Feature Request: audit trail

[IpeRob]

Please include a audit trail that includes all changes a specific (active directory) user makes to the B&R infrastructure (such as changing repository or proxy settings) as well as changes to backup jobs. (adding/removing VM's, changing storage settings or modifications to the backup schedule).

[Shestakov]

Hello.
We already have a specific report in Veeam One to track changes you described:
Job Configuration Change Tracking report provides detailed information on job configuration changes performed within the reporting period including the exact time and the user account name who did the change.
Thank you.

[IpeRob]

thanks for you swift reply. Will look into this one seems likes this covers my request.

[veremin]

In addition, it might be worth taking a look at Windows Event Log (Application -> Veeam Backup); corresponding changes should be reflected there, as well. Thanks.

[VeaamGuy]

Please include a audit trail that includes all changes a specific (active directory) user makes to the B&R infrastructure (such as changing repository or proxy settings) as well as changes to backup jobs. (adding/removing VM's, changing storage settings or modifications to the backup schedule).

Hi guys, I have a similar requirement as above quote but the report provided as a solution in below quote doesn't cover it completely when adding/removing VMs from a backup job.

We already have a specific report in Veeam One to track changes you described:
Job Configuration Change Tracking report provides detailed information on job configuration changes performed within the reporting period including the exact time and the user account name who did the change.

The fields in the report are all required to complete the audit trail, which are :
Backup Server Job Type Property Previous Setting New Setting Modification Time Modified By

But after editing a backup job and removing/adding VMs my fields for "Previous Setting" and "New Setting" are blank. The Property only mentions the number of VMs added or removed from the job. I have already tried with increasing the logging level to the ultimate detailed (6) following http://www.veeam.com/kb1247 but that has not made any difference. Is there any other way to increase the reporting level to include those details in the report.

Thanks in advance.

[VeaamGuy]

I have already tried with increasing the logging level

Sorry just to be more clear, after changing the logging level (restarting the backup service) and making the change to a job the report is still showing the same as before and is not reflecting the new changes made to the Veeam job so not sure if that has fixed the problem. Will check again tomorrow to see if that has helped (maybe VeeamOne collects the logs overnight from the windows side to include in a DB for analysis - not sure how the reporting works but would be good to know).

So there are 2 possible problems here:
1. How can we get the VeeamOne report to include the changes made very recently e.g. in the last 10 minutes?
2. If increasing the logging level hasn't fixed the missing fields issue then what else can I try?

Thanks again.

[Shestakov]

Hi Rushad,
VBR logging level has no correlation with Veeam ONE reports, by the way, I would recommend to switch back from the highest logging level(6), since it may drastically increase your logging db size.

How can we get the VeeamOne report to include the changes made very recently e.g. in the last 10 minutes?

You can manually start collection job manually in Veeam ONE Reporter > Configuration > Servers.
Thanks!

[VeaamGuy]

Hi Rushad,
VBR logging level has no correlation with Veeam ONE reports, by the way, I would recommend to switch back from the highest logging level(6), since it may drastically increase your logging db size.

Cheers for the heads up on that, have changed it back to the default which was 4.

You can manually start collection job manually in Veeam ONE Reporter > Configuration > Servers.

Thanks heaps for the tip.
Had a default schedule at 3 am everyday so have added a few more points for the collection by changing it to periodically every 8 hours. Problem here is that it doesn't give you the option of a start time. Is this the right place for a feature request for v9? Would be great to have a start time specified for the periodic option and also maybe have an option to allow multiple set times for the same server e.g. collections at 3 am and 7pm daily would be ideal for us but based on the current options we cannot achieve this unless you have another way to do this? Maybe I can setup a scheduled task on the windows side for this if you can confirm what file needs to be executed for the collection task.

Coming back to the original question, can we somehow get the missing information by tweaking any of the settings to have a complete audit trail?

Thanks again for your help.

Kind Regards,
Rushad.

[Vitaliy S.]

Problem here is that it doesn't give you the option of a start time. Is this the right place for a feature request for v9?

Yes, that's a right place, but for periodic data collection start time is not required if you make it to run frequently.

Would be great to have a start time specified for the periodic option and also maybe have an option to allow multiple set times for the same server e.g. collections at 3 am and 7pm daily would be ideal for us but based on the current options we cannot achieve this unless you have another way to do this? Maybe I can setup a scheduled task on the windows side for this if you can confirm what file needs to be executed for the collection task.

Hmm... in v9 we would like to simplify the scheduling since it does not collect data required for real-time troubleshooting. Do you need to have audit logs available every morning for the review or you need to have this data available more often?

Coming back to the original question, can we somehow get the missing information by tweaking any of the settings to have a complete audit trail?

Auditing changes of the backup infrastructure is in the road map for future updates of Veeam ONE.

[Shestakov]

Rushad,

Is this the right place for a feature request for v9?

This is the exact place for feature requests and yours makes sense, but there is no chance it`s to be implemented in v9, because its release is already around the corner on testing/debugging stage.
I`ll keep it in mind for future versions though.

Coming back to the original question, can we somehow get the missing information by tweaking any of the settings to have a complete audit trail?

For now there is only a Job Configuration Change Tracking which shows changes into the jobs` configuration and VMware Configuration Tracking pack.
"Backup Infrastructure Change Tracking" also looks like a good feature request for next versions.
Thanks!

[signal]

In addition, it might be worth taking a look at Windows Event Log (Application -> Veeam Backup); corresponding changes should be reflected there, as well. Thanks.

I'm taking this a little out of context, but I'm looking for audit logging of access, changes and restores. I'm running 9.5 u2 with a virtual backup server and physical proxies. I changed a setting for a repository on the proxy, but I did not see any log entry in Event viewer under Application and Services -> Veeam Backup on the backup server.

Where can I find audit logging of who, what, when? Is there a way to get this into the event log, or is this solely in the log files?

[Shestakov]

Hello,
So far it's only in the logs.
But we are working on Backup Infrastructure Audit report which will be available in Veeam ONE.
Thanks!