Additional PostgreSQL Database Roles Present in NCM After a Restore-from-Backup Operation

Products

• Network Observability

Issue/Introduction

After comparing PostgreSQL role listings (\du) across multiple NCM environments running the same product version, additional database roles are found in one environment that do not exist in the others.

The extra roles observed are: adhoc, compliance_advisor, migration, network_advisor, pgdbaset, scheduler, and voyence_web.

All environments are on the same NCM version and use the same Application Server (AS) to Data Server (DS) architecture, which raises the question of why the role sets differ.

Environment

• Product: CA/Broadcom Network Configuration Manager (NCM)
• Component: PostgreSQL database (voyencedb)
• Affected setup: Environments provisioned via database restore-from-backup (e.g., a Disaster Recovery instance)

Cause

NCM's database restore utility, used to populate a database from a backup image, provisions a fixed set of PostgreSQL roles as part of the restore process. This role set includes several roles tied to legacy NCM modules and internal maintenance functions that predate the current release — compliance_advisor and network_advisor (older, since-consolidated advisory modules), voyence_web (a legacy web-tier schema owner), scheduler and adhoc (job execution roles), migration (used during internal database maintenance routines), and pgdbaset (an additional administrative role created alongside the others during restore).

A fresh installation of NCM does not go through this restore process, so it only creates the current, minimal role set (voyence, archive, dbutil, pgdba, voyence_ro, and any roles an administrator creates manually).

When an environment such as a DR instance is built by restoring a backup image rather than by fresh installation, the restore utility creates this broader legacy role set regardless of whether the backup content actually uses those roles. This is why environments that are otherwise identical in version and architecture can end up with different PostgreSQL role listings depending on how each one was provisioned.

Resolution

This is expected behavior of the restore-from-backup process and does not indicate a configuration error or a compromised environment.

1. Confirm that all affected environments are running the intended NCM version and that application functionality is working as expected.
2. Document that the extra roles (adhoc, compliance_advisor, migration, network_advisor, pgdbaset, scheduler, voyence_web) are a normal byproduct of the backup-restore provisioning path and are not indicative of unauthorized account creation.
3. No changes to these roles are required. They are part of the standard set of accounts created by the restore utility and support internal product functionality.