Overview of Veeam ONE Alarms
The Veeam Data Platform provides data resiliency through backup and replication, recovery orchestration and monitoring and analytics. Through these different capabilities, Veeam powers data protection for organizations to mitigate threats and orchestrate recovery when disasters occur. Veeam ONE, a part of the Veeam Data Platform Advanced and Premium editions, provides comprehensive monitoring and analytics, providing complete visibility of critical events that are happening in the data center. Through the different alarms that are included within ONE, you can respond and remediate issues in real-time, avoiding downtime and data loss. With over 300 predefined alarms included, it’s important to understand the alarm lifecycle, how you can adjust alarms and their configuration parameters. All the alarms have predefined thresholds based on industry standards and best practices, however they can be adjusted or tailored to fit your business needs.
Popular Alarms
With all the alarms included in Veeam ONE, you may be asking yourself, but which alarms are the most important? This answer comes down to what you want to monitor. Are you only concerned about your data protection jobs and backup infrastructure? Do you want to monitor how your virtual environment and machines are using resources like CPU, Network, or what processes and services are being installed? Are you interested in being notified about capacity or repository usage? This is the first step I would take when considering alarms, notifications, and remediation.
When monitoring your data protection infrastructure, you will want to know if backups are finishing successfully, keep an eye on restore operations, ensure backup repositories are not running out of space and immutability has been set.
Backup Job State | Potential Malware in Backups | Restore Activity | Suspicious Incremental Backup Size | Veeam Malware detection alarms |
Backup Repository Free Space | Immutability State | Intelligent Diagnostics | Internal Alarms | Missing RPO |
The above table of alarms are some of the data protection alarms I always check to ensure my environment is healthy. Backup Job State alarm will quickly notify me if a backup job wasn’t successful. While Restore Activity lets me know if a restore is happening, this can be useful if we have multiple restore operators delegated in the environment. We also don’t want to forget about Veeam Intelligent Diagnostics, this group of alarms is comprised of signatures that have the power to detect known issues in backup performance and configuration. When triggered, the alarm provides detailed information on the issue, without having the need to address Veeam Technical Support.
It’s also important to consider what platform your workloads are running on and what applications you are protecting. Nutanix AHV? Cloud Workloads? Microsoft 365 organizations? For all supported platforms, Veeam ONE can monitor and alert on backup status, and its components, extending observability across protected workloads no matter what platform, hypervisor, or cloud you are using.
If you are running VMware vSphere or Microsoft Hyper-V, you have the option to monitor the virtual environment as well, allowing you to detect issues with alarms designed to check virtual infrastructure components. Alarms can notify you of orphaned snapshots consuming valuable space, datastore free space, resource usage, VM performance and if there are machines missing backups. Some of the alarms I always keep track of in my environment are listed below.
Guest Disk Space | Heartbeat is missing | High Memory Usage | Latest Snapshot Age |
Latest Snapshot Size | Potential Infrastructure Malware activity | Orphaned VM backup snapshot | Possible Ransomware activity |
Too many snapshots on the VM | VM Connection Failure | VM CPU usage | Missing RPO |
Datastore Free Space | Datastore over-allocation | Bad login attempts | VM CPU Ready |
Adjusting Alarms
Alarms included within Veeam ONE come pre-defined based on industry standards and best practices. However, sometimes we need to tune alarms to better fit the environment or even a specific workload. For this, each alarm is adjustable, allowing you to configure rules, actions, and notifications easily.
Depending on how long you have had Veeam ONE running in your environment, you can use Alarm Modeling. This can be found in the menu, under “Alarm Modeling”. From here, you can choose which environment you want to model, either the virtual infrastructure or backup infrastructure, and then run analysis. You can model all the enabled alarms or only a specific alarm that may be ‘too noisy’. When the analysis is complete, you will see how many times an alarm has been triggered during a certain period of time, allowing you to analyze what workloads are triggering the alarm, and adjust or copy alarms to better fit your environment.
After using Alarm Modeling for analysis, you can edit the alarms to better tune them based on your environment. To do this, you can simply right click on the alarm and select edit.
From here, you can adjust the alarm as needed. There are several options you can configure and/or modify including rules, assignment, notifications, actions, and suppression settings.
Editing Alarm Rules
You can edit the counters and thresholds under the rules tab. Depending on the alarm, different thresholds will be available. For example, The VM Snapshot age alarm looks at the minutes, hours, or days since a snapshot has been created. On the other hand, the Scale-out backup repository data transfer session state considers different rules including the session type, for example if it was an offload, download, archive and retrieval session.
Assignment
The assignment section can be very useful, especially when we think about copying an alarm or creating a new alarm for a specific machine. We can change the assignment of the alarm from covering the entire environment, to specific machine, business view group, backup server, etc.
Notifications
Notifications should be configured to receive real-time messages about issues occurring in the environment. Depending on how you want to receive alarm notifications, there are some different options available, which includes email, SNMP trap, integration with ServiceNow to create an incident or a Syslog alarm.
Configuring Actions
Pre-defined remediation actions are available for some of the most common alarms. Actions can help streamline resolution. If a pre-defined action is not available, you have the option to write a script to perform an action. This can happen automatically when the issue occurs, or manually, requiring you to approve the action within Veeam ONE.
Suppression
The last setting you can configure is suppression. Suppression settings minimize notifications when planned resource consuming operations or other activities are occurring. This could be set during Veeam Backup activity, snapshot creation or deletion, and can be set for a specific period of time, daily or on certain days.
Copying Alarms
One thing I find useful is the ability to copy alarms. I think this works well when you want to keep the default settings that come configured out-of-the-box, but also want to modify the alarm to fit a specific workload. This allows you to assign the copied alarm to a specific workload without having to adjust the original alarm settings.
For example, maybe you have machines that require different Recovery Point Objectives ( RPOs) an easy way to ensure that they RPOs are being met is the VM with no backup alarm. This alarm can be copied, adjusted and then assigned to different parts of the infrastructure, so they are only triggered when certain parameters are met.
Manage and Interact with Alarms for Maximum Efficiency
Veeam ONE is the primary tool for monitoring Veeam backup environments, providing complete visibility to increase efficiency and minimize bottlenecks in the data center. Through its different alarms, you can troubleshoot issues in real time before they become bigger problems. By monitoring and tracking backup operations you can ensure you are meeting RPO requirements and maintaining compliance for your business. Working with alarms and adjusting them to fit your environments has many benefits, one for instance, is simply minimizing the amount of noise you have throughout the day, and only receiving the notifications that matter. Combining this with the option to add actions to each alarm to remediate issues automatically, you can streamline troubleshooting, freeing up time for you to work on other matters. The one aspect of alarms I didn’t touch on throughout this post is how to create Veeam ONE alarms. Don’t worry, that post will come soon.
What are some ways you utilize the alarms in Veeam ONE? Are there any alarms you find more helpful than others? If so, leave a comment below.