YARA and Script Library

After switching from TSM to Veeam, I found myself wasting plenty of hours excluding OFF-Line sql databases from backup.Normally it demands that you start SQL Server Management Studio ( witch takes a war ), identify the correct instance and then exclude the ofline databases in each backup job…..However… I’m notorisly lazy and in a bright moment, I turned to Powershell.The resulth is a script telling me if a database is offline and therefore maybe should be excluded or if a database in online and can be included in backup, and best of all… without starting SQL Server Management Studio. The script is eacy to use, gives a nice overview, you can in / exclude a database on a server in less than 20 sec ( depends on how many instances / databases the script have to scan ), you can chose to exclude Logs and diff backup and only have FULL backup if needed, and at last, - it logs every change make by time and username.Script is free to use…regards   MACH0NE 

Hi Team, The customer wants to setup ransomware alerts on Veeam One. And also wants that if any alert comes then backup should be stopped.I have checked the documentation and found that action option is available in alert setting where we have option to run script. can you please help me with the script.Thanks!!    

Hello community!Some customers asked for it and here is it (a little X-mas present for the community):The NAS Hash Comparer. This script launches an Instant File Share Recovery for a specified file share backup job and compares the hash value using the given parameters. More details can be found on my GitHub page: https://github.com/yetanothermightytool/powershell/blob/master/vbr/vbr-nas-hashcompare/README.mdHappy HolidaysSteve

Incase of Multiple VMs available on top of Veeam how AAIP will help and Support

Good Monday everyone! Another week, another script 😉 This time for the Veeam file share backup jobs.IntroAlso last Friday another script was ready for release, but I didn't want to "interrupt" the World Backup Day celebrations with a dull script ;) And my last script also caused quite some buzz in our backup world:vbr-job-scanner-ps1And I promised that more will come...    The scriptIn my GitHub repository you can find a script that checks if a unexpectedly high number of files have been backed up via file share backup compared to the last times. There are two versions of this script:vbr-nasjob-scanner.ps1 - For manual checks vbr-nasjob-scanner-post-script.ps1 - For use in the Backup Job as a post-script Details and instructions on the readme page.Feedback welcome!

You want to tag your Veeam Backup for Microsoft Azure Workers? Here's a script that will help you:https://github.com/yetanothermightytool/powershell/tree/master/vbazure/vbazure-workertag

Hi all, I just wanted to give you some updates on vCLI’s updates (up to 0.7.0-beta1):PUT and POST operations Default API updated to v12 VBR and v7 VB365 Enterprise Manager support Utility functions: VBR Job GET to POST converter Check for version updates  Job template featureVBR Job GET to POST converterThe VBR API Job object is slightly different to the POST object; the converter can take a GET object json file and convert it to a POST object json file. Job Template featureThe job template feature was put together to help with having to manage large VBR job objects. A job template can be created, forming the basis for any new jobs you want to create. For example, if you only need to modify the VMs, you only need to pass a relatively small object:type: Backupname: my jobdescription: Created by VCLI.isDisabled: falsevirtualMachines: includes: - type: VirtualMachine hostName: your-vmware-host name: your-vm-name objectId: vm-0001The command being:vcli job create abc-j

We have a Veeam AWS Appliance in its own backup account on the latest version, 7.1.08We are backing up more than 200 AWS accounts. I am looking for a Terraform code that, when included in creating a new AWS Account, automatically imports the account to the Veeam appliance. I looked into the Veeam Hub and did not find any. The only Terraform code I found was for deploying the Veeam AWS Appliance.Does anyone have the Terraform code, or is this possible with Veeam AWS Appliance?Thanks,Zahra   

I hope you're all doing well.I'm reaching out to the community for some guidance. As a test, I recently used Veeam intelligence to scan our infrastructure.Based on the scan, Veeam intelligence created  the following rule:[rule CommonRansomware{    meta:        description = "Detects common ransomware families"        author = "Veeam Support Assistant"        date = "2023-10-01"    strings:        $locky = "Locky"        $wannacry = "WannaCry"        $petya = "Petya"        $notpetya = "NotPetya"        $cerber = "Cerber"        $cryptolocker = "CryptoLocker"        $cryptowall = "CryptoWall"        $badrabbit = "BadRabbit"        $ryuk = "Ryuk"        $maze = "Maze"        $revil = "REvil"        $darkside = "DarkSide"    condition:        any of them}the results scared me since it’s a bunch on files detected by this rule.  thanks in advance for reading 

So, this is definitely a deep edge case if you could not tell from the title, if you could even figure out the situation from the title :)But since I went down this rabbit hole for a case, figured I’d share it for people getting deep into automation and the Veeam Public Cloud Backups who are following 3-2-1 rule and making Backup Copies of these from their External Repositories. Even if you never need to solve this particular use case, I suppose it’s a good example of what you can actually learn about a backup and how to properly parse data without nasty string munging.Issue: Backup Copies sourced from External Backups don’t have a UI field to associate the Restore Points with the original backed up machine’s public cloud information like Subscription, Region, etc.Where this likely becomes an issue is when you heavily automate regional deployments and may have identical infrastructures set up uniquely for individual regions. (e.g., you deploy machines with same names for regions that o

Hello,I have more than 700 policies on my VBAws serveurs. I have ton change fiew setting.I know how to create AWS Acoount / Policies I use PowerShell and Invoke-RestMethod  I’m not able to modify polices: I do not find a way even in the swagger If someone can share the way to modify account or Policies nvoke-RestMethod -Uri $TheUrl -Method Put -Body $json -ContentType "application/json" -Headers $Headers -NoProxy -SkipCertificateCheckRegards

Hi all, most of us know the powerfull Remove-VBOEntityData cmdlet to remove objects from Veeam Backup for Microsoft 365 repo’s. I’ve been checking documentation and the swagger, but didn’t find any API alternative. Anybody already succeeded in calling this function via API ?

Anyone created veeam python library through swagger.json and has been successful in creating backup job?

Hi all,Before I start this post I humbly request that if you like this project and want me to continue to develop this and other projects, to please share, give it a star on GitHub. It really helps with the motivation. I’ve been wanting an easy way to monitor logs from Veeam products in real-time.https://github.com/shapedthought/logwatchBinary download:https://github.com/shapedthought/logwatch/releasesSo I’ve put together just that, logwatch can monitoring all the files in a folder for changes and you can also recursively monitor all the files in sub-directories. If you enable ssh on your VSA v13 (do carefully!), you can then run the following to get all the first level directories:ssh -n user@server "tail -f /var/log/VeeamBackup/*.log" | logwatch --stdinTo monitor recursively:ssh -n user@server "while true; do find /var/log/VeeamBackup -type f -name '*.log' -print0 | xargs -0 -r tail -n0 -F 2>/dev/null; sleep 1; done" | logwatch --stdin -PYou can also use this with the cloud produc

Hi all, Currently there's no indication other then on the VBA appliance itself that there are pending updates. Therefore I created a PS script which we integrated into our monitoring system (N-Central) that pulls this data from the appliance. We get notified for pending updates and we can proceed to deploy them. You can find the script on my gist page: https://gist.github.com/BasvanH/cc7cb3974657bde5926af69869e73b0b Two variables are filled with the status:$pendingUpdates is a integer and filled with the pending update count$updateCategories is a string and filled with the categories of the pending updates. You can adjust the script to your needs. All the best, regards,Bastiaan

提示升级和更新。扫描后，它会提示该文件不存在。应该怎么做？我觉得这个需要手动更新，我不知道该怎么办 

💡 The Challenge:Removing a backup proxy in Veeam Backup & Replication across a lot of backup jobs can be pretty annoying and time-consuming.🚀 The Solution:That's why I wanted to share a short PowerShell script that automates this task for you!I personally use it whenever I decommission a backup repository in large, shared Veeam environments - it's a real time-saver.⚠️ Right now, this script is built for the Windows-based Veeam version (12 & 13).A version for the Linux-based appliance is on my roadmap, so stay tuned!👉 You can grab the script here: 🔗 https://github.com/fabpapde/community/blob/main/veeam/veeam-backup-proxy-remove-v1_0.ps1

As a fan of the Veeam Data Integration API, I have been spending time with a related but separate topic: Database Publish (referred to as Data Publishing in the Veeam documentation). The goal was to make backed-up databases available to another system for analysis, without permanently restoring them or affecting production.What is Data Publishing?Data Publishing is a feature in Veeam Backup & Replication that has been available for Microsoft SQL and Oracle for a while and was later extended to PostgreSQL and MongoDB. The mechanics are straightforward: Veeam mounts the backup data read-only, attaches the database files to the target engine, and keeps a write cache for any changes made during the session. When the session ends, the write cache is discarded. The source backup is untouched. The result is a database accessible via standard database protocols. You can connect to it, run queries, inspect schema and data, and then walk away and grab a coffee. No permanent restore, no impac

Not sure how useful this will be for anyone else, but should you need to parse through your logs on all gateway servers for S3 errors returned during Veeam operations with Object Storage, this script is for you.Script requires ripgrep to be installed on the Backup Server: https://github.com/BurntSushi/ripgrep?tab=readme-ov-file#installationIf you cannot install / use chocolately in your environment, download the ripgrep binary appropriate for your OS, and edit the script as noted in comment [2]. What it does:Collect all Object Storage Repsositories Get Ids for all assigned gateways Collect all gateways with Get-VBRServer cmdlet to create array of gateways Iterate over each gateway and do the following: Export logs JUST for that gateway server to the VBR server, uncompressed grep the logs for the relevant S3 error string with ripgrep (rg command) Write all found errors in full to a .log file Pares all found errors and write in human friendly format to CSV Clean up the exported logs,

​ ProxyPool Swapper for Veeam Backup for M365If you regularly onboard new tenants in Veeam Backup for Microsoft 365, chances are this scenario sounds very familiar.A repository gets assigned to a proxy pool, and at some point you want to move it—quickly and without hassle. A common approach is to use a dedicated onboarding proxy pool for the initial full backups of new tenants, and a separate, permanently assigned pool for ongoing operations. Once those initial backups are complete, only incremental, day-to-day changes remain. These smaller, predictable workloads can then be handled by a proxy pool that’s specifically designed and sized for daily processing.From an architectural perspective, this makes perfect sense. From an operational perspective… it can get a bit tedious.Another use case I frequently run into is the need to quickly access logs for a specific job or repository. To do this, I assign the repository to a local Windows proxy, which gives me easy access to the proxy logs.

While responding to a post, I figured I’d try to see if i could get all of the email accounts tied to jobs in my Veeam environment to assist.This script will also show the attached Copy and Tape jobs, so I’ll try to update it with additional logic time permitting. Either way, It will show if you (or others) have email alerts setup in Veeam jobs.  I plan to update if i can have it show Warning, Error, and Success enabled. $emailPattern = '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}'function Get-EmailsFromObject { param( [Parameter(Mandatory)] $obj, [string]$JobType = "Unknown" ) $json = $obj | ConvertTo-Json -Depth 5 -Compress -ErrorAction SilentlyContinue if ($json) { $matches = ($json | Select-String -Pattern $emailPattern -AllMatches).Matches foreach ($m in $matches) { [PSCustomObject]@{ JobName = $obj.Name JobType = $JobType Email = $m.Value } } }}$allEmai

Using YARA rules in the backup environment With the rise of cyber threats, particularly ransomware attacks, simply performing backups and restores is no longer sufficient. Restoring data without ensuring it is free of threats can lead to re-infection of the environment.Starting with version 12.1, Veeam Backup & Replication (VBR) has integrated native support for YARA rules into its Malware Detection ecosystem. This combination enables data integrity validation both before and during recovery processes. What are YARA rules?YARA (Yet Another Recursive Acronym) is an open-source tool widely adopted in incident response to identify and classify malicious artifacts.Unlike approaches based solely on the closed signatures of traditional antivirus software, YARA operates using customizable rules:Pattern-based signatures: Identification via specific strings, byte sequences, hashes, or file structures. Conditional logic: Precise rule definition to determine whether a file is malicious or ano

Hi,did anyone or maybe Veeam itself worked on skill for Claude Code (and others)? For diferenet API endpoint, but mainly VPSC.I found (but not tried) this one https://github.com/Servosity/msp-skills/tree/main/skills/veeam  Best regards

The Application Backup RepositoryVeeam Backup & Replication v13.1 introduced the Application Backup Repository (ABR). It runs on the Veeam Infrastructure Appliance in Hardened Repository mode and turns local storage into a pool of virtual volumes, each one exposed as its own NFS target.The interesting part is what the writing side has to know: nothing. An application, a script, or a device simply writes to an NFS share. Veeam takes care of snapshots, immutability, and access control underneath.No agent, no plug-in, no awareness of Veeam at all.  That makes ABR a good home for everything that never fitted into a backup job. Which brings us to how you should lay it out.One Repository Per SourceIt is tempting to create one big ABR and point everything at it. Do not. Permissions and the snapshot schedule are configured per repository. That makes the repository your boundary for who may write, for who may read, and for how long data is kept. A single shared repository means one set of N

Hi all,Me again, I’ve been wanting to create a scanning tool to get detailed information about file systems to aid in the design of Veeam unstructured backups for a while. I created this tool a few years ago but I thought I’d dust it off and with the help of Claude make it something that the community can use. As always I’ve written it in Rust as it provides fast, multi-threaded scanning.https://github.com/shapedthought/fast-walkIt provides file system information in the following files:results-20260801-160000.csv           totals per extensionresults-20260801-160000-age.csv       totals per age bandresults-20260801-160000-size.csv      totals per size bandresults-20260801-160000-hotspots.csv  directories holding the most small filesresults-20260801-160000-largest.csv   the largest files foundIt also provides the information in the terminal:It also allows you to compare scans to get an idea of change rate over time:I’m looking for testing and feedback on different file systems of which