[V13] Feature request - Easier access to Malware Detection logs on VSA

[mathiasd]

As many here, we're testing the waters as MSP with rolling out the V13 VSA.
Currently have it running in production for one customer, where we're running into one minor issue: how am I getting our support staff to access to the malware detection logs?

In the malware detection logs we get the following:
19/10/2025 22:50:41 Warning : Locations of suspicious files can be found on the backup server **vsa hostname** at /var/log/VeeamBackup/Malware_Detection_Logs/suspicious_files_25-10-19.log

On Windows based Veeam hosts, this is as easy as just navigating to the folder via our RMM tool and fetching the file.
On the VSA, this becomes much harder. We want to keep the VSA as a locked down "black box" appliance, with our support staff having no access to SSH, no RMM tools installed on it.
Just access to either the fat client on a Windows host, or the web interface for some quick checks.

Via a running support case we got the feedback that we can extract it via the support log system.
This works fine for me as our internal product expert, to do once in a blue moon to troubleshoot, but I can't expect our support staff to spend 10 minutes to collect the log files, extract them, and then go look for the log file.

As such, I'd like to put forward a feature request to make the malware detection log retrievable from within the Backup & Replication console.

[Dima P.]

Hello Mathias,

Thank you for the feedback - we’ll note this as an improvement request. In the meantime, you can export the logs using Veeam B&R export log it should include malware detection logs as well. Thank you!

[petesteven]

+1

We have the same hurdle with the logs. This should work in a different way than via Export Logs.

[DaStivi]

+1

easiest thing would be to see the correct folder structure under the files tab in VBR Console... but for some reason the folder/file-tree there is something different then whats on the filesystem of the vsa itself..

[CompKingCanada]

+1 here too. It's been over a year now...

[mabergerp]

+1 also for VBR Linux v13.x appliance:

Why I agree/suggest that Malware Detection needs some love.
Today I have to do all of the following steps just to see "if" I have a malware incident. It should not be this difficult and frankly I rarely even bother to check anymore due to the difficulty involved -- which goes against all best-security-practices:

Open VBR application; login as SSO/MFA; Inventory > Malware Detection > Click on the server's name > Show history > Malware events > find the server > right-click server and click "Details". All this work just to show me the VBR Linux appliance path to the file and potential issue.

Open a browser as "veeamadmin" > Veeam Host Management Console > Remote Access > SSH Server. Turn it on. Logout of the VBR appliance.
Log back into the VBR appliance as "veeamso" find and enter the MFA code > click "Approve. Logout of the appliance as "veeamso".

Open PuTTY as "veeamadmin".
cd /var/log/VeeamBackup/Malware_Detection_logs.
ll to see the files. Compare it to the output of the VBR Application for the server issue.
vi or cat the file above.
Read/review the file to see if it is truly malware or just routine stuff.
Exit SSH
I never bother to disable SSH Server in the VBR appliance as it'll just timeout and stop by itself. I know - not good security practice, but just more steps to do.

Go back into VBR application > Inventory > Malware Detection >Server > Mark as Clean. Provide a description as to why it was flagged as malware and mark it clean or not.

All of this should be bubbled up into the far VBR Windows application for me.