Skip to main content
Question

Malware Analysis errors - B&R still referencing old workstation name


  • B&R 12.3.1.1139
  • VOne 12.3.0.4670
  • Agent for MS 6.3.1.1074

Job managed by agent

A few months ago, I replaced a physical workstation that uses Windows Agent. I reinstalled the old SSD into the new computer. I renamed the PC. Everything works, including Veeam Agent backups but I noticed that email alerts and Malware scan related errors still reference the old computer name even though the new pc name is displayed in the B&R control panel.

Since updating to B&R 12.3 and enabling Veeam Threat Hunter, I get the following email alerts:

  • [Error] Malware analysis session has failed unexpectedly: Action completed with error
  • [Failed] Daily malware detection report (0 malware events for 0 workloads)

Image

On the B&R server, I see the following in: C:\ProgramData\Veeam\Backup\Svc.VeeamDataAnalyzer.log

Code: Select all

[CRansomwareSessionMailer] Sending session failure email report...
[25.01.2025 01:33:13.265]    <48>    Info (3)    [DB] Generating xml report
[25.01.2025 01:33:13.328]    <48>    Info (3)    [DB] Transforming xml report to html report
[25.01.2025 01:33:13.375]    <48>    Info (3)    [CReportMailer] Sending e-mail notification, server 'SMTP Server 'mail.EXAMPLE.com', port '587', timeout '100000', use ssl 'True'', to 'jeff@EXAMPLE.com'
[25.01.2025 01:33:13.468]    <48>    Info (4)    Certificate trusted.
[25.01.2025 01:33:13.531]    <48>    Info (3)    [CRansomwareSessionMailer] Session failure email report was sent successfully
[25.01.2025 01:33:13.531]    <48>   Error (3)    Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\2025_0125.0629.4a84dfd48d73414eb22a6c3e049b166f\internal\refs.txt not found (System.Exception)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.RealProxy.WrapMethodCalling[T](Func`1 func)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.<>c__DisplayClass6_0.<GetResult>b__0(RealProxy p)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.Common.CWcfRetryableProxy`1.Invoke[U](Func`2 func)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.RansomwareScanner.CGuestIndexAnalyzer.AnalyzeIndexDelta(CRansomwareAnalysisTask task)
[25.01.2025 01:33:13.531]    <48>   Error (3)    [GuestIndexAnalyzer] Failed to analyze index delta
[25.01.2025 01:33:13.531]    <48>   Error (3)    Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\2025_0125.0629.4a84dfd48d73414eb22a6c3e049b166f\internal\refs.txt not found (System.Exception)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.RealProxy.WrapMethodCalling[T](Func`1 func)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.Interaction.CatalogClient.CWcfGuestIndexDeltaProxy.<>c__DisplayClass6_0.<GetResult>b__0(RealProxy p)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.Common.CWcfRetryableProxy`1.Invoke[U](Func`2 func)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.RansomwareScanner.CGuestIndexAnalyzer.AnalyzeIndexDelta(CRansomwareAnalysisTask task)
[25.01.2025 01:33:13.531]    <48>   Error (3)       at Veeam.Backup.RansomwareScanner.ExtensionMethods.AnalyzeWithRetrySafe(IIndexAnalyzer analyzer, CRansomwareAnalysisTask task, ILogScope log)
[25.01.2025 01:33:13.531]    <48>    Info (3)    [GuestIndexAnalyzer] 1:Sleeping between retries for 30 seconds...
[25.01.2025 01:33:43.547]    <48>    Info (3)    [GuestIndexAnalyzer] VM [PC-7050]: analyzing point 1/25/2025 6:29:30 AM\4a84dfd4-8d73-414e-b22a-6c3e049b166f) delta
[25.01.2025 01:33:43.547]    <48>   Error (3)    Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\2025_0125.0629.4a84dfd48d73414eb22a6c3e049b166f\internal\refs.txt not found
[25.01.2025 01:33:43.547]    <48>   Error (3)    Catalog folder has invalid structure: file C:\VBRCatalog\Index\Machines\PC-7050\

PC-7050 is the old pc name.

On the B&R server, when I browse to C:\VBRCatalog\Index\Machines, the folder for the workstation has the new name, not PC-7050. I have already tried deleting and recreating the backup job on the PC, after the PC was renamed.

I opened a ticket with Veeam Support back in early February but it was closed due to lack of resources for NFR licensed customers. Has anyone encountered this and/or know how to fix? Thanks!

0 comments

Be the first to comment!

Comment