VBR v12.1: would syslog format reference be available?

[fabbar]

Hi all,
I would like to know if it will available a reference of syslog messages.
I'm testing this feature and I have redirected all messages to a text file and messages are quite different from each other.
My goal is parsing messages via logstash/grok and extracting fields, but I have to know what kind of messages I can get.
Thanks

[Dima P.]

Hello fabbar,

Thank you for your question! The documentation is in progress, the closest I can share at the moment is Veeam Backup & Replication Events which was used as a starting point for Syslog messages.

all messages to a text file and messages are quite different from each other

Can you please share couple of examples as the reference? Thank you!

[fabbar]

Sure.

Code: Select all

<14>1 2024-01-31T06:00:40.343930+01:00 VBRHOSTNAME Veeam_Backup - - [origin enterpriseId="31023"] VM (VM_NAME) VM backup job "VM_BACKUP_JOB_NAME" is started\nID: UUID-UUID-UUID-UUID

<14>1 2024-01-31T06:00:41.096214+01:00 VBRHOSTNAME Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=150 JobSessionID="UUID-UUID-UUID-UUID" JobID="UUID-UUID-UUID-UUID" JobType="0" TaskSessionID="UUID-UUID-UUID-UUID" OibID="UUID-UUID-UUID-UUID" OriginalOibID="UUID-UUID-UUID-UUID" CreationTime="01/31/2024 05:00:41" Status="0" JobDescription="JOBDESCRIPTION" SourceHostName="VCENTERFQDN" VmRef="vm-XXXXXX" VmName="VM_NAME" TransferredGb="0.000" Platform="0" IsEntry="False" Version="1" Description="VM VM_NAME task has finished with 'Success' state."]"

<14>1 2024-01-31T06:01:43.394963+01:00 VBRHOSTNAME Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=10010 OibID="UUID-UUID-UUID-UUID" OriginalOibID="UUID-UUID-UUID-UUID" VmRef="vm-XXXXXX" VmName="VM_NAME" ServerName="VCENTERFQDN" DateTime="01/31/2024 05:00:57" IsCorrupted="False" Platform="0" StorageSize="8388608" RepositoryID="UUID-UUID-UUID-UUID" IsFull="False" Version="1" Description="VM 'VM_NAME' restore point has been created."]

<14>1 2024-01-31T10:03:04.098398+01:00 VBRHOSTNAME Veeam_MP - - [origin enterpriseId="31023"] [categoryId=0 instanceId=40700 ConfigurationBackupSpecXML="<ConfigurationBackupJobSpec><RepositoryId>UUID-UUID-UUID-UUID</RepositoryId><RepositoryName>Default Backup Repository</RepositoryName><RetentionPolicy>10</RetentionPolicy><StorageEncryptionEnabled>True</StorageEncryptionEnabled><StorageCryptoKeyId>UUID-UUID-UUID-UUID</StorageCryptoKeyId></ConfigurationBackupJobSpec>" UserFullInfo="<ModifiedUserInfo fullName="SYSTEM" loginType="4" />" Version="1" Description="Configuration backup has been completed. Result: Success."]

It would be useful to parse single fields so I would be able to index them in an ELK platform for instance.

[Dima P.]

Thank you for the details! Indeed matching the values to exact fields is much easier. Let's await for the comment from @Egor Yakovlev, he is currently out of office but coming back next week.

[Egor Yakovlev]

Hi.
Yes, we are working with Technical Writers to provide a full Syslog Events Reference Guide that will include all possible events, parameters and samples.
Stay tuned!