Solved

Alert when backup jobs are deleted


Badge +4

Hi,

I have a customer request where I have some trouble finding a solution. He would like to receive an alert via email as soon as a backup job is deleted (not the data on the clients itself, but the already backed up content) e.g. if an employee is going to leave and would like to harm the company or similar scenario.

 

Is something like this possible without using any third party product?

 

Regards

 

Holger

icon

Best answer by MichaelCapon 21 July 2021, 10:41

Hi Holger,

We do have Commvault Workflows that can be deployed in the CommCell that require authorisation for deletion of entities within Commvault:
https://documentation.commvault.com/11.24/expert/115705_authorizing_requests_on_commcell_entities_using_workflows.html

 

You could also create Custom Alert Rules within the CommCell to email an alert when something is deleted. - There are a few error codes for these events, which can be found here: https://documentation.commvault.com/11.24/expert/130849_system_messages_event_strings_and_error_codes.html
Here are a few (of many) examples:

83:274 MediaAgent successfully deleted.
83:275 iDataAgent successfully deleted.
83:276 Client successfully deleted.
74:309 Deleted
85:1253 Clients deleted [<String>]
35:34 Subclient [<String>] has been deleted.

 

Best Regards,

Michael

View original

4 replies

Userlevel 5
Badge +10

Hi Holger,

We do have Commvault Workflows that can be deployed in the CommCell that require authorisation for deletion of entities within Commvault:
https://documentation.commvault.com/11.24/expert/115705_authorizing_requests_on_commcell_entities_using_workflows.html

 

You could also create Custom Alert Rules within the CommCell to email an alert when something is deleted. - There are a few error codes for these events, which can be found here: https://documentation.commvault.com/11.24/expert/130849_system_messages_event_strings_and_error_codes.html
Here are a few (of many) examples:

83:274 MediaAgent successfully deleted.
83:275 iDataAgent successfully deleted.
83:276 Client successfully deleted.
74:309 Deleted
85:1253 Clients deleted [<String>]
35:34 Subclient [<String>] has been deleted.

 

Best Regards,

Michael

Badge +4

Hi,

 

awesome! Thank you very much.

Badge +4

Hi @MichaelCapon ,

 

I thought I could take a shortcut before browsing through all search results for “delete” in the documentation (about 970 results). So I took a staged environment and deleted a job there. But there is nothing in the event viewer or event report. Aren’t there events if a job is deleted from a storage policy copy (erase and reuse media)?

Badge +4

Hi,

 

I have agreed with the user to focus on limiting the number of users who have the ability to delete jobs instead. As far as I saw the only trace was in the Audit Trail where deleted jobs are mentioned.

 

Thank you very much for your help. The hint with alerts based on events was very useful for an other question from him (warning when certain users log in to the Commcell Console).

 

Regards

 

Holger

Reply