+1I’ve been testing syslog with v12.1 and I cant seem to see messages related to an unsuccessful login to the VBR console. We see messages for logins and logouts but not unsuccessful.
I’ve also configured Veeam ONE syslog and this seems to show all logins but not VBR.
I have even tested this with the Veeam lab “test drive 12.1” at https://propartner.veeam.com/hands-on-labs/
has anyone else tested this at all or had experience of it? We need to get unsuccessful logins somehow…. thanks
Best answer by coolsport00
Hi
It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.
Hope this helps.
+21Hi
It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.
Hope this helps.
+21I am glad to see this post as we are going to implement Syslog connections for all our Veeam servers, and this is definitely a nice to have for sure along with MFA. Going to follow that forum post too. 👌🏻
+1Hi
It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.
Hope this helps.
thanks for the response. Does seem strange that the SIEM integration (syslog) feature is there but VBR doesnt sent to syslog. Looks like it still uses windows event logs where as VONE and EM will forward to syslog server….
+21Yeah, it does sadly.
+21I recommend following the Forum post I shared to keep tabs on any updates Veeam has.
+7Hi
It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.
Hope this helps.
This is correct. As I understand it with 12.1 the goal was to get the same items you’d find in the local Windows Event Viewer from Veeam into syslog with the idea they would use that to build on in future versions.
+14While this is not what you were asking for, Veeam does log MFA events; for example invalid MFA code.
https://helpcenter.veeam.com/docs/backup/vsphere/vbr_events_security.html?ver=120
So if you enable MFA for your users, you would at least get those events.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
