Skip to main content

Events
Groups
Leaderboard

EN

VeeamOn Tours 2024

2 months ago

Community
Community
YARA and Script Library

YARA and Script Library

Download featured YARA rules, browse code samples or contribute your own scripts

163 Topics
853 Comments

When you subscribe we will email you when there is a new topic in this category

163 Topics

Recently active

Most replies Most views Newest first

Timothy DewinComes here often

posted in YARA and Script Library

Fast Clone Savings: Call for community testing

Hi all, Recently I started experimenting with XFS savings calculation. I’ve seen some good work from the community and therefor I want to say, thanks for all people that played with xfs_bmap, filefrag, and especially mweissen13 with some good idea’s on how to find the overlapping intervalsI’m sharing here what I believe is a working implementation:https://github.com/tdewin/ttozz/tree/main/sortedfragmentsSo first of all, I’ve split up the work in 2 parts:Creating frag files: these files are basically filefrag output but reordered on volume level offset. This is required to find the overlapping intervals (shared blocks). Notice that filefrag order the fragments on file level offset. You can cat the files if you are curious. They are basically in YAML format because you should be able to easily parse them with libraries or just pure stream reading line per line. Analyzing the frag files: open the files and read them in ordered fashion. If two files report a similar intervals (starting blo

ScottVeeam Legend

posted in YARA and Script Library

List of Tapes and load count

I have a lot of tapes and multiple libraries. I recently had a few failures, and wanted to check how many times each tape has been loaded and either read or written too to see if there is a trend with the oldest ones. I created a little script to do this, and figured I’d sort it from the most loads at the top. It ended up being a coincidence and I have plenty of life left in all my tapes, but always fun to lean a new command # Load Veeam PowerShell SnapIn if not already loadedif ((Get-PSSnapin -Name VeeamPSSnapIn -ErrorAction SilentlyContinue) -eq $null) { Add-PSSnapin VeeamPSSnapIn}# Get all tape media$tapes = Get-VBRTapeMedium# Create an array to hold the results$results = @()foreach ($tape in $tapes) { $tapeInfo = "" | Select-Object 'TapeName', 'LoadCount' $tapeInfo.TapeName = $tape.Name $tapeInfo.LoadCount = $tape.LoadCount $results += $tapeInfo}$results | Sort-Object LoadCount -Descending | Format-Table

ThePlaneskeeperNot a newbie anymore

posted in YARA and Script Library

Immutable Storage actual disk used per folder

Inherency:Since we bill by actual disk usage for our client utilizing CloudConnect, the existing reports are non-functional for reporting and billing (They report pre-deduplication/reflink data). It took a while to figure out, but there is a way to calculate actual disk space used on a per directory on an immutable repository.Solution:Using: https://community.veeam.com/blogs-and-podcasts-57/check-reflink-and-spared-space-on-xfs-repositories-244 I have extrapolated a script that will give the disk usage of each folder (IE: client) on an immutable repo. This isn't "Data used"; that is what Veeam reports. This is "Disk Used". The actual size on disk after reflinks (duplicated data is only counted once). A note about this script; it appears that the original blog entry is wrong on the size of a block. They attribute it to 4096... which is true... on disk... but the utility used explicitly gives the information in block sizes of 512:https://linux.die.net/man/8/xfs_bmap"units of 512-byt

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-staged-restore.ps1 - Powershell script for Staged VM Restore

SummaryAnother powerful PowerShell script that leverages Veeam Backup & Replication to simplify the process of restoring virtual machines. With this script, you can perform staged VM restores. The script automates the entire process, from connecting to the Veeam server and listing available restore points to selecting a restore point and initiating the restore process. The script Download hereThe script is highly customizable and utilizes several parameters to tailor the restore process to your specific needs. Let's take a closer look at these parameters:ESXiServer: Specify the name of the target ESXi server where the VM will be restored. This allows you to choose the appropriate destination for the restore operation.VMName: Provide the name of the VM that you want to restore. This ensures that the script locates the correct VM during the restore process.Jobname: Enter the name of the Veeam backup job that contains the VM you wish to restore. This parameter helps the script identif

tan123New Here

asked in YARA and Script Library

veeam python library through swagger.json

Anyone created veeam python library through swagger.json and has been successful in creating backup job?

Chris.ArceneauxVeeam MVP

posted in YARA and Script Library

Automated Upgrade to Veeam Backup & Replication v12

The PowerShell script to automate the upgrade for Veeam Backup & Replication & Enterprise Manager to v12 is now available on VeeamHub! For more details on the script itself, I recommend reading the documentation on VeeamHub.https://github.com/VeeamHub/powershell/tree/master/BR-UpgradeV12 If you’re familiar with my previously written upgrade scripts for v10 and v11, here’s a summary of enhancements in this latest release:Support for both Windows Server 2019 & 2022 Added support for VBR plugins Veeam Backup for AWS Veeam Backup for Microsoft Azure Veeam Backup for GCP Veeam Backup for Nutanix AHV Veeam Backup for Red Hat Virtualization Veeam Plug-in for Kasten K10 Added support for Veeam Explorer for PostgreSQL Added function to test for pending reboots prior to beginning upgrade Added patch install functionality if Updates folder is present in the Veeam ISO Added check for license as it’s required for VBEM upgrade Added ISO validation as the script was written for v12

vergotedComes here often

posted in YARA and Script Library

Windows FLR restore via powershell - multiple vms

First time sharing, so feedback is much appreciated. There is a lot improvement possible but this short script did the trick. A while ago we came across an issue after automation made some unforeseen changes to the vm. Therefore I was tasked with the restore of a system file from +1000 vms from a specific date (not the last backup)VBR backup Agent backups Netapp snapshot onlyThe CSV file exists out the vm name & backupjob name for the VBR & Agent restores. (extracted this from the notes in vcenter where possible)For the netapp restore the vmname was only needed.Here is the script that made my life easier:function Get-TimeStamp { return Get-Date -UFormat "[%Y-%m-%d %T]"}# Starting script# --Write-Host "$(Get-TimeStamp) - Starting script"$vmlist = import-csv C:\scripts\Veeam\restore\vmlist.csv -Delimiter ";"Foreach ($vm in $vmlist) { $backupjob = $vm.backupjob $asset = $vm.vm $backup = Get-VBRBackup -Name $backupjob $restorepoint = Get-VBRRestorePoint -Backup $backup

SteveHeartVeeam MVP

posted in YARA and Script Library

VeeamONE - Suspicious Increment Size - Remediation Action Script

IntroYou know the stories: Sometimes an incorrect keyboard layout can lead to incorrect entries. Or while coding, , you must make sure that you use the correct special characters such as ' or ", etc. But let's focus on the main topic - Veeam ONE AlertsVeeam ONE Alert - Suspicious incremental backup sizeYou probably know this Veeam ONE Alert: Veeam ONE Alert - Suspicious incremental backup size. What many may not know is that you can configure Veeam ONE to perform remediation actions when alerts are triggered. These actions can be performed automatically or after manual approval.Veeam ONE offers the following types of remediation for alarms:Predefined actions that are configured for the most commonly used out-of-the-box alarms. Custom scripts that you can specify in the settings of any alarm. For each severity level, Veeam ONE can run one or more custom scripts.For the Suspicious incremental backup size alert we do have a predefined action available: Predefined RemediationA SureBackup

StefanZiComes here often

posted in YARA and Script Library

Advanced Linux File Level Restore including Cross Restore

What? Mount the contents of the latest restore point of a Linux VM to the very same or another VM using the data integration API. Why? Linux admins can just browse the backup contents on the local system and restore the files they need (on the CLI 😉) Advanced & complex restore scenarios Cross-restore to another server (source server and target server can be different) $machine = "esxrhel1"$machine_dns = "esxrhel1.lab.local"$machine_credentials = Get-VBRCredentials -Name "veeam" | ? { $_.Description.Contains("Veeam Linux Account") }$rp = Get-VBRRestorePoint -Name $machine | Sort-Object -Property CreationTime | select -Last 1$publishSession = Publish-VBRBackupContent -RestorePoint $rp -TargetServerName $machine_dns -TargetServerCredentials $machine_credentials -EnableFUSEProtocol -Reason "Test FUSE restore"# Print info on session$publishSession#Unpublish-VBRBackupContent -Session $publishSessionAs a result on the Linux system you’ll get loop mounts like these./dev/loop0 on /tmp/Veea

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-securerestore-lnx.ps1 - Secure Restore for Linux VM

As the proverb says, "A script a week keeps the doctor away". This week, we'll turn our attention to the Veeam Data Integration API. The idea for the script was to program a kind of SecureRestore for Linux VMs. There are many blog posts about the Data Integration API together with Linux, but nowhere could I find a script that covers the following requirement:Restore a Linux VM with prior AVscan. Abort the process if a virus is found, otherwise do the restoreLet's start…PrerequisitesInstall the latest Win OpenSSH package on the host where the script will be used Win32-OpenSSH Generate a public/private key pair using PuTTYgen A Linux server with ClamAV installed (I used Ubuntu 22.04 LTS) Add the Linux server to Veeam Backup & Replication using the generated key: Add Linux Server A Backup Job protecting the Linux VM as well as a restore point (the script uses the latest for the Restore)How to install ClamAVA quick guide to install ClamAV on the Ubuntu serverUpgrade your package listsu

ScottVeeam Legend

posted in YARA and Script Library

Time based groups for Active Directory

If you have Veeam on your domain, or Enterprise Manager and want to give a user access for a specific amount of time, you can achieve this with a simple PowerShell command. Add-ADGroupMember -Identity ‘Group_NAME’ -Members ‘Username’ -MemberTimeToLive (New-TimeSpan -Minutes *****) The issue with this is trying to calculate minutes to days, weeks, months, or having some sort of searchable way to do this task. Onboarding users with this method was proving difficult so I thought of easier ways to achieve this. What started off with an overly complex excel spreadsheet to extract minutes from dates and generate a command has now become an PowerShell based GUI. In the below script. anything with “*****” should be replaced with items from your own AD infrastructure. This allows to search 1 or many users and add them to 1 or many groups. If you select the TTL checkbox, you can select the end date when the users will be removed from the groups. The user and group names can be searched start

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-nasjob-scanner.ps1 - VBR- Report unexpectedly high number of files that have been backed up

Good Monday everyone! Another week, another script 😉 This time for the Veeam file share backup jobs.IntroAlso last Friday another script was ready for release, but I didn't want to "interrupt" the World Backup Day celebrations with a dull script ;) And my last script also caused quite some buzz in our backup world:vbr-job-scanner-ps1And I promised that more will come... The scriptIn my GitHub repository you can find a script that checks if a unexpectedly high number of files have been backed up via file share backup compared to the last times. There are two versions of this script:vbr-nasjob-scanner.ps1 - For manual checks vbr-nasjob-scanner-post-script.ps1 - For use in the Backup Job as a post-script Details and instructions on the readme page.Feedback welcome!

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-get-jobcfg.ps1 - Quickly show Veeam Backup Job Configuration Settings

Spring is here 💐 and with it comes another script. This time for Veeam Backup & Replication.The script shows different job configuration settings and can be used to quickly identify differences in job settings.The Readme and code lines can be found in GitHub:Bits & BytesMore to come depending on your feedback (I already got one related to NAS backup)

Pasqual DöhringNot a newbie anymore

posted in YARA and Script Library

Measure the changed data in your VMware environment

The problemHave you ever needed to know how much data you need to backup incrementally from your VMware environment? Because you need to design a new backup storage? Because you need to know, if your WAN is capable of transferring everything into the cloud or from your branch office? Because you need to know the change rates of your VMs? The solutionNow you can track these data changes with a simple script! Let me introduce you to GetChangedBlocksV2! It is a PowerShell script which uses the VMware PowerCLI to read the changes from your VMware disks each time it is run and saves it as CSV. It keeps track of the changes between each run, between each day and between each week. In order to get good results, you need to run this tool on a regular basis, e.g., with the Task Scheduler.There is even a basic Excel file included to analyze the results for you. But if you have better tools feel free to utilize them. Where to get it?https://github.com/turboPasqual/GetChangedBlocksV2 Other stuffWh

vNote42On the path to Greatness

posted in YARA and Script Library

[PowerShell, PowerCLI] Check for VMs that are not being backuped

If you do not run VeeamONE, it can be challenging to check if every VM that should be backed up, is really backed up. Therefore I wrote a small PowerShell script. Basically this script looks for each VM if there is a restore point for this VM. If not, it gets listed. Extra feature: Script connects to every vCenter that is registered in B&R server. There is a Blocklist included: when VMs should not be backuped, just place their name in the blocklist and they will not be shown in the list. So you can exclude VMs without editing the script.Notes:CredObject.xml is used for stored, encrypted credentials. Script connects to local B&R server, so it should run there if not changed. # Load Plugin and moduleAdd-PSSnapin VeeamPSSnapinImport-Module VMware.VimAutomation.Core# Configure for multiple vCenter ConnectionsSet-PowerCLIConfiguration -DefaultVIServerMode Multiple -Scope Session -Confirm:$falseSet-PowerCLIConfiguration -InvalidCertificateAction Ignore -Scope Session -Confirm:$false#

SteveHeartVeeam MVP

posted in YARA and Script Library

vbr-job-scanner.ps1 - Veeam Backup & Replication - Report Suspicious Backup File Size

IntroIn the past I’ve shared some scripts with the community which were related to security stuff. Among my many ideas (I should put down on paper everything that is buzzing around in my head), someone recently asked in our internal Teams Veeam MVP chat the following question: "Can somebody please integrate VONE's Suspicious Backup file size and job duration alarm into VBR?" Friday MoodI try to keep every Friday afternoon free for some exciting projects. Most of the projects are related to customer or partner requests that can’t be handled directly with Veeam products. So, last Friday's slogan was "It's Friday again.....". (Who knows the song?)My approach was to create two scripts. One for manual execution, the other for integration into existing backup jobs with the possibility to display the result in the backup job statistics. The ResultPlease have a look into Brad's post, who was asking for the possibility to identify this in VBR: Linch TipsRelease v1.1 of the script will include t

Jnaude123New Here

asked in YARA and Script Library

Veeam Reporting for Nutanix AHV

Is there any way to report (powershell script etc.) on Nutanix AHV repository hosted content (via Hyper-V) except for using the Veeam ONE “Protected VMs) report. Information required, Succesful backup sessions: Job anme, start & stop times, Durations, avg speed, total, processed, data read, transferred, dedup, compression, result.

Martin WeberComes here often

posted in YARA and Script Library

Pre-Check for update VEEAM to Version 12 using VMware

Hello together,before you update VEEAM to Version 12 using VMware vCenter/ESXi please check VMs HardDisks for duplicate UUID. In Version 11 this was never a problem. In the new Version VEEAM checks the UUID and backup will fail.VMware has no problem with that most time. But they know the Problem - https://kb.vmware.com/s/article/2006865This command will find any HardDisk with duplicate UUID - please note that this is VMware PowerCLI commandGet-VM | Get-HardDisk | Select @{N='VM';E={$_.Parent.Name}}, @{N='Uuid';E={$_.ExtensionData.Backing.Uuid}} | Group-Object -Property Uuid | ?{ $_.Count -gt 1 }As Service Provider such changes in VEEAM are a total disaster!!

Martin WeberComes here often

posted in YARA and Script Library

VEEAM Maintenance Mode PowerShell Scripts

Yesterday, during the VEEAM User Group Germany someone was missing a Maintenance Mode for VEEAM. The main problem was to keep which job was enabled and which was disabled. I wrote a script some times ago which stopped all jobs and disable them but before the state is dumped into a JSON File. On leaving maintenence the JSON-File will be read and required jobs are set to enabled again and failed jobs are triggered to restart. The scripts (and more) can be found on our github repository: https://github.com/claranet/VeeamHub/ Here are these scripts:Enter-Maintenance.ps1param( [switch]$DryRun=$False)Import-Module Veeam.Backup.PowerShellFunction log($message) { $timestamp = Get-Date -Format "yyyy-MM-ss hh:mm:ss" Write-Host "$($timestamp) - $($message)"}if($DryRun) { log "DRY RUN - NOTHING WILL CHANGE" }$_FILE = "$PSScriptRoot/job_states.json"if( [System.IO.File]::Exists($_FILE) ) { log "State File already exists - remove it first!!" pause Exit 1}# Create new, empty state fileNew-Item -

InfowhizNew Here

asked in YARA and Script Library

Backup Eamil Notifications

Is that any way to trigger notification when backup job start?

BystanderNew Here

asked in YARA and Script Library

Set a file list for backup in before job script

Hi,I need to write to the tape files created during previous day. I have a script which generates that list. How can I tell Veeam, which files to write?Do I need to write script creating a new job each day or it is possible to use “before job script” for that?Thanks in advance

EdxHComes here often

posted in YARA and Script Library

Hi all, I just wanted to give you some updates on vCLI’s updates (up to 0.7.0-beta1):PUT and POST operations Default API updated to v12 VBR and v7 VB365 Enterprise Manager support Utility functions: VBR Job GET to POST converter Check for version updates Job template featureVBR Job GET to POST converterThe VBR API Job object is slightly different to the POST object; the converter can take a GET object json file and convert it to a POST object json file. Job Template featureThe job template feature was put together to help with having to manage large VBR job objects. A job template can be created, forming the basis for any new jobs you want to create. For example, if you only need to modify the VMs, you only need to pass a relatively small object:type: Backupname: my jobdescription: Created by VCLI.isDisabled: falsevirtualMachines: includes: - type: VirtualMachine hostName: your-vmware-host name: your-vm-name objectId: vm-0001The command being:vcli job create abc-j

kristofpoppeVeeam Vanguard

asked in YARA and Script Library

Remove-VBOEntityData via API

Hi all, most of us know the powerfull Remove-VBOEntityData cmdlet to remove objects from Veeam Backup for Microsoft 365 repo’s. I’ve been checking documentation and the swagger, but didn’t find any API alternative. Anybody already succeeded in calling this function via API ?

Praveen SharmaNew Here

asked in YARA and Script Library

Stop VM Backup if any alert is received from Veeam One

Hi Team, The customer wants to setup ransomware alerts on Veeam One. And also wants that if any alert comes then backup should be stopped.I have checked the documentation and found that action option is available in alert setting where we have option to run script. can you please help me with the script.Thanks!!

Martin WeberComes here often

posted in YARA and Script Library

Veeam AHV Metrics Exporter for Prometheus

Hello together, I wrote a exporter to Collect VEEAM AHV Metrics for Prometheus: https://github.com/claranet/veeam-ahvproxy-exporter/ It now also Support API v4 for Veeam v12. Best regards,Martin

1
2
3
4
5
6
7

Page 4 / 7

Badge winners

patrick hauerhas earned the badge Veeam Employee
shangwshhas earned the badge Veeam Employee
Edward Watsonhas earned the badge Veeam Employee
SysEnghas earned the badge Discussions Guardian
SysEnghas earned the badge Conversations Champion

Show all badges

Powered by Gainsight

Terms & Conditions

Sign up

Already have an account? Login

Log in with your Veeam account

Login to the community

Log in with your Veeam account

Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.

Enter your e-mail address

Back to overview

Scanning file for viruses.

Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.

OK

This file cannot be downloaded

Sorry, our virus scanner detected that this file isn't safe to download.

OK