• EN
Solved

Veeam 12.1 syslog and unsuccessful logins

MavMikeVBR
Userlevel 5

I’ve been testing syslog with v12.1 and I cant seem to see messages related to an unsuccessful login to the VBR console. We see messages for logins and logouts but not unsuccessful.

I’ve also configured Veeam ONE syslog and this seems to show all logins but not VBR.

I have even tested this with the Veeam lab “test drive 12.1” at https://propartner.veeam.com/hands-on-labs/

 

has anyone else tested this at all or had experience of it? We need to get unsuccessful logins somehow…. thanks

icon

Best answer by coolsport00 21 March 2024, 13:04

View original

7 comments

coolsport00
Userlevel 7
Badge +17

Hi @MavMikeVBR -

It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.

Hope this helps.

 

Shane Williford - Veeam VMCA/VMCE | Veeam Legend | VUG Leader | VCP-DCV | Twitter: @coolsport00
Chris.Childerhose
Userlevel 7
Badge +20

I am glad to see this post as we are going to implement Syslog connections for all our Veeam servers, and this is definitely a nice to have for sure along with MFA.  Going to follow that forum post too.  👌🏻

Chris Childerhose - VMCA2022 | VMCE2023 | Veeam Vanguard 7* | Veeam Legend 3* | vExpert 5* | VCAP-DCV/VCP-DCV | Object First Ace | Cisco Champion | Twitter: @cchilderhose | Blog Site – https://just-virtualization.tech
MavMikeVBR
Userlevel 5

Hi @MavMikeVBR -

It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.

Hope this helps.

 

thanks for the response. Does seem strange that the SIEM integration (syslog) feature is there but VBR doesnt sent to syslog. Looks like it still uses windows event logs where as VONE and EM will forward to syslog server….

coolsport00
Userlevel 7
Badge +17

Yeah, it does sadly.

Shane Williford - Veeam VMCA/VMCE | Veeam Legend | VUG Leader | VCP-DCV | Twitter: @coolsport00
coolsport00
Userlevel 7
Badge +17

I recommend following the Forum post I shared to keep tabs on any updates Veeam has.

Shane Williford - Veeam VMCA/VMCE | Veeam Legend | VUG Leader | VCP-DCV | Twitter: @coolsport00
k00laidIT
Userlevel 6
Badge +6

Hi @MavMikeVBR -

It appears, as noted in this Forum post , sending logon events to a SIEM isn’t yet feasible. It looks like Veeam is looking to maybe have a feature enhancement in a future release.

Hope this helps.

 

This is correct. As I understand it with 12.1 the goal was to get the same items you’d find in the local Windows Event Viewer from Veeam into syslog with the idea they would use that to build on in future versions.

Jim Jones, @k00laidIT, AWS Community Builder, Cisco Champion, vExpert, Veeam Vanguard
regnor
Userlevel 7
Badge +14

While this is not what you were asking for, Veeam does log MFA events; for example invalid MFA code.

https://helpcenter.veeam.com/docs/backup/vsphere/vbr_events_security.html?ver=120

So if you enable MFA for your users, you would at least get those events.

Max M. | Systems Engineer @Veeam | VMCE/VMCA | former Legend & Vanguard

Comment


Terms & Conditions