Integrate Veeam Backup and Replication EventTracker v9.x and above Publication Date: September 27, 2018
Abstract This guide provides instructions to configure VEEAM to send the event logs to EventTracker Enterprise. Once events are configured to send to EventTracker Manager, alerts, dashboard and reports can be configured into EventTracker. Scope The configurations detailed in this guide are consistent with EventTracker Enterprise version 9.x and later, and VEEAM v9.5. Audience VEEAM users, who wish to forward event logs to EventTracker Manager and monitor events using EventTracker Enterprise. The information contained in this document represents the current view of EventTracker. on the issues discussed as of the date of publication. Because EventTracker must respond to changing market conditions, it should not be interpreted to be a commitment on the part of EventTracker, and EventTracker cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. EventTracker MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from EventTracker, if its content is unaltered, nothing is added to the content and credit to EventTracker is provided. EventTracker may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from EventTracker, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. 2018 EventTracker Security LLC. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 1
Table of Contents Abstract... 1 Scope... 1 Audience... 1 Overview... 3 Prerequisites... 3 Configure VEEAM to forward logs to EventTracker... 3 EventTracker Knowledge Pack (KP)... 5 Alert... 5 Knowledge Objects... 5 Categories... 5 Reports... 5 Import Knowledge Pack into EventTracker... 8 Import Alerts... 8 Import Knowledge Objects... 9 Import Category... 11 Import Tokens Template... 12 Import Flex Reports... 13 Import Dashboards... 15 Verify Knowledge Pack in EventTracker... 18 Verify Alerts... 18 Verify Knowledge Object... 19 Verify Category... 20 Verify Token Values... 21 Verify Flex Reports... 22 Verify Dashboards... 23 Sample Dashboards... 25 2
Overview Veeam Backup & Replication is a software product developed by Veeam Software to back up, restore and replicate data on virtual machines. It was first released in 2008 and is part of the Veeam Availability Suite. Prerequisites EventTracker 8.x or later should be installed. Veeam Backup & Replication Tool should be installed. Configure VEEAM to forward logs to EventTracker Veeam logs are found in Event Viewer. EventTracker consumes the logs from the Event Viewer. Go to <%EventTrackerInstalledPath%>\Prism Microsystems\EventTracker\Agent. Run etaconfig. Select Event Filters tab, and then click the Filter Exception button. Figure 1 3
Select New to add an exception. Figure 2 In the Match in Source field type Veeam MP and click OK. Save and exit. Figure 3 4
EventTracker Knowledge Pack (KP) Once logs are received in EventTracker; category, reports and dashboards can be configured in EventTracker. Alert Veeam Backup and Replication License Expired: This alert is generated when the license for Veeam Backup and Replication tool is expired. Knowledge Objects Veeam Backup and Replication - Configuration changes: This knowledge object gives information about the configuration changes such as jobs created, modified or deleted. Veeam Backup and Replication - Jobs: This knowledge object gives information about the Backup jobs status. Categories Reports Veeam Backup and Replication - Configuration changes: This category gives information about the configuration changes such as jobs created, modified or deleted. Veeam Backup and Replication - Jobs: This category gives information about the Backup jobs status. Veeam Backup and Replication - Configuration changes: This report gives information about the configuration changes such as jobs created, modified or deleted. Figure 4 5
Logs Considered: Figure 5 Veeam Backup and Replication - Jobs Status: This report gives information about the Backup jobs status. Figure 6 6
Logs Considered: Figure 7 Veeam Backup and Replication - Connection details: This report gives information related to connection details. Logs Considered: Figure 8 Figure 9 7
Import Knowledge Pack into EventTracker Import Alerts Launch EventTracker Control Panel. Figure 10 Double click Export/Import Utility, and then click the Import tab. Click Alert option, and then click the browse button. 8
Figure 11 Figure 12 Click OK, and then click the Close button. Import Knowledge Objects Click Knowledge objects under Admin option in the EventTracker manager page. Click on Import option. Locate the file named KO_VEEAM.etko 9
Figure 13 Now select all the check box and then click Upload. Figure 14 10
Knowledge objects are now imported successfully. Click OK, and then click the Close button. Import Category Figure 15 Launch EventTracker Control Panel. Double click Export/Import Utility, and then click the Import tab. Figure 16 Click Category option, and then click the browse button. 11
Figure 17 Locate Category_VEEAM.iscat file, and then click the Open button. To import categories, click the Import button. EventTracker displays success message. Click OK, and then click the Close button. Import Tokens Template Figure 17 Logon to EventTracker Enterprise. Click the Admin menu, and then click Parsing Rules. Select Template tab, locate the Token_Template_VEEAM.ettd file. 12
Figure 18 Select all the reports by clicking on the check box. Click on the Import icon. Templates are now imported successfully. Figure 19 Click OK, and then click the Close button. Import Flex Reports Figure 20 Launch EventTracker Control Panel. Double click Export/Import Utility, and then click the Import tab. 13
Figure 21 Click Reports option, and select new (.etcrx) from the option. Figure 22 Locate the file named Reports_ VEEAM.etcrx and select all the check box. 14
Figure 23 Click the Import button to import the reports. EventTracker displays success message. Click OK, and then click the Close button. Import Dashboards Figure 24 In EventTracker 9.0, you can import dashlet. Following is the procedure to do that: 1. Login into EventTracker Enterprise Web console. 15
Figure 25 2. Go to My Dashboard option. Figure 26 16
3. Click on import button and select Dashlet_Veeam.etwd File. Figure 27 Figure 28 4. Click upload and select Dashboard which you want to import. 17
Figure 29 5. Click on Import button. It will upload all selected dashboards. Verify Knowledge Pack in EventTracker Verify Alerts Logon to EventTracker. Click the Admin menu, and then click Alerts. In Alerts search for Veeam to view Veeam Alerts. 18
Verify Knowledge Object Figure 30 Logon to EventTracker. Click the Admin menu, and then click Knowledge Object. In Knowledge Object Group Tree to view imported knowledge object, scroll down and click VEEAM group folder. Knowledge Objects are displayed in the pane. 19
Verify Category Figure 31 Logon to EventTracker. Click the Admin menu, and then click Category. In Category Group Tree to view imported category, scroll down and click VEEAM group folder. Category are displayed in the pane. 20
Verify Token Values Figure 32 Logon to EventTracker. Click the Admin menu, and then click Parsing Rules. In Token Value Group Tree to view imported token values, scroll down and click VEEAM group folder. Token values are displayed in the token value pane. 21
Verify Flex Reports Figure 33 Logon to EventTracker. Click the Reports menu, and then Configuration. Select Defined in report type. In Report Groups Tree to view imported Scheduled Reports, scroll down and click VEEAM group folder. Reports are displayed in the Reports configuration pane. 22
Verify Dashboards 1. Go to My Dashboard option. Figure 34 Figure 35 23
Click on customize dashlet icon. Figure 36 Figure 37 24
Sample Dashboards Veeam Backup and Replication Job Status Figure 38 25
Veeam Backup and Replication Configuration Changes Veeam Backup and Replication Job Details Figure 39 Figure 40 26