How to flag "SUSPECT" one or more Vm backup ?

[ThierryF]

Hello,

Following question came into my inbox today being how to flag suspect one or more backups to
at least warn if a recover is issued or prevent recover from ?

An admin reported me a malware suspission on one server and requested backups to be
deleted. VM is backuped twice : once via VBR at VM level, once via application level backup
stored into securized file share that's later on backuped by VBR also.

How to anotate these backups (or all previous ones) with suspect flag ?

Not knowing malware install date, all earlier backups are "suspect".
If I could delete disk ones easily, tape copies are still there, nothing preventing
nor advising for disk recovery (for FLR) nor entire VM recover.

Deleting VM disk backups from veeam config is possible but not for file server backup that
would prevent me to recover any other files it stores.

Any idea ?

Thanks

TH

[HannesK]

Hello,
there is no option to add text to a backup.

once via VBR at VM level, once via application level backup

just to clarify: that means Veeam plus another backup software, right?

Would the following help you (except for the tape use-case)?
- move the backup to a "suspect" job (move is a V12 feature)

Best regards,
Hannes

[ThierryF]

Hello,

Not a text field, but like a suspect flag in veeam db...
Networker has different backup level flags. One is suspect. Turns automatically on in case of tape medium error but you can arm in case of backup suspicion (virus, malware, or any case you may judge important for your business...)

About you quote I have a vm backup job at vmware level and an application level backup being written to a cifs share (and file server hosting share is also vbr protected). Hope this clarify.

[HannesK]

Hello,
we count your feature request +1

I still cannot follow why there is "vmware level" and "application level" (because Veeam does it "all in one job"), but I guess that's outside the request itself. I remember customers telling me, that they use agent-based backup for file level restore and hypervisor based backup for VM restore with legacy backup products. That's where my question came from. But it's not relevant to the request as far as I see.

Best regards,
Hannes

[ThierryF]

Hello,

The reasons of dual backup are quite simple : as that machine is a kind of batch server where some of our [AD/AAD/O365] scripts runs from,
it is easier to refresh dev/acc from prod data, online store (backup frequency may be different) for direct recovery without relying on backup infra, ...
Same for our AD DCs,a VM VeeamVBR based backup combined with an Windows AD level Backup to file store fror granual recovery if needed.

I already imagine you will answer me Veeam has an AD integration module, I know, but this is historic before we bough Veeam ...
and Veeam cost is also sometime an issue ...

Th

[HannesK]

Hello,
just for information, we brought marking backups as infected in version 12.1.

https://helpcenter.veeam.com/docs/backu ... tatus.html

Best regards,
Hannes