Audit what admin started a particular job

[MrTomahawk]

Is there a way to find out which admin kicked off a paricular back or restore job? I looked in the C:\Users\All Users\Veeam\Backup folder and I see logs for each of the jobs and can open a log to find out loads of more info then whats found in Report or Statistics, but even then it logs the job being started from the service account asscoiated with the job instead of logging the admin which actuallly kicked the job off.

[Vitaliy S.]

Hello Craig,

In the upcoming version of Veeam ONE (part of Veeam Backup Management Suite) there will be a report called "Restore Operator Activity" that will give you information on all types of restores performed by the backup operators with the exact times and restore points used.

As to the backup/replication jobs start information, can you please tell me the use case you need this data for? Don't you use job schedulers to start your jobs?

Thank you!

[MrTomahawk]

We do use scheduled jobs, however whenever we discover any issues that may have occurred we often do an ad-hoc backup, and then there's restores which are never scheduled.

[Vitaliy S.]

Ok, thanks for clarification...so the report showing all details about restores occurred should be exactly what you are after.

[veremin]

For now the following one-liner might be helpful:

Code: Select all

Asnp VeeamPSSnapin 
Get-VBRRestoreSession |  where {((Get-Date) - ($_.CreationTime)).totalhours -le "24"} |Sort-Object Creationtime | Select name, CreationTime, {$_.Initiator.name} 

This script will output all “Full VM” restore sessions (that occurred during last 24 hours) along with the name of restored VM and name of restore initiator.

Unfortunately, with the current product version Get-VBRRestoreSession method is restricted to full VM restore sessions. Nevertheless, this behaviour will be fixed in the upcoming release, where it's possible to track other restoration activities via PS.

Thanks.

[MrTomahawk]

Thanks, is there a similar Powershell command I could use to get back the initiator of any non-scheduled backups? Does have to be while the backup is in process? Thanks again

[veremin]

You can use the following one-liner in order to get similar information:

Code: Select all

Asnp VeeamPSSnapin 
Get-VBRBackupSession | where {((Get-Date) - ($_.CreationTime)).totalhours -le "24"} |Sort-Object Creationtime | Select name, CreationTime

However, please be aware that backup session doesn’t have an initiator name parameter, thus, the script will only output name and creation time of corresponding backup sessions.

Thanks.

[masonit]

Hi

Tried this but it doesn't show who started the job. Isen't this registered anywere?

\Masonit

[Vitaliy S.]

According to Vladimir this script shouldn't return the name of the job initiator:

please be aware that backup session doesn’t have an initiator name parameter

BTW, this info is not exposed in the UI as well, but thanks for the feedback. I will verify if it is easy to add this capability to the Windows Event log of the backup server.

[masonit]

According to Vladimir this script shouldn't return the name of the job initiator: BTW, this info is not exposed in the UI as well, but thanks for the feedback. I will verify if it is easy to add this capability to the Windows Event log of the backup server.

Ok sorry missed that.

Yes that would be great! It is a must for us to be able to track, who does what...

\Masonit

[kennyt2000]

Hi Guys,

did you ever come up with a way to audit who started a backup job?

Thanks

[Vitaliy S.]

Yes, to audit this you need to navigate to Windows Event log on the backup server -> Veeam Backup - > and search for an event with ID 110 which does have job initiator name in its details. Thanks!

[egrigson]

I've just checked the Veeam event log and while there is a 110 event it simply states 'Backup job xxxx has been started' - there is no mention of the job initiator. In the user field it says 'N/A'. This is the case for every event 110 on my Veeam server, regardless of whether it was scheduled or started manually. I'm using v7 u4.

Any other ideas?

[Vitaliy S.]

Hi Ed,

Did you trigger your job manually or by schedule?

Thanks!

[masonit]

Same here. It only say N/A. I triggered the job manually. I am logged in on the backup server with a account from another trusted domain.

\Masonit

[Vitaliy S.]

Magnus, are you using Veeam B&R v8 or v7 patch 4?

[masonit]

None of them, ver 7.0.0.839. Maybe patch 4 is required?

\Masonit

[Gostev]

Sure.

[egrigson]

Sorry for the delaying in replying, I was out of the office for a week.

I get the same 'N/A' under the user field whether the job is started manually or via a schedule, so I've still not found a way to audit who started a job. I'm on v7 u4.

Ed.

[Vitaliy S.]

I have re-checked everything again and it seems like I have dlls with different build number compared to patch 4 version, sorry for the confusion. As to the user name displayed in the event log, then it is logged in the description of this event in Veeam B&R v8.

[masonit]

Is it possible to see who has changed something in Veeam.? Ex someone made a change to retention in a job.

\Masonit

[veremin]

Job Configuration Change Tracking report seems to be the way to go. Thanks.

[ftbug]

Hi, it may be a long shot, but i was wondering if it is possible to check in any sort of logs to see who and when a schedule for a certain job was created/edited?

I know when a job is created that the timestamp and user is saved in the description, however, it would be handy to have some further details/logs of other things that have been edited within the job

kind regards

[veremin]

Check the abovementioned report and see whether it answers your requirements. Thanks.

[ftbug]

Will this provide historical data? or just the data after veeam one has been installed and configured?

[Vitaliy S.]

The second variant. Backup data for the change tracking report will be collected after Veeam ONE installation. Once you do this, all historical information will be stored in Veeam ONE database, so that you can get back to it at any time.

[ftbug]

Okay great, thanks