Splunk reporting

[dcd62]

Does anyone have experience exporting the Veeam B&R events and logs to a Splunk server?
I found this kb that gives the Event id's for the jobs: https://www.veeam.com/kb1834
The application event logs are located at: "C:\Windows\System32\winevt\Logs\Veeam Backup.evtx"
I was going to set up Splunk reports on the job status, successful/failed/etc based on the event id

Any ideas or input are welcomed.

thanks

[nielsengelen]

I haven't seen this posted in public yet however I know some companies doing this. There are public posts about Veeam and Log Insight (https://notesfrommwhite.net/2016/06/29/ ... g-insight/) which might can get you started or give you some ideas.

[dcd62]

Thank you, I w.ill take a look at that link

[glaspiet]

We are an environment of ~15k users, we use a good portion of the Veeam portfolio at this point. We just stood up Splunk. Is anyone else using Splunk to monitor their Veeam environment? If so what are you using it to look for?

[foggy]

Hi Travis, you may want to review the hints above. Thanks!