Comprehensive data protection for all workloads
Post Reply
MrTomahawk
Novice
Posts: 5
Liked: never
Joined: Jul 30, 2013 4:12 pm
Full Name: Craig Miller
Contact:

Audit what admin started a particular job

Post by MrTomahawk »

Is there a way to find out which admin kicked off a paricular back or restore job? I looked in the C:\Users\All Users\Veeam\Backup folder and I see logs for each of the jobs and can open a log to find out loads of more info then whats found in Report or Statistics, but even then it logs the job being started from the service account asscoiated with the job instead of logging the admin which actuallly kicked the job off.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

Hello Craig,

In the upcoming version of Veeam ONE (part of Veeam Backup Management Suite) there will be a report called "Restore Operator Activity" that will give you information on all types of restores performed by the backup operators with the exact times and restore points used.

As to the backup/replication jobs start information, can you please tell me the use case you need this data for? Don't you use job schedulers to start your jobs?

Thank you!
MrTomahawk
Novice
Posts: 5
Liked: never
Joined: Jul 30, 2013 4:12 pm
Full Name: Craig Miller
Contact:

Re: Audit what admin started a particular job

Post by MrTomahawk »

We do use scheduled jobs, however whenever we discover any issues that may have occurred we often do an ad-hoc backup, and then there's restores which are never scheduled.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

Ok, thanks for clarification...so the report showing all details about restores occurred should be exactly what you are after.
veremin
Product Manager
Posts: 20270
Liked: 2252 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Audit what admin started a particular job

Post by veremin »

For now the following one-liner might be helpful:

Code: Select all

Asnp VeeamPSSnapin 
Get-VBRRestoreSession |  where {((Get-Date) - ($_.CreationTime)).totalhours -le "24"} |Sort-Object Creationtime | Select name, CreationTime, {$_.Initiator.name} 
This script will output all “Full VM” restore sessions (that occurred during last 24 hours) along with the name of restored VM and name of restore initiator.

Unfortunately, with the current product version Get-VBRRestoreSession method is restricted to full VM restore sessions. Nevertheless, this behaviour will be fixed in the upcoming release, where it's possible to track other restoration activities via PS.

Thanks.
MrTomahawk
Novice
Posts: 5
Liked: never
Joined: Jul 30, 2013 4:12 pm
Full Name: Craig Miller
Contact:

Re: Audit what admin started a particular job

Post by MrTomahawk »

Thanks, is there a similar Powershell command I could use to get back the initiator of any non-scheduled backups? Does have to be while the backup is in process? Thanks again
veremin
Product Manager
Posts: 20270
Liked: 2252 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Audit what admin started a particular job

Post by veremin »

You can use the following one-liner in order to get similar information:

Code: Select all

Asnp VeeamPSSnapin 
Get-VBRBackupSession | where {((Get-Date) - ($_.CreationTime)).totalhours -le "24"} |Sort-Object Creationtime | Select name, CreationTime
However, please be aware that backup session doesn’t have an initiator name parameter, thus, the script will only output name and creation time of corresponding backup sessions.

Thanks.
masonit
Service Provider
Posts: 325
Liked: 23 times
Joined: Oct 09, 2012 2:30 pm
Full Name: Maso
Contact:

Re: Audit what admin started a particular job

Post by masonit »

Hi

Tried this but it doesn't show who started the job. Isen't this registered anywere?

\Masonit
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

According to Vladimir this script shouldn't return the name of the job initiator:
v.Eremin wrote:please be aware that backup session doesn’t have an initiator name parameter
BTW, this info is not exposed in the UI as well, but thanks for the feedback. I will verify if it is easy to add this capability to the Windows Event log of the backup server.
masonit
Service Provider
Posts: 325
Liked: 23 times
Joined: Oct 09, 2012 2:30 pm
Full Name: Maso
Contact:

Re: Audit what admin started a particular job

Post by masonit »

Vitaliy S. wrote:According to Vladimir this script shouldn't return the name of the job initiator: BTW, this info is not exposed in the UI as well, but thanks for the feedback. I will verify if it is easy to add this capability to the Windows Event log of the backup server.
Ok sorry missed that.

Yes that would be great! It is a must for us to be able to track, who does what...

\Masonit
kennyt2000
Influencer
Posts: 12
Liked: 2 times
Joined: Jun 25, 2009 3:05 pm
Full Name: Kenny Thornton
Contact:

Re: Audit what admin started a particular job

Post by kennyt2000 »

Hi Guys,

did you ever come up with a way to audit who started a backup job?

Thanks
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

Yes, to audit this you need to navigate to Windows Event log on the backup server -> Veeam Backup - > and search for an event with ID 110 which does have job initiator name in its details. Thanks!
egrigson
Novice
Posts: 6
Liked: never
Joined: Nov 03, 2014 9:32 am
Full Name: Ed Grigson
Contact:

Re: Audit what admin started a particular job

Post by egrigson »

I've just checked the Veeam event log and while there is a 110 event it simply states 'Backup job xxxx has been started' - there is no mention of the job initiator. In the user field it says 'N/A'. This is the case for every event 110 on my Veeam server, regardless of whether it was scheduled or started manually. I'm using v7 u4.

Any other ideas?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

Hi Ed,

Did you trigger your job manually or by schedule?

Thanks!
masonit
Service Provider
Posts: 325
Liked: 23 times
Joined: Oct 09, 2012 2:30 pm
Full Name: Maso
Contact:

Re: Audit what admin started a particular job

Post by masonit »

Same here. It only say N/A. I triggered the job manually. I am logged in on the backup server with a account from another trusted domain.

\Masonit
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

Magnus, are you using Veeam B&R v8 or v7 patch 4?
masonit
Service Provider
Posts: 325
Liked: 23 times
Joined: Oct 09, 2012 2:30 pm
Full Name: Maso
Contact:

Re: Audit what admin started a particular job

Post by masonit »

None of them, ver 7.0.0.839. Maybe patch 4 is required?

\Masonit
Gostev
Chief Product Officer
Posts: 31457
Liked: 6648 times
Joined: Jan 01, 2006 1:01 am
Location: Baar, Switzerland
Contact:

Re: Audit what admin started a particular job

Post by Gostev »

Sure.
egrigson
Novice
Posts: 6
Liked: never
Joined: Nov 03, 2014 9:32 am
Full Name: Ed Grigson
Contact:

Re: Audit what admin started a particular job

Post by egrigson »

Sorry for the delaying in replying, I was out of the office for a week.

I get the same 'N/A' under the user field whether the job is started manually or via a schedule, so I've still not found a way to audit who started a job. I'm on v7 u4.

Ed.
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

I have re-checked everything again and it seems like I have dlls with different build number compared to patch 4 version, sorry for the confusion. As to the user name displayed in the event log, then it is logged in the description of this event in Veeam B&R v8.
masonit
Service Provider
Posts: 325
Liked: 23 times
Joined: Oct 09, 2012 2:30 pm
Full Name: Maso
Contact:

Re: Audit what admin started a particular job

Post by masonit »

Is it possible to see who has changed something in Veeam.? Ex someone made a change to retention in a job.

\Masonit
veremin
Product Manager
Posts: 20270
Liked: 2252 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Audit what admin started a particular job

Post by veremin »

Job Configuration Change Tracking report seems to be the way to go. Thanks.
ftbug
Enthusiast
Posts: 59
Liked: 2 times
Joined: Nov 18, 2015 10:12 am
Full Name: Freddie
Contact:

[MERGED] : Backup Schedule Logs

Post by ftbug »

Hi, it may be a long shot, but i was wondering if it is possible to check in any sort of logs to see who and when a schedule for a certain job was created/edited?

I know when a job is created that the timestamp and user is saved in the description, however, it would be handy to have some further details/logs of other things that have been edited within the job

kind regards
veremin
Product Manager
Posts: 20270
Liked: 2252 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Audit what admin started a particular job

Post by veremin »

Check the abovementioned report and see whether it answers your requirements. Thanks.
ftbug
Enthusiast
Posts: 59
Liked: 2 times
Joined: Nov 18, 2015 10:12 am
Full Name: Freddie
Contact:

Re: Audit what admin started a particular job

Post by ftbug »

Will this provide historical data? or just the data after veeam one has been installed and configured?
Vitaliy S.
VP, Product Management
Posts: 27055
Liked: 2710 times
Joined: Mar 30, 2009 9:13 am
Full Name: Vitaliy Safarov
Contact:

Re: Audit what admin started a particular job

Post by Vitaliy S. »

The second variant. Backup data for the change tracking report will be collected after Veeam ONE installation. Once you do this, all historical information will be stored in Veeam ONE database, so that you can get back to it at any time.
ftbug
Enthusiast
Posts: 59
Liked: 2 times
Joined: Nov 18, 2015 10:12 am
Full Name: Freddie
Contact:

Re: Audit what admin started a particular job

Post by ftbug »

Okay great, thanks
Post Reply

Who is online

Users browsing this forum: ante_704, Paul.Loewenkamp and 281 guests