Skip to main content
  • EN

I’ve been testing syslog with v12.1 and I cant seem to see messages related to an unsuccessful login to the VBR console. We see messages for logins and logouts but not unsuccessful.

I’ve also configured Veeam ONE syslog and this seems to show all logins but not VBR.

I have even tested this with the Veeam lab “test drive 12.1” at https://propartner.veeam.com/hands-on-labs/

 

has anyone else tested this at all or had experience of it? We need to get unsuccessful logins somehow…. thanks

Hi @MavMikeVBR -

It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.

Hope this helps.

 

I am glad to see this post as we are going to implement Syslog connections for all our Veeam servers, and this is definitely a nice to have for sure along with MFA.  Going to follow that forum post too.  👌🏻

Hi @MavMikeVBR -

It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.

Hope this helps.

 

thanks for the response. Does seem strange that the SIEM integration (syslog) feature is there but VBR doesnt sent to syslog. Looks like it still uses windows event logs where as VONE and EM will forward to syslog server….

Yeah, it does sadly.

I recommend following the Forum post I shared to keep tabs on any updates Veeam has.

Hi @MavMikeVBR -

It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.

Hope this helps.

 

This is correct. As I understand it with 12.1 the goal was to get the same items you’d find in the local Windows Event Viewer from Veeam into syslog with the idea they would use that to build on in future versions.

While this is not what you were asking for, Veeam does log MFA events; for example invalid MFA code.

https://helpcenter.veeam.com/docs/backup/vsphere/vbr_events_security.html?ver=120

So if you enable MFA for your users, you would at least get those events.

Comment


Terms & Conditions