Blogs and Podcasts

Veeam ONE helps organizations meet the challenges that come with digital transformation, navigating hypervisors, and meeting the data protection requirements of today’s businesses. It provides insights into backup status, resource usage, SLA Compliance, threat mitigation and observability. By leveraging Veeam ONE’s monitoring and analytics organizations gain complete visibility into their virtual and backup environment.The Veeam Data Platform continues to develop support for a variety of workload types, providing an easy way to protect data whether it resides in virtual, physical or cloud deployments, including enterprise applications and SaaS offerings. However, backup is only one factor when it comes to protecting an organization’s data. Organizations need also to consider how they can leverage security features, orchestrated recovery, and advanced monitoring to stay resilient and protected in today’s digital landscape. As workloads continue to move across platforms, it’s important t

IntroductionAs security operations centers (SOC) manage a daily flood of alerts and logs, the ability to effectively analyze and interpret this log data becomes an essential part of the cybersecurity workflow. Processing and investigating security incidents are the be-all and end-all of any SOC analyst. Before starting an investigation, we must have a common terminology to define attacks and security-related activities and a search that leads us to those activities.In my previous blog post, I demonstrated how log data from VBR can be sent to Elastic via Syslog for evaluation and visualization. Let us take a step back and start with the basics.The BasicsSecurity Information and Event Management (SIEM) systems centralize the collection and analysis of log data across diverse sources, offering features like data aggregation, uniform formatting, pattern detection through correlation, secure log storage, in-depth analysis, and detailed reporting to ensure comprehensive security event manage

ICYMI, the Story:On the 20th June, one of the two national datacenters in use by the Indonesian government was attacked, and ransomware deployed.Normally that is a headline in itself, but the story gets worse when you dive into it. This datacenter, housing more than 200 government agencies, had very little in the way of backups. According to an official from Indonesia’s cyber security agency, approximately 98% of the government data stored in the datacenter had not been backed up. (Source: TomsHardware). The government regardless took the stance that they would not pay for the decryption key and would instead manually proceed to working on decrypting & recovering the data, which I don’t doubt would be challenging if at all possible, and the risk to the integrity of the encrypted data is a reality here. In this scenario, the story supposedly has a happy ending, as the ransomware group behind this attack have allegedly apologised and offered a decryption key. Until the Indonesian gov

Hola! Hace un tiempo recibí mi OOTBI para comenzar a jugar con el,aquí tienes el enlace a mi post inicial:Os dejo aquí la entrada, que me parece mejor tener toda la info a la mano. Object First – OOTBI – Primer arranque y configuración.Tal y como vimos en la entrada anteriorAbrimos la caja y vimos nuestra unidad OOTBI.Ahora, es tiempo de encenderla, conectarnos por remoto a su consola, y realizar la configuración inicial del sistema, acceder a su GUI, y crear nuestro primer Bucket.Vamos…Nos conectamos a la IPMI de OOTBI, para encontrar la IP, yo escanee mi red con Advanced Easy Scanner…El usuario es ADMIN, la contraseña, la que viene escrita en la pestaña del frontal.Pantalla inicial del IPMI, desde aqui, vamos a controlar por remoto y encender nuestro OOTBIBoton rojo PowerPower Ondale!Ahora que está arrancando, nos vamos a la consola remota por HTML5Remote Console, Remote Console, Launch Console.Boom! aquí vemos como bootea nuestro OOTBI Os suena esta ventana? a mi mucho… donde la hab

It is worth noting that Object First Out-of-the-Box Immutability (OOTBI) provides true data immutability and is very simple to deploy, as we will see shortly and addresses the issue of slow recovery times that can make ransomware attacks damaging to operations and reputation.I will recommend deploying an OOTBI appliance due to the pervasive nature of cyber-attacks on data protection infrastructure (backup). With OOTBI, you will achieve efficient data recovery, a user-friendly and cost-effective solution that can effectively stop ransomware attacks. As you all know, this storage solution was purposely built for Veeam.Before using this guide, read the following articles below  Please follow the steps below to integrate Object First OOTBI with VBR. You may want to take a look at the original blog post for more information.Create an S3 KeyIn the previous guide, we have discussed the various ways to access Object first OOTBI web interface. Upon login, we will have to create an s3 key. To

Hello Community! SynopsisI couldn’t wait to get this out to you all. If you’ve been following along my Veeam Malware Detection journey, specifically with Inline Entropy scans, you know I’ve shared it has some shortcomings; although, it’s still a great tool to implement in your environment in my opinion.The post today coincides with my most recent Malware Forensics post on how to work through events you may receive from Veeam. Click below to read it if you like:Since my Forensics post a few weeks ago, Veeam has provided a few updates to its Malware Detection engine. UpdatesThe first update came with the latest Veeam Backup release, v12.1.2. Much of the Malware updates in this release came mostly from Community feedback on the Forums and pertained mostly to the File System Analysis (FSA) engine. I don’t use that engine in my environment, so not sure how well the update has worked with regard to FSA detection, false positives, and exclusions.The 2nd update is specifically for the Inline E

In this article, we will learn how to Migrate Veeam Configuration Database to PostgreSQL Server. I am sure you already know what PostgreSQL is. So let me not bore you with this information as some of our peers have already discussed this topic.   By default, PostgreSQL is used with all new installs of Veeam Backup & Replication 12. Existing Veeam Backup & Replication deployments that were upgraded from 11a or older will continue to use Microsoft SQL Server until they are manually migrated to PostgreSQL Why switch to PostgreSQL?Migrating Veeam Backup and Replication from Microsoft SQL Server (MSSQL) to PostgreSQL is driven by various reasons. Below are some common reasons to consider such a migrationCost saving: If you prioritize cost savings, choosing PostgreSQL for your database needs is an excellent option. It is an open-source database engine that is completely free to use, even for commercial purposes, under the PostgreSQL license.Mitigate Vendor Lockin: Migrating to Po

Hello Community! I am in the middle of modifying my Backup/DR environment →  adding infrastructure, upgrading VBR servers, etc, etc...basically a refresh cycle as it were. One of my VBR Servers is used for DR purposes using Veeam Replication. I created a new server for it on the newest server OS (2022) and did a Configuration Backup migration. This was the first time I performed a DB migration and was pleasantly surprised by the ease of this task. Well done Veeam! As for my other VBR server, I’m not wanting to do a DB migration. I’m going to recreate most everything from scratch for various reasons. But, out of just under 30 jobs I have on this server, I do want to retain 7 of them. Sadly, as some of you know based off a Hub post from a yr or so ago by @shawnl :..exporting Jobs isn’t really possible. I really would like a Backup/Copy Job export function in the Console personally. Anybody else concur this would be a useful feature add?But, I digress. My main purpose here is to provide t

This blog intend to assist SAs/SEs whose customers wants SAP integration(with Oracle databases) in OS platform like Windows, AIX etc. Q1. Customer’s SAP Environment is running on AIX or Windows with Oracle database as backend. Which solution should be proposed?A1. As there is no SAP on Oracle Plug-in for windows or AIX, we must utilize the Oracle RMAN Plug-in such cases.Ask the customer if he wants to utilize the advanced features of RMAN and can work independently without Brtools integration.If there are strict integration needed with Brtools, refer the Q&A in the following sections. Q2.Customer need strict integration with Brtools in such environments. How can this be integrated?A2. Brtools can be integrated with Oracle RMAN in the following waya. Ask the SAP Admin for the location of init<SID>.sap. From Oracle 12 onwards, it can usually found in /oracle/<SID>/sapprof/ b. Take the backup of the init<SID>.sap file c. Edit the file and configure the following para

In my interactions with numerous customers through my role, a recurring concern is their reluctance to grant open sudo access. However, many are more receptive to the idea of allowing limited sudo commands specifically needed by the application.Today, let's explore the sudo commands required by Veeam Backup & Replication v12 for the Veeam Agent for Linux. Bear in mind that this list is subject to modification based on community feedback. I encourage you to participate in this collaborative effort – feel free to suggest additions or removals to this list, which I've compiled based on my preliminary research.The necessary sudo commands for the veeamserviceraccount are as follows: veeamserveraccount ALL=/usr/bin/[ -d /tmp/ ],/usr/bin/id,/usr/bin/whoami,/usr/bin/mkdir,/usr/bin/rmdir,/usr/bin/arch,/usr/bin/uname,/opt/veeam/veeaminstaller,/usr/bin/rm,/usr/bin/cp,/usr/bin/chown,/usr/bin/veeamconfig,/usr/bin/chmod,/usr/bin/mv,/usr/bin/sh,/usr/bin/touch,/tmp/VeeamAgent*-*-*-*,/usr/bin/ps,/u

With the release of 12.1.2 on Tuesday May 21st and after completing several upgrades I decided to do a blog post on the update and upgrade process.You can find my blog here - https://just-virtualization.tech/2024/05/22/veeam-12-1-2-release-upgrade/ Veeam 12.1.2 Release – Upgrade On May 21, 2024, Veeam Software released an update to the Veeam Backup & Replication products in the form of version 12.1.2.172. This update addresses some critical security vulnerabilities as well as has new enhancements plus a ton more fixes to address other bugs and issues.You can find out more about the release from the following KB page – KB4510: Release Information for Veeam Backup & Replication 12.1 and UpdatesSome of the highlights for this release –VulnerabilitiesIndicated severity values are CVSS 3.1 scores.Veeam Backup Enterprise Manager (VBEM)CVE-2024-29849 | Severity: Critical (9.8)This vulnerability in Veeam Backup Enterprise Manager allows an unauthenticated attacker to log in to the Veea

Hi everyone,Veeam Community Hackathon banner for 2024. Alfred is sitting in the middle at a desk. He is about to press a run button with his paw. Binary code and a slider is shown on the left of Alfred. In the middle the word Hackathon is shown with arrowed lines pointing to icons and text describing several aspects of the Hackathon: Development, Brainstorm, Time, Presenting, Goal, Teamwork, Community. The 2nd Annual Veeam Community Hackathon is back, and it's bigger and better than ever! Sep 26 9 AM EST/15:00 CEST to Sep 29 9 AM EST/15:00 CEST We, @JonahMay and I (@mkevenaar) are back with a new round for the Veeam Community Hackathon. This year we are joined by @jos.maliepaard and @Mayhem, who will be helping us organising this event. Just like last year, teams will be working together to enhance one of the Veeam products. However, this year the team members will be closer together! And yes, you read it correctly, we have extended the event from 24 hours to a whopping 72 hours! Wheth

Veeam's Malware Detection feature released with v12.1 was certainly a much-anticipated and welcomed feature by many, me included. And, if you didn't read it, I even wrote about my initial experiences with it:But since enabling Inline Entropy Scan in my environment, I've really had to micro-manage it with regards to Malware events of potential malicious activity Veeam "finds". Veeam is certainly aware of the short-comings of the Inline Scan engine and I know they are hard at work preparing an update for release which I'm confident will make it better. See this Forums post for further details.In the meantime, I've had to really dig into doing a lot of Scan Backup and manual scan tasks, as well as get creative in how I do forensics on my systems to make sure the Malware Detection events I'm receiving are false positives. And if not, take care of those issues appropriately as well. I thought I'd share some of the forensics and analyses processes I'm doing in my environment to help the Comm

VMware's vSphere 8 Update 3 brings significant enhancements and new features, providing improved performance, flexibility, and security. Key Updates vSphere Live PatchvSphere Live Patch in Update 3 allows critical bug fixes without needing to reboot or evacuate hosts. This ensures minimal disruption as virtual machines undergo fast-suspend-resume (FSR) during patching. However, VMs with vSphere Fault Tolerance or using Direct Path I/O must be manually remediated.Partial Maintenance ModeThis new state allows existing VMs to continue running while disallowing the creation or migration of new VMs during vSphere Live Patch remediation tasks.Enhanced Image CustomizationvSphere Lifecycle Manager now supports more granular customization of images, including the removal of non-essential components and retaining specific driver versions, optimizing for remote and edge use cases.Dual DPU SupportvSphere 8 Update 3 introduces support for dual DPU configurations, enhancing high availability and net

VMware's vSphere 8 Update 3 introduces the powerful vSphere Live Patch feature, a significant advancement in maintaining system security and stability without the need for extensive downtime or service interruptions. What is vSphere Live Patch?OverviewvSphere Live Patch allows administrators to apply critical patches directly to the hypervisor layer without requiring a reboot or evacuation of hosts. This feature ensures continuous availability of virtual machines (VMs) while keeping the system secure and up-to-date.Key BenefitsMinimized Downtime: The Live Patch feature utilizes a fast-suspend-resume (FSR) process, ensuring minimal disruption to running VMs. This approach is particularly beneficial for environments requiring high availability and minimal service interruptions. Operational Efficiency: By eliminating the need for host reboots during patching, administrators can apply security fixes and updates more frequently and efficiently. This leads to improved system reliability and

IntroductionStarting with Veeam Backup & Replication version 12.1, VBR events can be sent to external syslog servers. A list of events can be found here.There are currently integrations for Splunk and Sophos MDR/XDR, which, among other things, provide better visibility to detect and stop threats targeting backup data. Further information can be found at the following URLs:Veeam App for Splunk Sophos MDR/VDR integrationNote: The possibilities with Veeam Backup & Replication are described in this blog post. The options with Veeam ONE are being investigated and will be created and documented later if necessary.Elastic StackThe Elastic Stack, often referred to as ELK Stack, is a powerful set of open-source tools used for a variety of data analytics purposes, particularly for searching, analyzing, and visualizing large volumes of data in real-time. The stack began as a collection of three "open source" products:Elasticsearch is a distributed, RESTful search and analytics engine. It

With v12 it will be supported to use group Managed Service Account (gMSA) for user credentials.For my understanding of gMSA it will be necessary to have VBR server in a domain. Because it will still not be recommended to join this server the production domain, a special resource or management domain could be needed. For more details we will have to wait for general availability to get the user guide.If you have more ideas about gMSA implementation, let us know 😀

I wanted to override the default DNS in WSL: add the following section to /ect/wsl.conf (if not present create the file)[network]generateResolvConf = false Then restart wls (in powershell wsl --shutdown) Create a normal resolv.conf file and add your dns settings. I also made the file immutable since someone posted that it would be wiped clean on reboot:sudo chattr +i resolv.conf  

Veeam for Mac is a data protection and disaster recovery solution designed for endpoints and virtual machines running macOS. With Veeam Backup for Mac, you can back up all user profiles data or individual files and folders. When disaster strikes, you can restore individual files and folders from backups to their original location or a new location.Why use Veeam Agent for Mac?Using Veeam Agent for Mac and not the default “Time machine” offers numerous benefits as mentioned above. But, let us look critically into some of the core benefits.Veeam Agent for Mac supports various backup destinations, including local storage, network shares, and cloud storage thereby providing users with the flexibility to choose the most suitable option based on their needs in order to adhere to the 3-2-1 Rule. With Veeam Agent for Mac, you can continue an interrupted backup session from where it stopped. Regardless of whether this is due to a network outage or someone closing your laptop while your backup jo

Hi Everyone, Sunny Spring day. If you have some time please listen to this great Podcast run by Veeam Vanguards Tom May and @JonahMay . It was a lot of fun and these two really smart fellows kept me on my toes! https://differentdev.com/episodes/

On-Prem Object Storage + Veeam Backup & Replication’s Instant VM Recovery = Rapid Recovery When we introduced the Capacity Tier in Veeam Backup & Replication (VBR) v9.5.4 early in 2019, there were few, if any, on-prem object storage platforms that would be recommended as a source for Instant VM Recovery (IVMR).  At that time on-prem object storage was not considered performative enough to sustain the speeds required to restore a single VM instantly, never mind multiple simultaneous restorations.But things have changed since those “early days”.  Now doing IVMR from on-prem object storage is commonplace.  Recently I worked with one of our Technical Alliance Partners (TAP), Spectra Logic, testing with their BlackPearl S3 Hybrid Cloud Object Storage.  One of the VBR features tested was IVMR and the results validated the performance that on-prem object storage can achieve.  Here are the details and results of this particular test:IVMR Test Scenario:The Instant VM Recovery test scena

What an exciting week this has been! I got the opportunity to attend VeeamON virtually from Columbus, OH, while the main event was in Ft. Lauderdale, Florida. The nice thing about hybrid events is that you can join them from other locations, making them more accessible to more people. Session-wise, I chose to focus primarily on Veeam Backup for Azure and Coveware by Veeam’s ransomware sessions since that’s where I’m geeking out lately. The nice thing is that several sessions are now available on demand, so attendees can go back and see what we missed.Of course, I started my time at VeeamON with the opening keynote where data and data resilience was the theme. Veeam CEO Anand Eswaran kicked us off wearing some awesome custom Veeam sneakers and introducing the City of Ft. Lauderdale’s CIO, Tamika McKay. McKay welcomed attendees to her city, highlighting Ft. Lauderdale’s role in the tech industry as well as its beaches and cultural offerings. She said her top priorities as CIO are cyberse

Recently as blogged already, I got a DS923+ Nas and here is one of the guides agreed upon. This short article will discuss how to set up iSCSI Target and Storage LUN on Synology DS923+ for VBR.ISCSI stands for Internet Small Computer System Interface. It revolutionizes storage accessibility by seamlessly transporting SCSI commands over TCP/IP networks, granting unparalleled block-level access to storage devices. This innovative technology bridges the gap between traditional storage systems and modern networking infrastructures, empowering businesses with efficient, scalable, and flexible storage solutions.iSCSI allows you to use a Windows repository with ReFS which leverages FastClone. Do you wish to learn more about why the Storage LUN Better is better than a Mapped Network Drive etc. Create iSCSI Targets/LUNYou can create an ISCSI target or LUn on a Synology DS923+. Since this is a pretty new device, we will create both on the fly.For simplicity, I will create a single LUN and presen

In the dynamic landscape of data protection, the efficacy of backups hinges not only on their creation but also on rigorous testing and validation processes. This article elucidates the paramount importance of regularly testing backups and underscores the significance of validation procedures, while also shedding light on the practical application of the 3-2-1-1-0 rule—a guiding principle in data backup strategy. Why Testing and Validation Are ImperativeEnsuring Data Integrity Regular testing of backups is essential to verify the integrity of the data being backed up. Data corruption, storage failures, or other unforeseen issues can compromise the integrity of backups. By routinely testing backups, organizations can identify and rectify any anomalies, thus ensuring that their data remains intact and recoverable.   Compliance Requirements Many industries are subject to regulatory compliance mandates that necessitate the implementation of robust data protection measures, including regula

I have been working on learning how Veeam SysLog can be utilized with the Azure SEIM tool Sentinel. This entry focuses on what I learned about KQL and an idea of how that can be useful when examining these events. I hope you find it useful, and if anyone wants to know more about the setup, just let me know. What is KQL?Kusto Query Language (KQL) is a powerful, read-only language designed to query structured, semi-structured, and unstructured data. It is primarily used with Azure Data Explorer for swift and interactive analysis of vast data sets.Why Use KQL?KQL is optimized for efficiently handling massive volumes of data, making it suitable for tasks like log analysis, telemetry data crunching, and monitoring applications and infrastructure. And is deeply integrated with various Microsoft services like Azure Monitor, Azure Log Analytics, and Application Insights. KQL's syntax is easy to pick up, especially for those familiar with SQL. It includes familiar clauses such as where, summari