some functions about Veeam sure backup

[baber]

Dear all
Hi

I was run veeam sure backup in my environment and it work perfectly but want to know what does that means quote from veeam help center :

" If the SureBackup job is configured to perform malware scan, Veeam Backup & Replication scans data of VMs from the application group and the verified VM with antivirus software."

1- Is that your means for example if i had backup from 10 vms i can malware scan or virus scan in surebackup ?
where can i config that ?
As I know we have 4 tests in surebackup : Heartbeat , ping , script and verification
which one will be use for malware or virrus scan ?

2- The last step of verification that check all of vms files such as vms,vmdk, flat.vmdk, ..... how it works for example for checking this had to have a source file for compare now want to know what is source file for checking ?

BR
Babak

[HannesK]

Hello Babak,

where can i config that ?

it's some new checkboxes in the settings

@2: you mean the "Validate entire virtual disk content (detects silent data corruption)"?
This check is reading the complete backup file. Within the file, there are checksums for the blocks. The software creates the checksums again an compares them to the stored values. If they do not match, then the file is corrupt.

Best regards,
Hannes

[baber]

As i understood in the backup job it will be get CRC check from the vm and will be save this value during verification files in surebackup it will get a CRC checking from backup file and will compare between them is that correct ?

2- what is that means from malware scan ?
Is that your means it can scan backup file with an anti malware/virus scan ?

BR

[HannesK]

Hello,
the backup process creates CRC checksums for every block. Theses checksums are checked. See user guide

Is that your means it can scan backup file with an anti malware/virus scan ?

yes you can. Also see user guide

Best regards,
Hannes

[baber]

excuse me i confused is that your means one of the antivirus such as kasper, nod32 , norton , .... can scan my backup ?
Where do i have to select Antivirus/Malware application ?

BR
Babak

[HannesK]

Hello,
yes, you can do AV scans before restoring or during backup test.

We call that "Secure Restore" (see "Antivirus XML Configuration File" section how to configure your AV vendor).

Best regards,
Hannes

[baber]

so thanks
now if i want use kaspersky for scan do i had to add this line ?

<AntivirusInfo Name='Kaspersky' IsPortableSoftware='false' ExecutableFilePath='Veeam.Backup.Antivirus.Scan.exe' CommandLineParameters='/p:%Path%' RegPath='HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\symcscan' ServiceName='symcscan' ThreatExistsRegEx='Threat\s+found' IsParallelScanAvailable='false'>
<ExitCodes>
<ExitCode Type='Success' Description='No threats detected'>0</ExitCode>
<ExitCode Type='Error' Description='Invalid command line argument'>1</ExitCode>
<ExitCode Type='Error' Description='Antivirus scan was completed with errors'>2</ExitCode>
<ExitCode Type='Error' Description='Antivirus scan was canceled'>4</ExitCode>
<ExitCode Type='Infected' Description='Virus threat was detected'>3</ExitCode>
</ExitCodes>
</AntivirusInfo>

or what do i had to add to that file ?

BR
Babak

[MichaelCade]

Hi Babak, You are absolutely right in regard to being able to scan for malware threats inside your automated SureBackup verification job.

Have you tested the above xml?

There is also the ability to run the Secure Restore functionality during many of the Veeam restore processes, for testing purposed of this XML this might be quicker for you. For example an Instant VM Recovery to a virtualised environment, using a different restore vm name and opting not to turn this on would be a good way to test out your custom XML.

Please keep us updated on how things go.

[MichaelCade]

Barber, also keep an eye on this as you may be using the same antivirus software with a similar requirement.

veeam-backup-replication-f2/secure-rest ... ml#p315961

I will keep an eye on the support case that is open.

[Dima P.]

Hello Babak,

Can you please clarify the exact name of the antivirus software you would like to integrate with? We've managed to get Kaspersky Security 10 for Windows Server working fine, so if that's the version of the software you've been using please use the example provided in this post. Cheers!

[baber]

thanks

As "kaspersky security for windows server 10.1.0.622" has been installed on my veeam server now due surebackup job also want to scan my backup file as i see in previous posts i had to use follow xml code

Code: Select all

<AntivirusInfo Name='Kaspersky Security 10 for Windows Server' IsPortableSoftware='true' ExecutableFilePath='C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security 10 for Windows Server\kavshell.exe' CommandLineParameters='SCAN %Path% C:\VeeamFLR' RegPath='' ServiceName='' ThreatExistsRegEx='Threat\s+found' IsParallelScanAvailable='false'>
		<ExitCodes>
			<ExitCode Type='Success' Description='No threats detected'>0</ExitCode>
			<ExitCode Type='Error' Description='Operation canceled'>1</ExitCode>
			<ExitCode Type='Error' Description='Service Not Running'>-2</ExitCode>
			<ExitCode Type='Error' Description='Permissions error'>-3</ExitCode>
			<ExitCode Type='Error' Description='Object not found'>-4</ExitCode>
			<ExitCode Type='Error' Description='Invalid command syntax or scan scope not defined'>-5</ExitCode>
			<ExitCode Type="Error" Description='Invalid command arguments'>-6</ExitCode>
			<ExitCode Type='Infected' Description='Infected and other objects detected'>-80</ExitCode>
			<ExitCode Type='Infected' Description='Probably infected objects detected'>-81</ExitCode>
			<ExitCode Type='Error' Description='Processing errors detected'>-82</ExitCode>
			<ExitCode Type='Success' Description='Unchecked objects found'>-83</ExitCode>
			<ExitCode Type='Infected' Description='Corrupted objects detected'>-84</ExitCode>
			<ExitCode Type='Error' Description='Task log creation file failed'>-85</ExitCode>
			<ExitCode Type='Error' Description='Unknown error'>-99</ExitCode>
			<ExitCode Type='Error' Description='Invalid key'>-301</ExitCode>
 		</ExitCodes>
	</AntivirusInfo>

Top

now 2 questions :
1- when do i had to paste or in which file do i had to put this code ?
2- Is that code ok and can use for kaspersky ?

BR

[foggy]

1. You need to add it to the AntivirusInfos.xml file as described in this user guide section.
2. Since the code seems to be exactly the same as in the example mentioned above, it should work.

[baber]

but ii get this error at the start up sure backup job

8/13/2019 Error: Antivirus software was not detected

[foggy]

I'd check the paths and contact support for a closer look if everything seems to be correct.

[baber]

no need change in follow code ?
I am just sure from the path of my kasper sky file
is path for VEEAMFLR, service name and ... correct ?
no changes need ?

Code: Select all

<AntivirusInfo Name='Kaspersky Security 10 for Windows Server' IsPortableSoftware='true' ExecutableFilePath='C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security 10 for Windows Server\kavshell.exe' CommandLineParameters='SCAN %Path% C:\VeeamFLR' RegPath='' ServiceName='' ThreatExistsRegEx='Threat\s+found' IsParallelScanAvailable='false'>
		<ExitCodes>
			<ExitCode Type='Success' Description='No threats detected'>0</ExitCode>
			<ExitCode Type='Error' Description='Operation canceled'>1</ExitCode>
			<ExitCode Type='Error' Description='Service Not Running'>-2</ExitCode>
			<ExitCode Type='Error' Description='Permissions error'>-3</ExitCode>
			<ExitCode Type='Error' Description='Object not found'>-4</ExitCode>
			<ExitCode Type='Error' Description='Invalid command syntax or scan scope not defined'>-5</ExitCode>
			<ExitCode Type="Error" Description='Invalid command arguments'>-6</ExitCode>
			<ExitCode Type='Infected' Description='Infected and other objects detected'>-80</ExitCode>
			<ExitCode Type='Infected' Description='Probably infected objects detected'>-81</ExitCode>
			<ExitCode Type='Error' Description='Processing errors detected'>-82</ExitCode>
			<ExitCode Type='Success' Description='Unchecked objects found'>-83</ExitCode>
			<ExitCode Type='Infected' Description='Corrupted objects detected'>-84</ExitCode>
			<ExitCode Type='Error' Description='Task log creation file failed'>-85</ExitCode>
			<ExitCode Type='Error' Description='Unknown error'>-99</ExitCode>
			<ExitCode Type='Error' Description='Invalid key'>-301</ExitCode>
 		</ExitCodes>
	</AntivirusInfo>

[foggy]

Please ask our engineers to take a closer look at your environment, the message you're seeing means that Veeam B&R is not able to detect the antivirus on the mount server.

[baber]

Is that your means had to open a support case ?

[foggy]

Correct.

[tdewin]

Seems that Kaspersky now even has an official kb on this:
https://support.kaspersky.com/us/15250#block5

[baber]

Unfortunately not solved the problem in first step error : Error: Antivirus software was not detected

[foggy]

Have you contacted technical support with this?

[Gostev]

Did you edit the file on the mount server specified for the backup repository?

[baber]

Yes. actually mount server has been reside on veeam server . all of them are on veeam server
I just edit AntivirusInfos.xml in follow path

C:\Program Files\Common Files\Veeam\Backup and Replication\Mount Service

[wishr]

Hello again,

I'd suggest checking this situation directly with our support team, as it's hard to troubleshoot it through the forum.

Thanks

[informatica.bd]

@Baber Hello did you get a support answer for this certainty checking issue using Kaspersky?

[Dima P.]

Hello informatica.bd,

Here is a KB article created by Kaspersky team which should help you to configure the Secure Restore with Kaspersky Security for Windows Server: How to integrate Kaspersky Security 10 for Windows Server with the Veeam Backup & Replication’s Secure Restore feature. Let us know in the described configuration works for you. Cheers!