When auditors come knocking—or worse, when bad actors strike—not having accurate and complete event logs can make all the difference in how your organization survives the encounter.
However, users are often understandably more focused on day-to-day operations and only think to look for this information once it’s needed (and when time is of the essence).
The good news is that all the information you need—including where to find changes in Veeam server user access permissions, failed login attempts, and failed RDP connections—is available in several different locations, including:
- Windows Event Viewer
- Veeam Backup and Replication Audit logs for performed restores
- Veeam One Audit log
- The individual application log(s)
Windows Event Viewer
Many Veeam activities (success, warning, and failures) get logged to the Windows Event viewer by default.
To see these events from within the Veeam Backup and Replication (VBR) server, open the Windows Event Viewer console and Migrate to the Veeam Backup node. For a Windows Server running the Veeam Agent for Windows, investigate the Veeam Agent node.
Some captured events include:
- Changes to the VBR security groups
- Changes to repository settings
- Changes to the general options in the VBR GUI
- Passwords in the password manager change
A complete list can be found in the Veeam Backup and Replication User Guide.
Windows can capture the state of login attempts to the server and other applications to the Event Viewer logs if this feature is enabled through a group policy. It is off by default.
These Veeam events can be alerted by any other software that can monitor and exam Windows Events Logs Like Microsoft System Center.
Veeam Backup and Replication Audit log location
Restore operations performed in Veeam Backup and Replication (VBR) server console get logged to an audit file stored on the Server. By default, the path to the audit logs is %ProgramData%\Veeam\Backup\Audit.
This location can be changed on the general options page in the VBR GUI.
Just drill down through the log location to find the restore files needed to get to the logs. In my case, I am looking for a SQL Explorer restore performed in August 2022. Since the restore was done in the latest month, I’ll look in the file with the same month digit as the restore I want to check. Open the file and check the date range of the file.
I found the SQL restore I am looking for. When I opened it up, I saw that a SQL restore was performed on 8/8 at 18:46 by a user.
Veeam One is a backup and report server that can collect and hold events from one to multiple VBR servers in a DB.
Two reports in Veeam One show information about a customer’s Veeam backup environment.
- Backup Infrastructure Audit
- Backup Objects Change Tracking
Both reports can be scoped to a specific time frame, objects, and jobs.
The record all changes made to the Veeam configuration database along with date change, who changed something, and what was changed.
The reports can be found in the Veeam One Report interface under the Backup Monitoring section.
Veeam Backup and Replication logging
VBR provides detailed logging of almost all backup and restore-related events. These logs can be accessed from the following locations.
- On the backup server, log files are stored in the following folder: %ProgramData%\Veeam\Backup.
- If you run Veeam Backup & Replication Console as a non-privileged user, log files are stored in the user’s AppData folder: \<username>\AppData\Local\Veeam\Backup.
- On Linux servers and ESXi hosts, logs are stored in the following directory: /var/log/VeeamBackup/ or /tmp/VeeamBackup
- On Microsoft Windows servers, logs are stored in the following directory: %ProgramData%\Veeam\Backup
Providing accurate logs that are easy to view is essential to monitoring the health of a server and the backup environment. Logging also helps notice and detect any drift away from a proper and secure system, either accidentally or by a rogue insider.