• EN

Topics started by Michael Melter

32 Topics

Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

VMCE v12 exam review and tips

VMCE v12 trainingA brand new VMCE v12 training course was launched in September. The 3-day training now includes many of the great things that have been implemented in this version.Find your training here: Veeam Certified Engineer (VMCE) Training VMCE v12 examThe associated VMCE v12 exam has been available since 1 October. As a Veeam certified trainer myself, I have to be compliant within the next 60 days. That's why I planned a tough schedule and scheduled the exam just one day after this year’s Veeam100 summit in Prague 😀.Schedule your exam here: Get Veeam Certified Now! Exam flavorsThis time I took an online protored exam with PearsonVUE. I used to like on-site exams better, but since Covid I have gotten used to online exams and actually like them more now because of the time savings.The process is fairly straightforward. Once you have registered, you will receive an email with all the information you need. I strongly recommend that you do the test of your environment that is offer

20
coolsport00
16 days ago
Michael Melter
Michael MelterVeeam Legend
posted in Cyber Security Space

Expect the unexpected - find out about intruders roaming your backup environment fast and easy

What is this about?There's a saying in IT security that it's never a question of if, but when you'll be attacked by intruders.We're already doing a lot to harden our VBR and VB365 servers.However, we must always assume that attackers will be able to bypass our defenses and gain access to our systems. That's why we always have at least one immutable repository (VHR, S3 w/object-lock, tape, ...).But even then, it could be a matter of time before an attacker can bypass time-based object locks. So we would definitely want to know as soon as possible when bad guys are strolling through our perimeter. Have little birds tweet youThe concept of placing so called “honeypots” in an IT environment is well established: Honeypot (computing) - Wikipedia. Designing, placing and maintaining smart honeypots - like e.g. a fake VBR server - is a cumbersome process that needs attention.We can do something much simpler that will also give us knowledge of intruders roaming our networks.In former times miner

5
dloseke
2 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Discussion Boards

Veeam plugins - check VBR version compatibility BEFORE upgrading - it's not as it seems

Just a heads up for those of you using Veeam plugins. Especially, if they are unmanaged by VBR, which we see quite often for the large line of business applications.Today we have plugins for SAP-HANA, SAP on Oracle (Linux only), Oracle RMAN (Windows and Linux), IBM Db2 and MS-SQL.Having done quite a few upgrades for larger customers recently, I had to learn some non-obvious peculiarities about plugin compatibility:First, you might think (as I did), that VBR always supports the plugin of the major release below the one you’re upgrading to. In fact, it says so in the help center: “Veeam Backup & Replication supports the latest two major versions of Veeam Plug-ins.” (System Requirements - Veeam Plug-ins for Enterprise Applications).The challange is in the term “major version”. To me, that would have meant the number before the decimal point. For example, 12 for 12.x, 11 for 11.x. As it turns out, this is not the case. The next sentence in the help center link above already invalidates

6
marco_s
2 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Discussion Boards

Keeping your Veeam Hardened Repository safe and secure for up to 10 years

What and why?The Veeam Hardened Repo (VHR) is definitely in my top 10 list of product features. However, as with any IT system, having it in place means that it needs to be maintained. Veeam's own components are maintained by Veeam during patches or upgrades. With the initial release of 12.1, updating a VHR is still a partly manual task. You will need to enable SSH to do this. Cumulative Update 1 to 12.1 should allow us to update the Veeam services without having to enable SSH: https://forums.veeam.com/veeam-backup-replication-f2/upgrade-of-vbr-to-12-1-with-hardened-repo-t91251.htmlBut there is more to it than that! The Linux underneath also needs to be maintained. Update your Linux underneathFor example, as Ubuntu is one of the recommended distributions to use with a VHR, this is of course easily achieved through its package management system APT.We always recommend using LTS releases. With those you immediately get 5 years of update support after their initial release date. For 20.04

7
Michael Melter
4 months ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

VB365 V7a change log

Veeam released V7a of VB365 just recently (Dec 5th, 2023).https://forums.veeam.com/veeam-backup-for-microsoft-365-f47/current-version-is-1-0-0-860-ga-t39185.htmlThe KB for the patches to 7.0 has all the changes of 7.0.x: https://www.veeam.com/kb4425With a new major release (e.g. V7) we get the changes within the “what’s new” document: https://www.veeam.com/veeam_backup_m365_7_0_whats_new_wn.pdfThere does not seem to be a “what’s new” document for 7a (7.1.x). Here I can only find the full release notes which makes it kind of hard to determine changes.Did anyone find the specific changes within 7a already?

5
Chris.Childerhose
4 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Discussion Boards

VB365 V7/7a - There is an error in XML document

Just a heads up for a hotfix to VB365.We recently faced multiple errors within our MSP stack for VB365:Processing mailbox xyz failed with error: There is an error in XML document (1, 5332).. The specified type was not recognized: name='SharingMessage' Turned out to be a problem introduced by some changes Microsoft applied to M365.Veeam published a hotfix just a few days later: https://www.veeam.com/kb4527It’s applicable to the most recent version of 7 (7.0.0.4388) as well as 7a (7.1.0.1301) and I can confirm it to solve the issue.You have to stop all services and replace Veeam.Ews.dll in 4 different locations.Make sure to rename or copy the files to be replaced beforehand and have or create a backup of the VB365 system.  

2
Chris.Childerhose
4 months ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

Plugin all of a sudden consuming license - though VM is part of socket license

In a customer environment today we faced the issue that all HANA plugin backups all of a sudden stopped backing up:Session failed: Unable to process the workload: your license has been exceeded   In VBR’s license dialog I found the plugins to consume VUL licenses all of a sudden - which there are only the 6 complimentary ones. The plugins run on VMs already under socket licensing and that worked for years.Has anyone seen this already? How does VBR actually determine if the plugin resides on a VM? This process seems to be impaired here.Case is open. Support is digging through plugin logs. ThanksMichael

6
JMeixner
4 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Cyber Security Space

Four critical CVEs patched in VeeamONE (KB4508)

 Yesterday (Nov 6th, 2023) Veeam released a hotfix to mitigate four critical issues in VeeamONE (VONE).KB4508: CVE-2023-38547 | CVE-2023-38548 | CVE-2023-38549 | CVE-2023-41723 (veeam.com)Two of them score 9.8 and 9.9. One of those two allows for remote code execution on the SQL server used for VONE, while the other enables a non-privileged VONE portal user to gain the NTLM hash of the user that runs the reporting service.Therefore it is absolutely mandatory to patch those ASAP.Patching is fast and easy, as long as you’re on the most recent Version already (Veeam ONE 12 P20230314, 12.0.1.2591).The patch comes as a zip of ~1,2MB in size.It unpacks into a folder structure as shown. It consists of 8 files in total: First of all you must check if the most recent edition is used. This can easily be done using PS:Get-WmiObject -Class Win32_Product | where {$_.Name -like "Veeam ONE*"} | select Name, VersionI’ve been on the correct version already.If not, you first have to patch using the regu

14
Chris.Childerhose
5 months ago
Michael Melter
Michael MelterVeeam Legend
posted in YARA and Script Library

SQL log-shipping, but only on certain days - find out how

In a customer project I just stumbled across the requirement to do SQL log-shipping with VMs. A simple task, I thought at first. But this time the request included a so-called division by zero - at least from a VBR perspective. With VBR (at least until V12), it is not possible to restrict log-shipping to certain days of the week. You can only set the overall frequency of log backups: Microsoft SQL Server Transaction Log Settings - User Guide for VMware vSphere (veeam.com)You can set a schedule for image-level backups of course. But in between, log backups are performed continuously as defined by the above setting.It came in very handy that @SteveHeart recently published another script that can determine which VBR backup job a PS script was started out of. The code in mention to actually determine the process ID of the VBR job above goes back to @tsightler. So the script can be used flexibly as you don’t have to hard code job names etc. So I “borrowed” this code and enriched it with tog

2
Chris.Childerhose
6 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

Entire VM restore - Veeam hallucinating hard disks - solved

I just had a situation in a customer environment where the customer complained that a restored VM had more disks than the one that was backed up before (6 instead of 5 for a SQL Server VM).The recovery was done using Entire VM Restore - User Guide for VMware vSphere (veeam.com).When restoring to the original location, Veeam prompts you that the original VM will be deleted first:At first, I though this was related to the user that Veeam uses to access vCenter no having the appropriate rights. For example, the user does not have permissions to delete the VM.But then I noticed that the additional disk to be 200GB in size. The old state the we wanted to restore only had 2x100, 2x300 and 1x500. So where did the 200GB disk come from?It turns out that the size of this disk was adjusted by the VMware team a few weeks ago (100 → 200). We wanted to restore from an older state with the 100GB still there. Could this be the reason? Does VBR leave resized disks being alone while recovering and adds

9
Scott
8 months ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

SureBackup with Agents fails with "cannot detect IP address"

SureBackup with Agents is a brand new V12 feature I already blogged about:SureBackup with physical workloads - and some more gems | Veeam Community Resource HubAlready using it in production environments, we now faced an issue with a job consisting of a DC and and Exchange server. Both are physical machines originally. For the DC everything worked fine in the SureBackup run. But the Exchange server failed with:Error: Results: cannot detect IP addressThis is right at the beginning of the testing process and even when I disable all checks.Doing an Instant-Recovery manually with the Exchange, I could determined that the exchange VM - after the necessary P2V and intial boot - shows up an “unknown network adapter” in device manager. Installing the built-in Windows driver for the E1000 with a right-click directly brought up the interface. I guess SureBackup failed to do that automatically.So question is, why does VBR do that correctly for the DC and fails for the Exchange.We’ll try pre-insta

9
Michael Melter
10 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

Restore of Exchange items while not being able to reach the proper Global Catalog server (GC) - solved

I was able to solve this challenge in a project and would like to share the findings. The challengeConsider you want to restore Exchange items (e.g. mails, calendar objects, etc.) using Veeam Explorer for Exchange as well as Veeam Enterprise Manager.Consider also, that you have a larger multi-domain infrastructure with the VI and backup infrastructure in a sub-domain (infra.mydomain.com). For security reasons, we are not able to reach the GC of the root domain. The mail addresses are derived from the root domain though (myuser@mydomain.com).This might lead to the situation that neither Veeam Explorer for Exchange nor Veeam Enterprise Manager can determine the CAS server of your Exchange environment, as they want to contact the GC in charge first. This is even if they can easily reach the CAS itself. You can observe this in the corresponding logs (%programdata%\Veeam\Backup\ExchangeExplorer\Logs): 13.04.2023 15:35:39   15 (17156)  Looking for mailbox 'myuser@mydomain.com' in Global Cata

3
BertrandFR
10 months ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

Oracle ACFS

We can well backup Oracle databases sitting on ASM clusters using the RMAN plugin:Veeam Plug-in for Oracle RMAN - Veeam Plug-ins for Enterprise Applications But there is more to ASM clusters. You might also have ACFS as an Oracle-homed cluster FS. It is not used for the database files themselves as these are located in the ASM itself. ACFS is rather meant to host supporting files around the databases throughout the cluster (general purpose files, shared database homes, administrative files, log files, trace and audit files, scripts, etc.).It appears to be necessary to backup those files in conjunction with an ASM/RAC clusters next to the pure DB using RMAN and the Veeam plugin as well. Dead-end #1:Most Oracle systems run on physical systems for the “unconventional” license requirements Oracle tries to apply. Therefore first idea to grab those files would be the Veeam Agent.Unfortunately, Veeam Agent does not support ASM clusters. At least not from an Oracle perspective: Oracle Backup -

8
BertrandFR
11 months ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

Restore permissions for Veeam Backup for Office 365

To back up data from M365 one can pre-create an app within AzureAD and connect via a certificate from VBM. Then no additional login to M365 is necessary:Step 5. Register or Select Azure AD Application - Veeam Backup for Microsoft 365 GuideKeep in mind that you do not need to select this check box if you have granted the required permissions to the specified Azure AD application beforehand and already registered its certificate in Azure Active Directory. If the Grant this application required permissions and register its certificate in Azure AD check box is not selected, Veeam Backup for Microsoft 365 skips the Log in to Microsoft 365 step and proceeds to Finish Working With Wizard.But once you want to restore back to M365 things change: From within Exchange Explorer, you are prompted to do the device flow login with e.g. an Exchange admin to restore mail objects.Though while deploying the AzureAD-App an impersonation user was already specified. Is there a way to pre-define rights to th

7
Michael Melter
11 months ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

Restore full mailbox with Veeam Explorer for Exchange - ID handling

If you want to restore a deleted Exchange mailbox (on-prem), you first have to create an empty mailbox within Exchange for the user. This has already been described earlier: https://forums.veeam.com/veeam-backup-replication-f2/restore-deleted-mailbox-with-veeam-explorer-for-exchange-t16174.html Challenge is, while creating a new mailbox you also create a new ID for it. This leads to loosing some functionality (permissions to folders for 3rd parties etc., recurring appointments, etc.). Is there another known way to recover the mailbox including its original ID?I would rather have expected VEXE to create the mailbox for me while recovering - including all metadata.

4
Michael Melter
11 months ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

SOBR Archive Tier – Explained and Configured – Part 4 of 4

This is part four of the blogpost. If you want to read it from the beginning, head here: SOBR Archive Tier – Explained and Configured – Part 1 of 4 | Veeam Community Resource HubIn this last part, we will cover the free section of our feat and put things together in VBR.Setup within VBRNow it’s time to create the new object storage inside your VBR console. Add a backup repository of the type “Object storage”.Add new object repository to be used as archive tier. Choose the appropriate hyperscaler. For the archive tier currently only AWS and Azure are supported. We’ve used Azure in the example.Only Amazon S3 (AWS) and Azure can leverage the archive tier.Now the differentiation from capacity tier is made by selecting “Azure Blob Storage Archive Tier” instead of just “Azure Blob Storage”.Make sure to select the special option for the archive tier.Give the new repository a nice name and description within VBR.Very inventive name, isn’t it?And provide your storage account name and the shared

7
W
1 year ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

Agent backup of Windows failover cluster - CBT warning after switchover

In an agent job for a WSFC (fileserver role) we see a warning after having switched over to the secondary node. Each job run now finishes with a warning that CBT table has changed.As with VM backups I expected the warning to disappear in the next cycle - but it didn’t. How can I reset the CBT for an agent backup (not hypervisor based CBT but Veeam CBT driver here)?

4
Michael Melter
1 year ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

Azure Immutablity - possible to enable it on existing container?

One of the great features we’ve gotten with V12 is object-lock with Azure S3.@Rick Vanover did a great walkthrough for MS Ignite last year with a V12 beta already.With new storage accounts and containers it works as he explained, which I could prove in a few environments already. My (and some of my customer’s) question now is: can we enable it safely and supportedly on an existing blob bucket with let’s say hundreds of TB of data already inside? First, you would have to enable “version level immutabilty” within the container: Quite easy while creating a new container like Rick has shown, but if you would want to do this afterwards, you first had to enable a policy on the container: Having this policy also makes the container differ from a freshly set-up immutable container. The latter would not have this policy.To add this policy one would also have to enable versioning for the storage account beforehand: I tried that in a testing environment and ended up being able to activate immutab

4
Michael Melter
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

SureBackup with physical workloads - and some more gems

@vNote42 already teased earlier, that we will probably see something alike in V12:https://community.veeam.com/blogs-and-podcasts-57/what-else-is-new-in-v12-vii-universal-surebackup-job-3073With V11 already having brought us cross convertibility between agent backups and VM backups for Instant-Recovery, it was quite logical to have this next.V12 ist in production now, so I couldn’t wait to test this functionality! 😎 How to set up?It’s very easy and straightforward to setup. The only difference here is, that you have to pick your VM from an agent job into the application group for your SureBackup job: I used a small physical Veeam server of my demo environment as en example here.Pay special attention to the reduction of your memory here. For VM->VM SureBackups this is often overlooked. But physical machines tend to have a lot more RAM that you might not want to allow them to be chopped off from your hypervisor during the testing.While creating the application group, I noticed two mor

11
BertrandFR
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

V11 - New feature - Prioritize primary backup job - why and how it works

While updating our VCSP stack with V11-RTM, I just stumble again onto this small but fine new feature to prioritize your primary backup jobs:More than once I had customers request several jobs to be finished with priority.You could of cause concatenate jobs with the schedule option “After this job:”. But this is not recommended as it does not use the ressources of your backup system accordingly. Valuable proxy/repo slots would linger out-of-work for quite a while.Overlapping jobs would lead to the second job jumping in with the first one still running, so saturating ressources. But this might easily oversteer and thus delay the first job.With the new option this problem can be solved by just the click of a checkbox.Prioritized jobs get a nice little flag in the job list. So how does it work?The Veeam scheduler runs all its tasks according to priorities:800: Restore jobs — restores are obviously the most important jobs 700: Continuous data protection jobs — new CDP ist also considered v

11
X
1 year ago
Michael Melter
Michael MelterVeeam Legend
asked in Discussion Boards

VBR outside domain - possible issues

For well know reasons myself and many here recommend to - if possible - deploy VBR and especially it’s repos outside of the Windows domain.Certain issues come as a downside with doing that:Maintaining multiple local admin logins, remote-UAC (LocalAccountTokenFilterPolicy), firewall behavior outside of domain networks etc. being some of those.Recently I stumbled upon a situation were we could not establish a connection from a non-domain-joined VBR server to a newly deployed non-domain-joined Windows 2019 repo server. Other older proxies/repos to the same VBR were available and functioning.From the VBR server the admin$ share of the to-be-connected new repo was not accessible (“invalid login”).VBR also stated “invalid login” during Windows server onboarding. But from another (domain joined) Windows system in the same (direct, non-routed) network, the repo’s admin$ share was well available with the same user/pw.Of course no Windows firewall whatsoever was active.Very strange.Has anyone se

6
regnor
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

SOBR Archive Tier – Explained and Configured – Part 3 of 4

This is part three of the blogpost. If you want to read it from the beginning, head here: SOBR Archive Tier – Explained and Configured – Part 1 of 4 | Veeam Community Resource HubIn this part 3 of 4, I will walk you through all the things to set up for the archive tier in Azure. How to setup the archive tier for your SOBR in Microsoft AzureLet’s assume we already have a SOBR using a capacity tier to offload data to Azure in a specific schema. Could be either copy or move or even a combination of both to fulfill the 3-2-1 rule. A nice walkthrough of the capacity tier setup could be found e.g. here: https://jorgedelacruz.uk/2019/05/14/veeam-cloud-tier-capacity-tier-in-microsoft-azure-blob-how-to-configure-a-veeam-backup-replication-scale-out-backup-repository/This would be our starting point to enable another shift of the already offloaded data into the cheaper archive tier.Therefore, first of all we have to define another storage account in the correct tier level. In our example for Azu

2
Chris.Childerhose
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

SOBR Archive Tier – Explained and Configured – Part 2 of 4

This is part two of the blogpost. Part one can be found here: SOBR Archive Tier – Explained and Configured – Part 1 of 4 | Veeam Community Resource HubIn this part will will discuss the reason behind having different tiers and how they appear within Microsoft Azure. Hot or Cool? – what’s it all aboutS3 storage or blob storage as it is also called is offered by the hyperscalers in various flavors that basically differ in speed of access and the cost charged for the in- or egress of data as well as its storage. We can generally decide between hot, cool and archive for Microsoft Azure. This translates to Standard and Standard-IA (=infrequently accessed) with Amazon AWS. The concept behind is the same. In the following I will stick to the terminology as of Azure.The capacity tier of the SOBR allows us to leverage either “hot” or “cool” storage tiers from the portfolio the hyperscaler offers. Both tier modes have the same access methodology (API) and the main difference is:Hot: Higher stora

5
Michael Melter
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in Discussion Boards

SOBR rebalancing with hardened Linux repo - division by zero?

Most of us love and embrace SOBRs as well as hardened Linux repos for obvious reasons.Once in a while a SOBRs shifts out of balance because VBR cannot predict sizes of VMs and especially chains with changes.Therefore, for a non-immutable repo we have ways to rebalance the SOBR: KB3100: Manually moving backup files between Scale-Out Backup Repository extents (veeam.com)V12 will even bring us the conservation of space optimizations here: New in VBR v12: True per-machine backup files - vNote42This though is and will not be an easy task for the hardened Linux repo, as it will prevent files from being moved between the extents. I e.g. currently face a customers SOBR with one extent having 0% free while the others all have more than 80% free...Question is: Did you ever face this challange? How did you solve it? (Build chains from scratch? Disable immutability, reorg files, enable immutabilty?)

9
Chris.Childerhose
1 year ago
Michael Melter
Michael MelterVeeam Legend
posted in Blogs and Podcasts

SOBR Archive Tier – Explained and Configured – Part 1 of 4

IntroAn often overlooked feature we can leverage since V11 is the archive tier for the Scale-Out-Backup-Repository (SOBR).SOBR: Tiers against fears… 😉While we find quite some good guidelines for the Veeam side of the functionality (e.g. Archiving Backup with Microsoft Azure Blob | Veeam Community Resource Hub), I’d consider it helpful to have some more insights to the technology and a guideline to also set up the hyperscalers side of the archive tier. I’ll choose Microsoft Azure here as an example. In the following blogpost with four parts (TLDR), I’ll walk you through some background and the complete setup.  A short history of the SOBRA scalable storage layer for backups is crucial for larger environments. This is why Veeam brought us the Scale-Out-Backup-Repository with VBR version 9.0 already. First it only consisted of the so called “performance tier” – that is the on-premises storage devices being pooled together as so called “extents” in a very flexible way.With Version 9.5 U4 t

1
Chris.Childerhose
1 year ago

Badge winners

Show all badges
Terms & Conditions