identify backup objects with authentication state warning or error

[real_tarantoga]

Hello,
I'm not able to identify the commandlet combination to filter last backup job states for objects, where the authentication for windows or ssh failed - so the job state is "warning" or "error".
google gemini wasn't clever enough.

After filtering these objects, the game in the script should be to assign a new VM tag to these VMs.
I'm managing the authentication by VM tags.

Thank You!
Stefan

[david.domask]

Hi Stefan,

Regrettably pullout out the specific messages for the failures can sometimes require using unsupported methods. Normally you would go through Get-VBRTaskSession (Get the job session with Get-VBRBackupSession, then pass that resulting object to Get-VbrTaskSession on the -Session parameter)

You can check the result of the task sessions on those objects. If you don't see it in the properties there, you can try using this unsupported method to get the messages from the Job Statistics Window in the UI.

[real_tarantoga]

Thank You, David!
Is there a report in ONE that I could customize for that?

Thx again,
Stefan

[david.domask]

Hi Stefan, you're very welcome!)

You can check the monitoring reports, for example, Latest Job Status report. Most of the monitoring reports will return the top-level error, so I think that could help you also.

[real_tarantoga]

I will try both and then report back

[real_tarantoga]

First feedback: The ONE report is a perfect starting point for a quick workaround. I will work through the listed VMs now and look for the PowerShell solution later.

Background: All my jobs are configured as "attempts vss or I/O sync" and after our IT security department SIEM/SOC took the log analysis online, they received massive alerts about failed login attempts on the Linux VMs... if I don't turn this off quickly, they will use me as a weather vane.

[david.domask]

Got it, glad the report will tide you over until you get a more lithe powershell solution. Veeam One is great, but I can imagine you probably want it a bit more "thin"

Btw, depending on what you're sending the events to, if it supports Syslog, consider using the Syslog integration. It works pretty well and might be easier to manage for your team managing the log server.

Lots of options with Veeam, pick which works best for you