How to alert if backups are being deleted

[bgalante]

Hi All,

I'm looking for a way to send an alert when any backups are manually being deleted, is there a way to do that?
I'd like to do it in somewhat real time, or maybe have a report run every hour, and if backups were manually deleted to let me know.
Has anyone done something like this?

[Egor Yakovlev]

Hi Brian.

Removing VM backup from VBR console triggers Windows Event ID 10050 under Application and Services Logs -> Veeam Backup. You can attach a task on that event and send email based on it.

/Cheers!

[bgalante]

Egor, Thank you! But I'm looking at that event, after doing a test delete of a backup, and it says:
Restore point for VM 'SERVER-NAME' has been removed according to the configured retention policy.

I would expect to see that for normal backup retention policy, and there are many of those, but it says the same thing when I manually deleted it. I'm using Veeam 9.5.
The other thing I noticed was it has "N/A" listed as the user, and I was using my own user id to delete the backup.

Is there any other possibilities of how I can accomplish this?

[soncscy]

Hey Brian,

It's hacky, but I've done something like this for clients by parsing the logs for the event. I think it's in the Console logs, and a simple like:

Get-ChildItem C:\ProgramData\Veeam\Backup\Console -Recurse | Select-String -Pattern "[some-text when backups are deleted]"

I don't remember the exact line, but you should be able to see it in the logs pretty clearly from a test.

You can parse out the date/time from the line returned and create some logic, then send with Send-MailMessage on events to catch.

It's not...great) But it works

[Egor Yakovlev]

You can check following code:

Code: Select all

$jobType = [Veeam.Backup.Model.EDbJobType]::DeleteBackup
[Veeam.Backup.Core.CBaseSession]::FindLastByJobType($jobType).SessionInfo

Where:
"RunManually" represents that it was a user-initiated deletion
"CreationTime" has a clear timestamp
"AuxData" contains details about user domain\name
Caveat is that it gets last ran backup deletion session, not all of them.

Or parse logs at C:\ProgramData\Veeam\Backup\Utils\DeleteBackup where Job.DeleteBackup has global list of deletions, and each initiated deletion task has new log entry Task.DeleteBackup_RepositoryName_UUID.log. Pretty much "if new file appears - someone triggered a backup deletion".

/Cheers!

[RubinCompServ]

Is this something that exists in VeeamONE?