We have a customer group (Oracle DBA's) who refuse to let the NetWorker server 
run their
backups.  They have scripts that perform the Oracle backups then run a save 
command from the
scripts to send the backups into NetWorker.

For the past two days, I've been trying to help them track down how they are 
getting deleted.
The first day, I set up a cron job that used mminfo and verified the existence 
of the saveset
every hour.  The saveset that had been written at 6am with a browse time of 1 
year and a
retention of 7 years disappeared between 2pm and 3pm.  The second day, I 
checked every two
minutes between 2pm and 3pm and the saveset that had been written that morning 
was deleted
between 2:34pm and 2:36pm.

Now, I was running a tcpdump during this time catching all traffic to the ports 
that nsrexecd
was listening to on the NetWorker server (assuming that whatever client is 
doing this delete
would be talking to nsrexecd to do it).  I found a single one of their machines 
that was
talking during the whole time -- but the DBA's are insistent there was no 
script that was
running in that two minute window that "should" have deleted the saveset.

Is there a way that I can get NetWorker to log when a saveset is deleted?  I'm 
assuming that
some script somewhere is running an nsrmm command (Thus, the NMC logging is not 
going to help
me here).  Is there any other command that could be run that would delete a 
saveset?

The server is running 7.5.3.4 on Red Hat Enterprise Linux 5 (64-bit) -- if that 
makes any
difference in the answer.  The client I think is guilty is running AIX 5.3 and 
NetWorker 7.3.3.

Thanks,

-- 
Frank Swasey                    | http://www.uvm.edu/~fcs
Sr Systems Administrator        | Always remember: You are UNIQUE,
University of Vermont           |    just like everyone else.
  "I am not young enough to know everything." - Oscar Wilde (1854-1900)

To sign off this list, send email to listserv AT listserv.temple DOT edu and 
type "signoff networker" in the body of the email. Please write to 
networker-request AT listserv.temple DOT edu if you have any problems with this 
list. You can access the archives at 
http://listserv.temple.edu/archives/networker.html or
via RSS at http://listserv.temple.edu/cgi-bin/wa?RSS&L=NETWORKER