snapshots police

[Kazz]

Hi,

One of our staff members is gonna retire at the end of the year. A responsibilities that he seems to enjoy is to chase people down after looking at VeeamOne report with VM snapshots open for more than a week or VM snapshots that grew more than 100GB in size. We are not expecting a new hire to chase people down, nor can we let VeeamOne delete snapshots for us. Looks like we have a few options.

1. Email Veeam One report to everyone in IT showing all open snapshot and ask people to review them and delete (most likely everyone will create a rule to move email to trash as it hits their mailbox)
2. Create a Teams channel and send alerts to it using WebHook (people will most likely silence the cannel so they don't get alerted about snapshots they didn't create)

This is what we are interested in the most, but not sure if any of the following is possible.

Since VeeamOne has the DOMAIN\user record of the account creating a snapshot, can Veeam One send an email to a user who created the snapshot?

Can VeeamOne pass the following values as parameters to a powershell script?
1. User Account who created a snapshot
2. Size of the snapshot
3. Date/Time of the snapshot creation
3. Name of the VM with the snapshot

We hope with a MS Graph API we can send an email directly to the user who created the snapshot and forgot to delete or send a direct Teams message to the user asking them to delete the snapshot.

Thanks

[RomanK]

Hello Kazz,

It is not what you are asking exactly, but Veeam ONE has alarms:
Latest snapshot age - The age of the latest snapshot for this VM has exceeded the configured threshold.
Latest snapshot size - The size of the latest snapshot file for this VM has exceeded the configured threshold.
Orphaned VM backup snapshot - This VM is running on the snapshot left by backup or replication job.

It is possible to assign each alarm in Veeam ONE for any infrastructure you want and use different notification actions.

Plus it is possible to run a PowerShell script when the alarm triggers.
There are some parameters in the command line to play with

%1 — alarm name; %2 — affected node name; %3 — alarm summary; %4 — date and time of alarm trigger; %5 — alarm status; %6 — previous alarm status; %7 — ID assigned to a combination of an affected node and an alarm; %8 — type of a child alarm object.

It seems to me that to resolve your case the report is not needed at all.

Thanks

[Kazz]

Hi Roman,

Yeah, we are looking to switch to alarms, but how can we pull out the user who created the snapshot. The Alarm would be triggered based on the snapshot age / size, but the alarm itself does not know or care who created the snapshot.

Sounds like we need a two part script, set up on both alarms (age and size) when either alarm gets triggered we can grab a VM name from the alarm and pass it to the second part that would look up an event of the last snapshot taken on the VM and get the account from created by filed. At this point we should be able to email the forgetful user asking them to clean up.

Has anyone done anything similar using Veeam PowerShell?

Thanks

[RomanK]

Hello Kazz,

If there is a logical grouping like:
user1 can create snapshots only for the VM1, VM11, VM111
user2 can create snapshots only for the VM2, VM22, VM222 it would be possible to utilize business view grouping. This, however, will not work for the case when anyone can create a snapshot anywhere.

Veeam ONE does not have its own PowerShell module. Veeam PowerShell is related to VBR activities, but the snapshot could be created by the user manually without VBR. Some relationships could probably exist in PowerCLI or in direct queries to VMware API.

Thanks

[Kazz]

Yeah, any user in IT can create a snapshot, so business view would not work.

I saw several examples where people were able to pull out user name of the user who created the snapshot.
This is a good start, now I am more confident it's possible to start alerting on snapshots and the accounts who created them

http://vstrong.info/2013/08/20/who-crea ... snapshots/

[jorgedlcruz]

Very interesting, I am confident I can put this into a PowerShell when I come back from hols in a week.

Will keep you posted.