[V13] Veeam Linux Appliances: Agent installation, Third party software support

[albertwt]

Hi Veeam Team,

With the recently released Veeam Software Linux Appliance for Veeam Backup & Replication 13 [https://www.veeam.com/products/data-pla ... a-download],

Is the installation of agents for infrastructure visibility, utilisation monitoring, Endpoint Detection and Response (EDR), and Vulnerability Management and Patching supported?

Any help and explanation would be greatly appreciated.

[Gostev]

Hi, Albert.

No, generally we do not support installing any 3rd party software on a software appliance.

While in some cases reasonable unavoidable exceptions will have to be made (such as drivers for some newest hardware), the no-support statement is especially true for intrusive software such as real-time threat monitoring. Because the presence of such software has been a constant pain in Customer Support for our Windows-based software (and is in fact one of a few main reasons for creating a software appliance).

I like to refer to software appliance as "Pre-build, Pre-hardened and Predictable" with the latter specifically thanks to the appliance being completely self-contained. While with intrusive 3rd party software, it becomes completely unpredictable.

Thanks

[albertwt]

Thank you, Anton, for confirming and clarifying this matter. It makes more sense to avoid any issues when installing the third-party agent on the Linux appliance.

Concerning disk space utilisation and uptime monitoring, I assume that the Veeam Linux appliance can be monitored using Veeam ONE.

However, if the client does not have a Veeam ONE license, what solutions can be implemented to prevent disk space or uptime issues?

[Gostev]

For end users, you're right that our solution for backup server monitoring is Veeam ONE. So this is THE solution to implement for clients for whom monitoring is important enough in their data protection strategy. Veeam ONE is included in all but one edition (Foundation) so most of our customer do actually have a Veeam ONE license... some may just not realize that it is included in their Veeam Essentials license.

For managed clients where you act as an MSP, we also offer Veeam Service Provider Console.

[sdv]

@Gostev,
Customers that have Enterprise Plus are now part of Veeam Data Platform Foundation edition (or secure foundation) and there is no Veeam ONE for them.
Meaning, as you say, they can't properly monitor the VBR environment.

For those customers - what other monitoring solution w/o third party installations allowed to monitor the appliance properly? Powershell / API's perhaps?
Or should they stick with Windows + VBR V13 + their own monitoring solution (for cpu/disk/mem etc) ?

Come to think of:
- Will there be VBR software for Linux (not specific appliance)? E.g. the customer can use third party tools as they like (e.g. monitoring) and harden has they like?
- Do customers need to move to the appliance within a few years (V14 ?)

[Gostev]

Sure, PowerShell is still available to use with VSA, I just can't imagine building and maintaining their own monitoring solution will be cheaper than paying that delta between Foundation and Advanced to get access to Veeam ONE (among other things).

1. There might but not for general public as we will need to replicate and maintain such customer's environment (Linux flavor, their custom hardening settings and 3rd party software) in our QA labs and test every next version against it to ensure compatibility. These added costs can be absorbed for high 7-digit deals but not for smaller customers.

2. There are currently no plans to discontinue installable software for Windows.

[chris.childerhose]

Hi, Albert.

No, generally we do not support installing any 3rd party software on a software appliance.

While in some cases reasonable unavoidable exceptions will have to be made (such as drivers for some newest hardware), the no-support statement is especially true for intrusive software such as real-time threat monitoring. Because the presence of such software has been a constant pain in Customer Support for our Windows-based software (and is in fact one of a few main reasons for creating a software appliance).

I like to refer to software appliance as "Pre-build, Pre-hardened and Predictable" with the latter specifically thanks to the appliance being completely self-contained. While with intrusive 3rd party software, it becomes completely unpredictable.

Thanks

Is there a KB or some for of documentation for this statement? I ask because I have deployed the VSA and JeOS VMs in a protected government workload and in order to pass auditing we need written proof that things such as Carbon Black cannot be installed on the appliances. It is a CYA thing.

[Gostev]

@tpayton could you create a KB please?

[chris.childerhose]

Thanks Anton. Awaiting KB patiently.

[tpayton]

@tpayton could you create a KB please?

https://www.veeam.com/kb4772 has been published.

[chris.childerhose]

Thanks for the KB @tpayton

[sheru]

I think extending SNMP monitoring to allow CPU, Memory, Network & Disk Utilization monitoring would be very helpful, especially as more infrastructure components are gonnabe available through similar pre-build software appliance (Veeam Infrastructure Appliance)

[garypigott]

SNMP has had security weaknesses in the past though. Personally, I'd rather SNMP stays off, but maybe have proper h/w monitor alerting via Veeam's emails. Hopefully Veeam will release aa standalone Linux application later, so we don't have to use VSA. We have a company standard hardened Ubuntu build here. I'd rather run the Linux Veeam application on that, and have it tweaked to my specific requirements.

[poulpreben]

Would it be feasible to install the Prometheus/OpenMetrics “node exporter”? The OpenMetrics protocol seems to be the standard choice for modern applications and appliances. It is already widely supported by many monitoring systems, and it even supports token authentication.

[Gostev]

We will certainly be looking at what makes sense to pre-install on VSA in future versions so any feedback is welcome. As always, best in form "what are you trying to achieve" or "what added VSA capabilities are you looking to get" vs. just "please pre-install software X".

[DE&C]

I would prefer if there were a built-in solution and Veeam simply integrated it into their REST APIs, so we could easily query the values directly.

In my view, SNMP is not a viable solution due to security risks, and emails are insufficient for automation.

[poulpreben]

As always, best in form "what are you trying to achieve" or "what added VSA capabilities are you looking to get" vs. just "please pre-install software X".

That's a fair point.

Our primary concern with JeOS appliances, including the VBR one, centers around lack of monitoring capabilities across our environments. We've found that having visibility into CPU, RAM, network, and disk usage is absolutely essential for maintaining healthy backup infrastructure. Under-sized backup servers have consistently been the root cause of various performance issues we've encountered, and having these metrics have been tremendously helpful in identifying regressions post upgrades.

While Veeam ONE works well as a standalone solution, we're really looking for built-in monitoring capabilities that would help us proactively manage performance without requiring additional infrastructure components (or investments).

[Dima P.]

Hi Preben, it's already planned, no worries!