Rescan Protection Group - MSI Installer Running Each Time

[sixarm]

Hi,

We've recently upgraded our VBR to v12 (v12.0.0.1420 P20230412) and have a Protection Group covering some Azure VMs with the Veeam Agent installed. The Protection Group is configured to perform a rescan every day at 07:30. We monitor these servers using Nagios XI and one of the things we monitor is for IoCs, which includes MSI installers. Each day around 07:30 we are now seeing an alert trigger for these Windows servers with the Veeam Agent installed. This wasn't happening with v11.

If we open Event Log and filter the Application log with the source of MsiInstaller and Event ID 1040 we can see this:

Beginning a Windows Installer transaction: C:\Windows\Veeam\Backup\Upload\7d46583f-dd03-4a8c-943d-61d950f2ad9b\VeeamTransport.msi. Client Process Id: 4048.

Should the MSI be running upon each rescan?

Thanks in advance.

[Dima P.]

Hello David,

Thank you for your post! Just a quick question - you are using regular agent installation to protect your Azure VMs, right (not the new cloud-native agent from v12)?

[Dima P.]

David,

We've discussed this issue with QA team too. They suspect this to be a bug or configuration issue, but in order to understand the root cause can you please raise a support ticket and share the case ID with us (we would need some debug logs)? Thank you!

[sixarm]

Hi Dmitry, thanks for the replies.

Correct, these are regular Veeam Agent for Windows protected servers having come from v11. I've not looked at the cloud-native agents in v12 yet.

I have raised support ticket: Case #06031884.

Many thanks!

[Dima P.]

Thank you, asked QA team to look at the case!