Actions that are audited

When auditing is configured in a NetBackup environment, the following NetBackup user-initiated actions are recorded and available to view in an audit report:

Actions that change the NetBackup configuration

Policy creation, deletion, and modification, for example.

Actions that change NetBackup runtime objects

These are the user actions that include the following:

Initiating a restore job
Changing the audit settings
Starting or stopping the audit service (nbaudit)

Note:

By default, changing the audit settings or starting and stopping the audit service is audited, even if auditing is disabled.

The following actions are not audited and do not display in the audit report:

Any failed actions.

Failed actions are logged in NetBackup error logs. Failed actions do not display in audit reports because a failed attempt does not bring about a change in the NetBackup system state.
The ramifications of a configuration change.

The results of a change to the NetBackup configuration are not audited. For example, the creation of a policy is audited, but the jobs that result from its creation are not.
The completion status of a manually initiated job.

While the act of initiating the job is audited, the completion status is displayed in the Activity Monitor.
Internally initiated actions

NetBackup-initiated internal actions are not audited. For example, the scheduled deletion of expired images, scheduled backups, or periodic image database cleanup is not audited.