Skip to main content
  • EN

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

  • 168 Topics
  • 915 Comments
168 Topics
Scott
ScottVeeam Legend
posted in YARA and Script Library
Get Daily backup size for previous 2 weeks.

This works great for me using forever forward incremental jobs. If you are using synthetic fulls, or reverse you may get unexpected results as your latest job will show as the full size. I took my previous script and modified it so I can look at the previous 2 weeks, and see the size of the backup for each day.  If you change the (-14) you can make this weekly, monthly, daily with ease. # Location of the Veeam backup folder$BackupFolderPath = "f:\Backups"# Start and end dates$EndDate = Get-Date$StartDate = $EndDate.AddDays(-14)# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandatory=$true)] [int64] $bytes ) return "{0:N2}" -f ($bytes / 1GB) + " GB"}# Go through each day from the start date to the end datefor ($Date = $StartDate; $Date -le $EndDate; $Date = $Date.AddDays(1)) { # Date in the format 'yyyy-MM-dd' $DateString = $Date.ToString('yyyy-MM-dd') # Get all backup files for this date $BackupFiles = Get-ChildItem

4203
Chris.Childerhose
1 year ago
Scott
ScottVeeam Legend
posted in YARA and Script Library
Get the size of a daily incremental

For those doing forever forward incremental jobs, this is a handy scrip to see the size of your jobs each day. If you use Synthetic jobs, or reverse incremental you may get unexpected results as your latest file will be the full backup file.  While doing some planning for new storage I wanted to see how big a daily backup of all jobs on a proxy was.Here is a little script I came up with that you can modify the section “Current.Date.AddDays(-1)” to look back further. I may modify the code at a later time to fine tune this.  This worked well to go back a few days, then see the average daily size. Add that to your total full backup size and you can predict out the space needed to meet your retention policies. # Location of the Veeam backup folder$BackupFolderPath = "F:\Backups"# Current date$CurrentDate = Get-Date# Date of the day before$PreviousDay = $CurrentDate.AddDays(-1).ToString('yyyy-MM-dd')# Function to convert bytes to GBfunction ConvertTo-GB { param ( [Parameter(Mandat

4551
Chris.Childerhose
1 year ago
K
KWCorkComes here often
asked in YARA and Script Library
Remove-VBOEntityData takes ages

I’m trying to delete some user to data to free up licences and it seems to be taking forever to complete. I’m testing with a user who only has a few 100 emails but the command seems to have hung up. Here is the relevant part of the script:$RepositoryName = 'My_M365Repository'$UsersToRemove = @( 'Joe.Bloggs@MyDomain.com')$Repository = Get-VBORepository -Name $RepositoryNameforeach($UserToRemove in $UsersToRemove){ $UserToRemove $UserData = Get-VBOEntityData -Type 'User' -Repository $Repository -Name $UserToRemove if(-not($UserData)) { 'No user data found' } Else { # Use $UserData to see which backup types exist, and then only remove those. if($UserData.IsMailboxBackedUp) { Write-Host 'Removing Mailbox data' Remove-VBOEntityData -Repository $Repository -User $UserData -Mailbox -Confirm:$false } }}Any idea if I’m doing something wrong, or that cmdlet really does just take ages? Thanks.

2243
K
1 year ago
C
CFRComes here often
posted in YARA and Script Library
Usefull reports

Hi everyone,I wrote some reports that helps me to manage Veeam backups. I put them online to share it to community. Feel free to use them and personnalize them 👍 BR-MorningReport : shows backup results of the night BR-DurationReport : shows duration and layout of backup jobs 

9262
Chris.Childerhose
1 year ago
olivier.rossi
olivier.rossiVeeam MVP
posted in YARA and Script Library
Is this share already protected?

IntroductionOver the past few months, I have had customers report over-consumption of VUL, when leveraging Veeam NAS backups.Veeam NAS backup is licensed by the amount of protected source data. The protected data amount is rounded down to the nearest 500GB and consumes one VUL per 500GB (see the user guide for details).The important licensing caveat is that if, for instance, a same share is protected by two different backup jobs, even though it is the same source data, its protected amount doubles (in this particular instance).It easy to see how your VUL consumption can very quickly get out of control. The purpose of that short post is to share a very small script that helps identify if a given share has been backed up multiple times.Note: The script only analyzes the defined shares path and cannot detect any “share alias” set on the NAS device. ScriptThe script lists all NAS backup jobs and combs through its protected shares, sort the data and generates an HTML and CSV report. See the

1264
dloseke
1 year ago
P
Philippe SNew Here
posted in YARA and Script Library
Restore only ACL from windows files without restoring files

hello, Small trick following a bad handling. The objective is to restore on a Windows file server the ACLs of the files without restoring the files.For this we will start by opening the console restore guest files. Once done, click on any file, then explore to find the path to the FLR mount.To get the list of ACLs you can run a single command. This command will save all subfolders and files as a plain text. The text file (acl.txt) will be saved on your current user folder.icacls c:data /save acl.txt /t /cWhere “C:data” is the FLR path, “T” is added to get all subfolders and files on that drive, and “C” allows to ignore all the access errors.If the number of folders and files are too large, then the command will take a long time to complete its execution. At the end of execution, you will get the list of total files which is processed successfully, and the number of files which don’t get success in processing.If you want to restore the lists, execute the following commandIcacls c: /rest

7487
K
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
Veeam Backup & Replication - SureBackup - HTTP Proxy Configuration for Linux Virtual Machines

IntroductionOne of the standout features of Veeam Backup & Replication is SureBackup, which allows for the automated testing and verification of backups. SureBackup creates isolated environments, called Virtual Labs, to ensure the recoverability of your virtual machines. During a SureBackup session, it sometimes would be helpful to connect the virtual machines to the Internet  By default, the VMs within the Virtual Lab run in an isolated environment and do not have access to the Internet. If you want the VMs in the Virtual Lab to access the Internet, select the Allow proxy appliance to act as an Internet proxy for virtual machines in this lab check box. See  Setup Proxy Appliance and Veeam KB1165.With the HTTP proxy settings in place, you can easily download security patches, update antivirus definitions, and install software updates on your Linux VMs. With this you can enhance your software testing and patching processes, streamline deployment workflows, verify compatibility, and

4283
SteveHeart
1 year ago
Timothy Dewin
Timothy DewinComes here often
posted in YARA and Script Library
Fast Clone Savings: Call for community testing

Hi all, Recently I started experimenting with XFS savings calculation. I’ve seen some good work from the community and therefor I want to say, thanks for all people that played with xfs_bmap, filefrag, and especially mweissen13 with some good idea’s on how to find the overlapping intervalsI’m sharing here what I believe is a working implementation:https://github.com/tdewin/ttozz/tree/main/sortedfragmentsSo first of all, I’ve split up the work in 2 parts:Creating frag files: these files are basically filefrag output but reordered on volume level offset. This is required to find the overlapping intervals (shared blocks). Notice that filefrag order the fragments on file level offset. You can cat the files if you are curious. They are basically in YAML format because you should be able to easily parse them with libraries or just pure stream reading line per line. Analyzing the frag files: open the files and read them in ordered fashion. If two files report a similar intervals (starting blo

3916
JMeixner
1 year ago
Scott
ScottVeeam Legend
posted in YARA and Script Library
List of Tapes and load count

I have a lot of tapes and multiple libraries. I recently had a few failures, and wanted to check how many times each tape has been loaded and either read or written too to see if there is a trend with the oldest ones.  I created a little script to do this, and figured I’d sort it from the most loads at the top.    It ended up being a coincidence and I have plenty of life left in all my tapes, but always fun to lean a new command # Load Veeam PowerShell SnapIn if not already loadedif ((Get-PSSnapin -Name VeeamPSSnapIn -ErrorAction SilentlyContinue) -eq $null) { Add-PSSnapin VeeamPSSnapIn}# Get all tape media$tapes = Get-VBRTapeMedium# Create an array to hold the results$results = @()foreach ($tape in $tapes) { $tapeInfo = "" | Select-Object 'TapeName', 'LoadCount' $tapeInfo.TapeName = $tape.Name $tapeInfo.LoadCount = $tape.LoadCount $results += $tapeInfo}$results | Sort-Object LoadCount -Descending | Format-Table 

1843
jos.maliepaard
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
vbr-staged-restore.ps1 - Powershell script for Staged VM Restore

SummaryAnother powerful PowerShell script that leverages Veeam Backup & Replication to simplify the process of restoring virtual machines. With this script, you can perform staged VM restores. The script automates the entire process, from connecting to the Veeam server and listing available restore points to selecting a restore point and initiating the restore process. The script Download hereThe script is highly customizable and utilizes several parameters to tailor the restore process to your specific needs. Let's take a closer look at these parameters:ESXiServer: Specify the name of the target ESXi server where the VM will be restored. This allows you to choose the appropriate destination for the restore operation.VMName: Provide the name of the VM that you want to restore. This ensures that the script locates the correct VM during the restore process.Jobname: Enter the name of the Veeam backup job that contains the VM you wish to restore. This parameter helps the script identif

4563
Scott
1 year ago
T
tan123New Here
asked in YARA and Script Library
veeam python library through swagger.json

Anyone created veeam python library through swagger.json and has been successful in creating backup job?

520
T
1 year ago
Chris.Arceneaux
Chris.ArceneauxVeeam MVP
posted in YARA and Script Library
Automated Upgrade to Veeam Backup & Replication v12

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12 If you’re familiar with my previously written upgrade scripts for v10 and v11, here’s a summary of enhancements in this latest release:Support for both Windows Server 2019 & 2022 Added support for VBR plugins Veeam Backup for AWS Veeam Backup for Microsoft Azure Veeam Backup for GCP Veeam Backup for Nutanix AHV Veeam Backup for Red Hat Virtualization Veeam Plug-in for Kasten K10 Added support for Veeam Explorer for PostgreSQL Added function to test for pending reboots prior to beginning upgrade Added patch install functionality if Updates folder is present in the Veeam ISO Added check for license as it’s required for VBEM upgrade Added ISO validation as the script was written for v12

6774
Geoff Burke
1 year ago
vergoted
vergotedComes here often
posted in YARA and Script Library
Windows FLR restore via powershell - multiple vms

First time sharing, so feedback is much appreciated. There is a lot improvement possible but this short script did the trick. A while ago we came across an issue after automation made some unforeseen changes to the vm. Therefore I was tasked with the restore of a system file from +1000 vms from a specific date (not the last backup)VBR backup  Agent backups Netapp snapshot onlyThe CSV file exists out the vm name & backupjob name for the VBR & Agent restores. (extracted this from the notes in vcenter where possible)For the netapp restore the vmname was only needed.Here is the script that made my life easier:function Get-TimeStamp { return Get-Date -UFormat "[%Y-%m-%d %T]"}# Starting script# --Write-Host "$(Get-TimeStamp) - Starting script"$vmlist = import-csv C:\scripts\Veeam\restore\vmlist.csv -Delimiter ";"Foreach ($vm in $vmlist) { $backupjob = $vm.backupjob $asset = $vm.vm $backup = Get-VBRBackup -Name $backupjob $restorepoint = Get-VBRRestorePoint -Backup $backup

1131
Chris.Childerhose
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
VeeamONE - Suspicious Increment Size - Remediation Action Script

IntroYou know the stories: Sometimes an incorrect keyboard layout can lead to incorrect entries. Or while coding, , you must make sure that you use the correct special characters such as ' or ", etc.  But let's focus on the main topic - Veeam ONE AlertsVeeam ONE Alert - Suspicious incremental backup sizeYou probably know this Veeam ONE Alert: Veeam ONE Alert - Suspicious incremental backup size. What many may not know is that you can configure Veeam ONE to perform remediation actions when alerts are triggered. These actions can be performed automatically or after manual approval.Veeam ONE offers the following types of remediation for alarms:Predefined actions that are configured for the most commonly used out-of-the-box alarms.  Custom scripts that you can specify in the settings of any alarm. For each severity level, Veeam ONE can run one or more custom scripts.For the Suspicious incremental backup size alert we do have a predefined action available: Predefined RemediationA SureBackup

3191
Chris.Childerhose
1 year ago
StefanZi
StefanZiComes here often
posted in YARA and Script Library
Advanced Linux File Level Restore including Cross Restore

What? Mount the contents of the latest restore point of a Linux VM to the very same or another VM using the data integration API. Why? Linux admins can just browse the backup contents on the local system and restore the files they need (on the CLI 😉) Advanced & complex restore scenarios Cross-restore to another server (source server and target server can be different) $machine = "esxrhel1"$machine_dns = "esxrhel1.lab.local"$machine_credentials = Get-VBRCredentials -Name "veeam" | ? { $_.Description.Contains("Veeam Linux Account") }$rp = Get-VBRRestorePoint -Name $machine | Sort-Object -Property CreationTime | select -Last 1$publishSession = Publish-VBRBackupContent -RestorePoint $rp -TargetServerName $machine_dns -TargetServerCredentials $machine_credentials -EnableFUSEProtocol -Reason "Test FUSE restore"# Print info on session$publishSession#Unpublish-VBRBackupContent -Session $publishSessionAs a result on the Linux system you’ll get loop mounts like these./dev/loop0 on /tmp/Veea

2092
E
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
vbr-securerestore-lnx.ps1 - Secure Restore for Linux VM

As the proverb says, "A script a week keeps the doctor away". This week, we'll turn our attention to the Veeam Data Integration API. The idea for the script was to program a kind of SecureRestore for Linux VMs. There are many blog posts about the Data Integration API together with Linux, but nowhere could I find a script that covers the following requirement:Restore a Linux VM with prior AVscan. Abort the process if a virus is found, otherwise do the restoreLet's start…PrerequisitesInstall the latest Win OpenSSH package on the host where the script will be used Win32-OpenSSH Generate a public/private key pair using PuTTYgen A Linux server with ClamAV installed (I used Ubuntu 22.04 LTS) Add the Linux server to Veeam Backup & Replication using the generated key: Add Linux Server A Backup Job protecting the Linux VM as well as a restore point (the script uses the latest for the Restore)How to install ClamAVA quick guide to install ClamAV on the Ubuntu serverUpgrade your package listsu

5653
SteveHeart
1 year ago
Scott
ScottVeeam Legend
posted in YARA and Script Library
Time based groups for Active Directory

If you have Veeam on your domain, or Enterprise Manager and want to give a user access for a specific amount of time, you can achieve this with a simple PowerShell command.  Add-ADGroupMember -Identity ‘Group_NAME’ -Members ‘Username’ -MemberTimeToLive (New-TimeSpan -Minutes *****) The issue with this is trying to calculate minutes to days, weeks, months, or having some sort of searchable way to do this task.  Onboarding users with this method was proving difficult so I thought of easier ways to achieve this.  What started off with an overly complex excel spreadsheet to extract minutes from dates and generate a command has now become an PowerShell based GUI.  In the below script. anything with “*****” should be replaced with items from your own AD infrastructure. This allows to search 1 or many users and add them to 1 or many groups. If you select the TTL checkbox, you can select the end date when the users will be removed from the groups. The user and group names can be searched start

7306
Scott
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
vbr-nasjob-scanner.ps1 - VBR- Report unexpectedly high number of files that have been backed up

Good Monday everyone! Another week, another script 😉 This time for the Veeam file share backup jobs.IntroAlso last Friday another script was ready for release, but I didn't want to "interrupt" the World Backup Day celebrations with a dull script ;) And my last script also caused quite some buzz in our backup world:vbr-job-scanner-ps1And I promised that more will come...    The scriptIn my GitHub repository you can find a script that checks if a unexpectedly high number of files have been backed up via file share backup compared to the last times. There are two versions of this script:vbr-nasjob-scanner.ps1 - For manual checks vbr-nasjob-scanner-post-script.ps1 - For use in the Backup Job as a post-script Details and instructions on the readme page.Feedback welcome!

611
Chris.Childerhose
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
vbr-get-jobcfg.ps1 - Quickly show Veeam Backup Job Configuration Settings

Spring is here 💐 and with it comes another script. This time for Veeam Backup & Replication.The script shows different job configuration settings and can be used to quickly identify differences in job settings.The Readme and code lines can be found in GitHub:Bits & BytesMore to come depending on your feedback (I already got one related to NAS backup)

3893
SteveHeart
1 year ago
Pasqual Döhring
Pasqual DöhringNot a newbie anymore
posted in YARA and Script Library
Measure the changed data in your VMware environment

The problemHave you ever needed to know how much data you need to backup incrementally from your VMware environment? Because you need to design a new backup storage? Because you need to know, if your WAN is capable of transferring everything into the cloud or from your branch office? Because you need to know the change rates of your VMs? The solutionNow you can track these data changes with a simple script! Let me introduce you to GetChangedBlocksV2! It is a PowerShell script which uses the VMware PowerCLI to read the changes from your VMware disks each time it is run and saves it as CSV. It keeps track of the changes between each run, between each day and between each week. In order to get good results, you need to run this tool on a regular basis, e.g., with the Task Scheduler.There is even a basic Excel file included to analyze the results for you. But if you have better tools feel free to utilize them. Where to get it?https://github.com/turboPasqual/GetChangedBlocksV2 Other stuffWh

58312
S
1 year ago
vNote42
vNote42On the path to Greatness
posted in YARA and Script Library
[PowerShell, PowerCLI] Check for VMs that are not being backuped

If you do not run VeeamONE, it can be challenging to check if every VM that should be backed up, is really backed up. Therefore I wrote a small PowerShell script. Basically this script looks for each VM if there is a restore point for this VM. If not, it gets listed. Extra feature: Script connects to every vCenter that is registered in B&R server. There is a Blocklist included: when VMs should not be backuped, just place their name in the blocklist and they will not be shown in the list. So you can exclude VMs without editing the script.Notes:CredObject.xml is used for stored, encrypted credentials. Script connects to local B&R server, so it should run there if not changed. # Load Plugin and moduleAdd-PSSnapin VeeamPSSnapinImport-Module VMware.VimAutomation.Core# Configure for multiple vCenter ConnectionsSet-PowerCLIConfiguration -DefaultVIServerMode Multiple -Scope Session -Confirm:$falseSet-PowerCLIConfiguration -InvalidCertificateAction Ignore -Scope Session -Confirm:$false#

452438
Chris.Childerhose
1 year ago
SteveHeart
SteveHeartVeeam MVP
posted in YARA and Script Library
vbr-job-scanner.ps1 - Veeam Backup & Replication - Report Suspicious Backup File Size

IntroIn the past I’ve shared some scripts with the community which were related to security stuff. Among my many ideas (I should put down on paper everything that is buzzing around in my head), someone recently asked in our internal Teams Veeam MVP chat the following question: "Can somebody please integrate VONE's Suspicious Backup file size and job duration alarm into VBR?" Friday MoodI try to keep every Friday afternoon free for some exciting projects. Most of the projects are related to customer or partner requests that can’t be handled directly with Veeam products. So, last Friday's slogan was "It's Friday again.....". (Who knows the song?)My approach was to create two scripts. One for manual execution, the other for integration into existing backup jobs with the possibility to display the result in the backup job statistics. The ResultPlease have a look into Brad's post, who was asking for the possibility to identify this in VBR: Linch TipsRelease v1.1 of the script will include t

4529
SteveHeart
1 year ago
J
Jnaude123New Here
asked in YARA and Script Library
Veeam Reporting for Nutanix AHV

Is there any way to report (powershell script etc.) on Nutanix AHV repository hosted content (via Hyper-V) except for using the Veeam ONE “Protected VMs) report.  Information required,  Succesful backup sessions: Job anme, start & stop times, Durations, avg speed, total, processed, data read, transferred, dedup, compression, result.

1791
Chris.Childerhose
1 year ago
Martin Weber
Martin WeberComes here often
posted in YARA and Script Library
VEEAM Maintenance Mode PowerShell Scripts

Yesterday, during the VEEAM User Group Germany someone was missing a Maintenance Mode for VEEAM. The main problem was to keep which job was enabled and which was disabled. I wrote a script some times ago which stopped all jobs and disable them but before the state is dumped into a JSON File. On leaving maintenence the JSON-File will be read and required jobs are set to enabled again and failed jobs are triggered to restart. The scripts (and more) can be found on our github repository: https://github.com/claranet/VeeamHub/ Here are these scripts:Enter-Maintenance.ps1param( [switch]$DryRun=$False)Import-Module Veeam.Backup.PowerShellFunction log($message) { $timestamp = Get-Date -Format "yyyy-MM-ss hh:mm:ss" Write-Host "$($timestamp) - $($message)"}if($DryRun) { log "DRY RUN - NOTHING WILL CHANGE" }$_FILE = "$PSScriptRoot/job_states.json"if( [System.IO.File]::Exists($_FILE) ) { log "State File already exists - remove it first!!" pause Exit 1}# Create new, empty state fileNew-Item -

45415
Scott
1 year ago
I
InfowhizNew Here
asked in YARA and Script Library
Backup Eamil Notifications

Is that any way to trigger notification when backup job start?

1706
D
1 year ago

Badge winners

  • Veeam Employee
    WilsonThas earned the badge Veeam Employee
  • Veeam Employee
    JordiBhas earned the badge Veeam Employee
  • Veeam Employee
    Monica Gaohas earned the badge Veeam Employee
  • Veeam Employee
    Toshihirohas earned the badge Veeam Employee
  • Veeam Employee
    tamerlanehas earned the badge Veeam Employee
Show all badges
Terms & Conditions