Understanding sysloging information

[sfaits]

We are currently pushing our Veeam logs to a syslog server and are trying to find explanations of the logging fields so we can filter/create reports/alerting based on the logs.

Are there any KBs that go over this information?

Also when we look at the logging we saw jobs that have IsCorrupted=True but when I look at the same job with Powershell all of the sessions show no corruption (IsCorrupted=False).

Thank you for any assistance on this.

[david.domask]

Hi sfaits,

Training for log analysis isn't publicly documented, and there are a few places in the logs where you'll see "oddities" like that (you will see the isCorrupted=True in a few places temporarily because at the time, the restore point is not usable, but after the operation completes, it's updated to False)

May I ask, what specifically are you hoping to track from the logs? Our Syslog integration forwards Events from a Veeam server and you can ingest backup information directly to your Syslog server from these, and it should be fairly comprehensive (for example there are SureBackup events which can report on SureBackup verification and validation events from SureBackup), so it might make more sense to rely on the events and let Veeam tell you the results of the verifications.

[sfaits]

Thank you for the reply David.domask

I do find the email notifications and the GUI to have all the information I need to monitor and manage the backups but management is hoping to create dashboards based on the logging to allow others to quickly view information on backups such "did x vm get backed up?" "Did that replication complete?" "Are backup copies getting done?" and they are not really interested in getting daily emails.

[david.domask]

Hi sfaits,

You're very welcome. Parsing this information from the logs may not be the best way as the logs will contain multiple sessions per log in most cases, so you'll need to devise some filtering to determine this. Easiest way to tell if a backup/replication task completed is to parse the Task.*.log files on the VBR server for each job. Near the end should be a string like:

[14.02.2025 15:59:03.735] <28> [0016] Info (3) Task session [293649b9-a7a9-4db5-9000-ab6f0fbd2137] has been completed, status: Success, 1,073,741,824 of 1,073,741,824 bytes, 1,048,576 of 1,048,576 used bytes, 5 of 5 objects, details:

The logfile name will include the workload being processed, and you can parse out the status as above.

If it were me, I would actually use some library (e.g., https://www.powershellgallery.com/packa ... essage.ps1) to send SYSLOG information based on data you poll from Veeam. This would let you build custom messages for your syslog server you can build reports on.

Similarly, VeeamOne can export reports as JSON, and you can parse and import these as well.

I would go this route and build it your dashboards with more targeted information rather than validating strings from logs; log formatting changes, while the other options will be structured and more easily parsed, and you don't have to worry about the structure changing/long scan times of the logs.