Detailed logging of FLR / restore sessions

[karapoti]

Hello,

my customer is forwarding all events in the Veeam Server's event log (windows event log) to their splunk/siem server and is asking how they can get more detailed information around restores: who initiated/what was restored/to where?

Its a Backup-as-a-Service platform where the customer does not (is not allowed) access to the UI / Veeam server.

Is it possible to get these sorts of details out of the usual event logging? If not, what options do we have?

thanks
Adrian

[Mildur]

Hi Adrian

I believe, this information is not logged in event log.
But you can use Veeam One which has a restore operator activity report. The report has everything you requested about restores.
https://helpcenter.veeam.com/docs/one/r ... ml?ver=110

You can schedule the report to be send as a mail to the customer.

Thanks
Fabian

[Regnor]

For FLR sessions detailed audit logs are generated under %ProgramData%\Veeam\Backup\Audit. Perhaps you can parse those with Splunk?