:20:02 BST | Warning | IDS Error | FWC_0023: File too big to perform diff (3005 Kb < 100 Kb limit): /opt/NBUAppliance/scripts/LSI_RAID_1.40.342-1650_Installer.pl |
| 2014-05-11 11:20:14 BST | Warning | File Watch Unix | Watched File Modified (/etc/sysctl.conf) |
| 2014-05-11 11:19:55 BST | Information | Agent Status | Starting Symantec Critical System Protection Service 5.2.8.164 |
| 2014-05-11 11:19:55 BST | Notice | Agent Status | Management Server URL : https://127.0.0.1:443/sis-agent/ |
| 2014-05-11 11:19:58 BST | Warning | Common Status | Curl Error: Verify the agent certificate matches the server.. |