Audit trail for Remove from Configuration/Delete backups from disk

[stuartmacgreen]

Is there anywhere in Veeam logs that can show activity such as when and who would have issued

• Remove from Configuration
• Delete from disk

for a Job

Thanks

[Egor Yakovlev]

Hi Stuart,
on top of the head, few ideas:
- C:\ProgramData\Veeam\Backup\Svc.VeeamCatalog.log will have "[CRemoveBackupCmd]" line with clear BackupRef following. Using that you can get exact timestamp when Delete From Disk was initiated for backup you are missing.
- Adding there C:\ProgramData\Veeam\Backup\Satellites\ you can find who exactly was logged on to your VBR server at said timestamp
- Finally, there is a log at user console machine(or VBR server if logged on locally) C:\Users\UserName\AppData\Local\Veeam\Console that tracks every single click user does, including "[Backup] Delete" with clear ID of deleted backup too.
Hope that helps!

[stuartmacgreen]

Thanks this worked excellent.
I now know when and how it was deleted and who was responsible or set the wrong expiry.

I will be having a stern talk with myself.

[Steven_Betz]

Hi Stuart,
on top of the head, few ideas:
- C:\ProgramData\Veeam\Backup\Svc.VeeamCatalog.log will have "[CRemoveBackupCmd]" line with clear BackupRef following. Using that you can get exact timestamp when Delete From Disk was initiated for backup you are missing.
- Adding there C:\ProgramData\Veeam\Backup\Satellites\ you can find who exactly was logged on to your VBR server at said timestamp
- Finally, there is a log at user console machine(or VBR server if logged on locally) C:\Users\UserName\AppData\Local\Veeam\Console that tracks every single click user does, including "[Backup] Delete" with clear ID of deleted backup too.
Hope that helps!

Hi Egor,

I would like to see which user is logged on with his console. Is there any log that shows me this information?

Many thanks

[Vitaliy S.]

Steven, did you have a chance to take a look at this suggestion?

- Adding there C:\ProgramData\Veeam\Backup\Satellites\ you can find who exactly was logged on to your VBR server at said timestamp

[tedsteenvoorden]

In relation to auditing, is there somewhere to see which failed logon attempts have been made via the veeam management console?

Best regards, Ted

[Mildur]

You can see failed logons in this report in the EM. It‘s not in the VBR GUI, but you get an nice export to check for login events.

https://helpcenter.veeam.com/docs/backu ... 0#generate

[tedsteenvoorden]

Thanx for the info Mildur!