This guide will help you configure Naverisk to monitor Veeam backups. It should be read in conjunction with http://kb.naverisk.com/en/articles/2810682-backup-monitoring which describes the backup monitoring capabilities of Naverisk in more general terms.
This guide has been written and tested using the Veeam Agent for Windows, however it is also applicable for monitoring a central Veeam server, in which the event log name needs to be changed but all other settings remain the same.
Determining Veeam Event Log entries
Veeam backup writes all events into an application event log called Veeam Agent (if using the Windows agent) or Veeam Backup (if using a Veeam server).
Three event log entries are created that are used for monitoring backups.
Backup Started
This entry is created each time a backup job is started, and has the event ID of 110, and a log level of Information. If the job does not run, no entry is created.
2. Backup Successful
This entry is created when the backup job completes successfully. The event ID is 190 and the log level is Information
3. Backup Failed
Should the backup job fail for any reason, a log entry is created, also with ID of 190, however the log level is Error.
We will use these three events to create monitoring in Naverisk that will create tickets if a backup does not start or if it starts and fails. It will also maintain the history of successful and failed backups for reporting purposes.
Creating a Device Role
To provide correct alerting and reporting, the monitoring must be configured in a Device Role, and not by configuring the event log rules on an individual device. A device role template for Veeam Backups is available on our routine store, however we will discuss the procedure for creating one below. It is recommended that you read these steps even if you plan on importing the template, so you understand the settings used.
Create a new Device Role under Settings and give it an appropriate name (eg Backups – Veeam). You will then need to add Monitored Event rules for the three Event Log entries created by Veeam, described above.
Backup Start – This rule will check that the backup job starts as scheduled
Add a new event rule, and configure it as follows:
Event Source: Veeam Agent or Veeam Backup as applicable
Event Type: Information
Event ID: 110
Event Description allows matching of text in the event description, it is not required for Veeam backup monitoring.
Set the SLA Class to Backup. This class will only generate a ticket if the SLA status is Failure, and also allows reporting history to be kept.
SLA Status: Failure – we are checking for backups that do not run, so we want an alert to be generated.
Set the Ticket Group and Ticket Trigger Text to your preferences.
Reporting Status: None – if the backup does not run, we want a blank entry for that day in the report, to indicate no backup was made
Tick Timed Event. When this is enabled, a ticket is generated if the event (backup started) is not received during the time window specified. If the backup starts and generates the event, this is detected, and no ticket is generated.
Set the desired start and end time. This should encompass the scheduled start time of the backup job, with some margin before and after to allow for any difference in system time. Note that it is not necessary to cover the entire backup period, just the time is should start. Note that the start and end time must not cross 12:00am eg Start 11:30pm, End 12:30am.
If a backup job is started outside the specified time period, a ticket will be generated to warn you of an unscheduled backup starting.
2. Backup Successful – this rule checks for successful completion. A ticket is not generated, however the event is recorded for reporting.
Add a new event rule, and configure it as follows:
Event Source: Veeam Agent or Veeam Backup as applicable
Event Type: Information
Event ID: 190
SLA Class: Backup
SLA Status: Information
Reporting Status: Success
3. Backup Failed – this rule checks for failed backups and generates a ticket. The event is also recorded for reporting
Add a new event rule as follows:
Event Source: Veeam Agent or Veeam Backup as applicable
Event Type: Error
Event ID: 190
SLA Class: Backup
SLA Status: Failure
Ticket Trigger Text: Backup Failed, or similar, to your preference.
Reporting Status: Failure
Save the Device Role, and copy if necessary to your clients. Add the role to the Device Profiles or individual devices as required.
With the monitoring in place, the following results will occur:
Monitoring backups that are taking too long
In some cases it is useful to know if a backup has not completed within the desired timeframe – for example a backup still running when business hours start could impact system performance. If required, an additional event rule can be added to generate a ticket if the backup has not completed within a specified period.
Add a new event rule as follows:
Event Source: Veeam Agent or Veeam Backup as applicable
Event Type: Information
Event ID: 190
SLA Class: Backup
SLA Status: Failure
Reporting Status: None
Select Timed Event and set start time to the scheduled start, and end time to the end of the backup window.
This rule will create a ticket if the backup is still running at the end of the backup window. No ticket is created if the backup completes within the window. The rule does not have any effect on the backup report.
Backup Reports
The rules configured above will result in a backup report showing the backup status for each day as follows:
Success – backup completed successfully
Failure – backup completed with errors
Warning – no backup ran.
