"Suspicious Backup Size" and "Unusual Job Duration" Notifications

[GenDev]

Hey everyone...

I'm playing around with adding our backup infrastructure to Veeam One for monitoring. I'm not sure if I have something misconfigured but we get "Suspicious incremental backup size" and "Unusual job duration" notifications almost nightly. Well, warning/errors and then resets. We do have occasional full backups configured on several of our VMs, which these notification seem to coincide with those. Obviously, I can modify the thresholds but I would have to modify them to the point that it would make the warnings pretty much useless.

Is there a way around this (without disabling the notifications) or is this just how it works?

Also, just to clarify, I did check and these notification aren't related to ransomware or any other issues.

[wishr]

Hi GenDev,

For both of these alarms, full backups should not cause this behavior. What kind of full backups you have configured?

Full backups are not taken into account in the suspicious incremental backup size alarm. This alarm analyses only the sizes of the previously created incremental backups and notifies you if the size of a newly created incremental backup significantly differs from the previous incremental backups.

Regarding Unusual job duration, it is also "relative" and also does not take into account full backups. It analyses previous incremental backup job runs and assesses their duration. If the duration of a new run significantly differs from the previous job runs, the alarm triggers.

Could you please open a support ticket to get these issues investigated and share your case ID? We are interested in getting to the bottom of these issues.

Thanks

[GenDev]

Thanks for the info. I'll get a case opened.

Do health checks have an effect on either warning?

EDIT: Forgot to mention, these jobs are setup with incrementals and weekly active fulls.

[wishr]

Welcome!

Health check does have an impact on the "Unusual job duration" alarm only. This is a known behavior and we are planning to address it in the long term. It requires significant cross-product changes.

Thanks