Log file documentation / format

[mgiljum]

Is there any documentation on the log format for the files in C:\ProgramData\Veeam\Backup365\Logs?

There seem to be 3 rotating logs: Veeam.Archiver.Proxy, Veeam.Archive.Service, and Veeam.Archiver.Shell.

All three generally seem to follow the same format (example below is from Veeam.Archiver.Shell):

Code: Select all

3/27/2019 9:21:14 AM    1 (2384) Veeam.Archiver.Shell.exe: Version=9.6.3.594
3/27/2019 9:21:14 AM    1 (2384) Command line parameters:
3/27/2019 9:21:15 AM    7 (2228) Connecting to 127.0.0.1 (port: 9191) using current account...
3/27/2019 9:21:15 AM    7 (2228)   successfully connected
3/27/2019 9:21:41 AM    1 (2384) Closing console...
3/27/2019 9:21:41 AM    1 (2384) Console closed

I'm interested in what the two numbers between the date and message are.

[nielsengelen]

There is no documentation around this. What would be the use case for this type of information?

[mgiljum]

There is no documentation around this. What would be the use case for this type of information?

We capture logs from a variety of our enterprise applications using logstash and pipe them into a log management system. From there we do analysis, reporting, alerting, etc. We mainly use this for monitoring failure conditions and security-related events.

While some of the other Veeam products (e.g. B&R) will create messages in the Windows Event log (which are a lot easier to parse), Backup for Office 365 doesn't, instead creating only those text logs. Knowing how to parse them allows all the data points/columns in each line to be properly collected/transformed for later analysis.

[Mike Resseler]

Hi @mgiljum

The first number after the time is the ProcessID and the second one (between the ( ) ) is the ThreadID

Cheers
Mike

[mgiljum]

Thanks Mike!

[Mike Resseler]

Hi @mgiljum

Sorry, I need to correct myself, it is not the ProcessID, it is a managed thread ID (from inside the solution)