Change Tracking report displaying internal VSA veeam-usr-vbr activity

[barks]

Veeam describes the Backup Object Change Tracking reports as "This report provides detailed information on backup infrastructure configuration changes"

The report emails hundreds of events daily initiated by veeam-usr-vbr which is the linux service account on VSA. Some are password resets for the account which support described as 'internal OAuth2 credential rotation' and some are normal job retention drop off deletes of old restore points. Support says these events match ONE's report query criteria and is expected.

I need a way to audit if admins or attackers are removing VMs, lowering job retention, etc. I can't see these critical events when the report is clouded with over 500 restore points removed daily due to retention reached; each VM is a row and the report is 61 pages. I do not count report point drop offs as 'backup infrastructure configuration changes', but this report does. What value is provided by showing me internal maintenance activity, I have not figured out.

Can we get something that provides me oversight to configuration changes by named console users? And maybe update the existing report verbiage to be clearer.

Case #08040690
Case #08251883