Monitoring and reporting for Veeam Data Platform
Post Reply
albertwt
Veeam Legend
Posts: 879
Liked: 46 times
Joined: Nov 05, 2009 12:24 pm
Location: Sydney, NSW
Contact:

[Veeam ONE Monitor] Alarm - Possible ransomware activity

Post by albertwt »

Hi All,

Just wanted to know if anyone here found out that [Veeam ONE Monitor] Alarm - Possible ransomware activity is really useful or not ?

I get bombarded with false positives daily from multiple different servers every hour so it is not very useful so far in my environment.

Most of the email alert comes from:
Exchange Mailbox server
Remote Desktop Service Host (Terminal Server)
File Server - running deduplication and Robocopy file transfer after hours.

Here's the threshold that I have set:
Image

I wonder if anyone here have found some other way to reduce the number of false positive ?
--
/* Veeam software enthusiast user & supporter ! */
Mike Resseler
Product Manager
Posts: 8044
Liked: 1263 times
Joined: Feb 08, 2013 3:08 pm
Full Name: Mike Resseler
Location: Belgium
Contact:

Re: [Veeam ONE Monitor] Alarm - Possible ransomware activity

Post by Mike Resseler » 2 people like this post

Hi Albert,

// EDITED: Didn't noticed at first that you already made changes. I couldn't see the images first. Did you made the changes on all objects? On a specific scope?

When this alarm was created (new in the latest version) it was tested and fine-tuned against many different setups and environments, but obviously, not against every possible environment that exists in the world :-)

The thresholds are:
For VMware VMs
* Average CPU usage is above 70.0% and datastore write rate is 40 MB/s for 5 minutes. - gives a warning
* Average CPU usage is above 80.0% and datastore write rate is 60 MB/s for 5 minutes. - gives an error
For Hyper-V VMs
* Total run time is above 70% and virtual storage write is above 40 MB/s for 5 minutes. - gives a warning
* Total run time is above 80% and virtual storage write is above 60 MB/s for 5 minutes. - gives an error

Best thing you could do is modify the alarm to make it more suitable for your environment so it doesn't give you the false alarms anymore on those specific servers.
More information on modifying the alarms can be found here: https://helpcenter.veeam.com/docs/one/a ... tml?ver=95
Also, don't forget you can work with scopes to fine-tune the alarm only for those objects: https://helpcenter.veeam.com/docs/one/a ... tml?ver=95

Hope it helps

Mike
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: [Veeam ONE Monitor] Alarm - Possible ransomware activity

Post by Shestakov » 1 person likes this post

Hi Albert,
Mike is spot on. If you have a disturbing number of false positives it`s recommended either to raise the thresholds (as you did) or disable the alarm.
However the fact you have average CPU Usage > 90% for 10 minutes should warn you without any possible ransomware activity :)
Thanks!
albertwt
Veeam Legend
Posts: 879
Liked: 46 times
Joined: Nov 05, 2009 12:24 pm
Location: Sydney, NSW
Contact:

Re: [Veeam ONE Monitor] Alarm - Possible ransomware activity

Post by albertwt »

I ended up disabling this alarm since I always getting this false positives despite I raised them to Warning: 90% for 15 minutes.

Certain Terminal Server, Exchange Mailbox server and even Network Virtual appliance VM is reported by this alarm.
--
/* Veeam software enthusiast user & supporter ! */
Shestakov
Veteran
Posts: 7328
Liked: 781 times
Joined: May 21, 2014 11:03 am
Full Name: Nikita Shestakov
Location: Prague
Contact:

Re: [Veeam ONE Monitor] Alarm - Possible ransomware activity

Post by Shestakov » 1 person likes this post

Thanks for that feedback, Albert.
Apart from ransomware alarm, what about CPU Usage alarm, does it also trigger often because of the high CPU utilization?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: [Veeam ONE Monitor] Alarm - Possible ransomware activity

Post by Vitaliy S. » 1 person likes this post

Albert, instead of disabling this alarm, I would suggest to make exclusions based on the time of the day (when you have an expected high load on the VMs).
Post Reply

Who is online

Users browsing this forum: No registered users and 9 guests