Veeam is a widely used and well-known backup system.
A customer recently asked me if he could check on the operation of his Veeam-based backup system by verifying the Windows event log, since the standard checks used within the community did not provide him with the current status of his Veeam infrastructure.
This use case requires that the customer be able to check whether over the last X hours there was a specific event with a particular event ID and message. Receiving this event allows the customer to be sure that the backup was successful!
If this event is not present in the last X hours, then the backup is taking too long and the customer would like to be informed of that fact with a critical message, as he has to manually adjust the system in order to prevent any data corruption or overloading.
To implement this use case we decided to use a plugin made available by Icinga called icinga-powershell-plugins, whose documentation can be found on this page.
Among the various plugins there, we found it useful to implement our use case with Invoke-IcingaCheckEventlog whose documentation can be found at this link.
In order to use it we installed the Icinga agent and then the Powershell plugins, using the following commands after starting a Powershell session with administrative rights.
Install-Module 'icinga-powershell-plugins'; Use-Icinga
Once that’s done, we were ready to use our Windows client-side script.
I ran the command by hand to check which options to use, then after setting the command I imported the newly available basket so we could use it.
We then create the host, configure the service linked to the command in question called Invoke-IcingaCheckEventlog, and get a result.
We looked at that command’s documentation where we saw that event 190 can be monitored. Furthermore, we also verified that the name of the job is inside the message, so you can go and check whether in the last 24 hours there were any instances of event 190 containing the name of the job we scheduled. If there is no such event, it means that the job is running long and therefore we need to manually intervene, and so for this reason we can raise an alarm.
The standard command code doesn’t allow an alarm to be raised when 0 events are found. So we then proceeded to change the PowerShell code to allow for this capability.
We set the various variables as needed before we test the command from the PowerShell command line. Here’s an example command we used:
Invoke-IcingaCheckEventlog -IncludeEventId 190 -Verbosity 3 -IncludeMessage "*'NAME OF THE JOB'*’STATUS OF THE JOB’*" -After 24h -critical 1:
I can also check the actual presence of the backup files using icinga-powershell-check-directory, which allows me to check whether or not the backup file is present.
Again we set the various variables as needed before we test the command in PowerShell. Here’s an example command:
Invoke-IcingaCheckDirectory -Path D:\Veeam_Repository\Backup\ -FileNames *.vib -Critical 1: -ChangeYoungerThan 80m -FileSizeGreaterThan 100MB
In the end we’ll have two commands along with the service templates that can use them on the Veeam host, and we can therefore satisfy our customer’s use case: monitoring whether in the last X hours a Veeam job has run correctly and has produced a file of at least X megabytes contained in a particular path.