Modifying alarms with rules with 5 minute time periods

[Jeremy Mueller]

I'm working on tweaking our alarm settings in Veeam ONE v11. When I went to modify a copy of the default "Possible ransomware activity", it refused to allow me to save the alarm because the rules use 5 minute time periods. The exact error message was "Monitored time period should be more than 15 min."

I've even gone back and opened up the default "Possible ransomware activity" alarm and just tried clicking on the Save button, but I'm still getting this error.

I can set the monitors up to 15 minutes and save them, but not at a 5 minute interval. Is there a way to have the 5 minute interval while being able to modify the alarms (ex: add server exceptions or tweak the thresholds)?

Thanks,

Jeremy

[wishr]

Hi Jeremy,

What data collection mode are you using? You can check that within the VONE settings utility.

Also, is that a flat v11 or v11a?

Thanks

[Jeremy Mueller]

We're using "Optimized for Advanced Scalability Deployment". And we have v11a installed.

Thanks,

Jeremy

[wishr]

I can confirm now that that is the reason. In the Advanced scalability data collection mode, the real-time data collection interval is set to 15 minutes.

If you'd like to change it to 5 minutes, the data collection mode should be also changed, but this may not be the recommended approach for you if the monitored environment is massive. We strongly suggest carefully testing such changes as they will result in significantly increased load and may potentially require adding additional resources to the VONE server.

How many hosts, VMs, VBR servers, and workloads protected by VBR do you have being monitored by this VONE instance?

Thanks

[Jeremy Mueller]

Ok, that's the issue. We're running 100 hosts with a little over 1300 VMs, and one VBR server.

I'll leave it set to Advanced scalability for now, and just use the 15 minute period instead of 5 minutes.

Thanks,

Jeremy

[wishr]

Hi Jeremy,

Thanks for getting back.

That's not that high number of VMs. How many workloads protected by the aforementioned VBR server you are monitoring with that VONE server and what is its current hardware configuration? Did you have an experience with the Typical data collection mode?

[Jeremy Mueller]

I'm not sure how to judge the "workloads protected", but we have 20 VM backup jobs, 6 agent backups, 4 NAS backups, and 5 backup copy jobs. The VONE server is 8 CPU and 16 GB RAM. It averages out to 10% CPU usage and 50% RAM usage.

We never tried the Typical data collection mode, because the contractor that helped us install Veeam told us to use the Advanced mode for our size of environment.

Thanks,

Jeremy

[wishr]

A protected workload is basically a VM, physical machine/server, cloud VM, file share being processed by the VBR server - any bottom-level entity that you can add to a job in VBR

Since the total number of monitored entities is more or less on the edge of the recommendation towards using the typical scenario (which is 1500), you have two options:
1. You may reach out to our technical support team and ask them to modify the database records manually to enable 5 min data collection interval for the real-time VM data. There are some risks associated with that such as database growth speed and server load, but they are not as severe as when you switch the mode completely. Usually, our TS engineers explain all the risks in a detailed manner before applying such changes.
2. You may give the typical data collection mode a try and if the server load and performance remains acceptable, keep it. Otherwise, just switch back - this should not cause any data consistency issues (confirmed by our QC team). Again, keep in mind the risks mentioned in #1.

Probably, I should ask one more question. What's the intention behind changing the alarm to 5 min intervals? What you you are trying to achieve/solve with this change?

Thanks in advance!

[Jeremy Mueller]

I didn't have an intention to change the alarm to 5 minutes, I was just modifying a copy of the alarm to exclude a server. At that point, I couldn't save the alarm due to the 5 minute interval. So I was confirming why that was.

I think we'll try the typical data collection for a week or two and look at the server performance. We can switch it back if we need to. If we do go back to advanced, we'll just use the 15 minute setting on the alarm.

Thanks for your help,

Jeremy