Veeam Integration for Elastic

Veeam Backup & Replication (VBR) is the backup, replication, and recovery engine of Veeam Data Platform. It creates image-level backups of virtual, physical, and cloud workloads, runs restore and SureBackup verification, and writes a first-party Event ID catalog covering job outcomes, malware detection, authentication, configuration changes, and infrastructure health.

This integration collects that Event Forwarding syslog over TCP or UDP using the Elastic Agent syslog input. It provides visibility into backup and restore job health, ransomware activity against backup infrastructure, user and credential changes, MFA and four-eyes authorization, Cloud Connect tenant activity, and Security & Compliance Analyzer results.

The Veeam integration is compatible with Veeam Backup & Replication 12.1 and later Event Forwarding syslog (RFC 5424). Event catalog coverage is based on VBR 13.1 (338 Event IDs across 12 official categories).

This integration collects Veeam Backup & Replication Event Forwarding syslog over the network.

Veeam Backup & Replication pushes every catalog event to one syslog destination as it is written. The integration uses the Elastic Agent TCP or UDP input with the syslog processor. Each collection cycle:

1. Receives RFC 5424 syslog from the backup server on the configured listen address and port (TCP, UDP, or TCP with TLS).
2. Parses the syslog envelope for timestamp, hostname, APP-NAME (Veeam_MP, Veeam_Security, or Veeam_Backup), and the origin structured-data element (enterpriseId="31023").
3. Extracts the optional [INF] / [WRN] / [ERR] severity token and the event payload (categoryId, instanceId, and PascalCase parameters, including nested XML such as UserFullInfo).
4. Maps instanceId to event.code, copies structured-data parameters under veeam.event.*, applies ECS mappings, categorizes the event using the 12 official Event Reference categories, and emits one document per syslog line.

The Veeam integration collects the following types of data:

• Backup and restore monitoring: Track job start and finish events, task results, and restore-point lifecycle to see whether backups and restores succeed, warn, or fail.

• Ransomware and malware detection: Detect malware activity in backups, restore-point deletion, entropy analysis sessions, and Security & Compliance Analyzer findings against the backup infrastructure.

• Identity and access auditing: Audit MFA enablement and failures, four-eyes authorization requests, user and role changes, credential record updates, and OAuth token activity.

• Configuration and infrastructure changes: Monitor general settings, syslog forwarding, repository and proxy changes, High Availability cluster events, and Cloud Connect tenant, quota, and gateway activity.

• License and plug-in visibility: Track license installation and remaining days, and application backup policy activity for enterprise plug-ins.

• Elastic Agent version 8.19+ or 9.1.0+ with Fleet enrollment.

• Veeam Backup & Replication 12.1 or later with a paid license. Community Edition does not include Event Forwarding.
• Event Forwarding configured to the Elastic Agent host using UDP, TCP, or TLS.
• Network path from the backup server to the Agent listen address and port. Event Forwarding supports IPv4 or FQDN destinations only (IPv6 is not supported).
• TCP framing that matches both sides. Veeam defaults to newline-delimited messages (SyslogTcpUseOctetCount=0). Use RFC 6587 octet-counting only if that setting is enabled on the backup server.
• TLS certificate when Veeam Event Forwarding transport is TLS. Veeam is the TLS client; the Agent presents the server certificate. Veeam does not document mTLS.
• Linux binds to ports below 1024 typically require elevated privileges. This integration defaults to TCP 9604 and UDP 9605. Configure the same port in Veeam Event Forwarding. Veeam product defaults are 514 (UDP/TCP) and 6514 (TLS).

On Veeam Software Appliance, Event Forwarding is configured from the web UI. Elastic Agent cannot be installed on the appliance; the listener must run on a reachable remote host.

Elastic Agent must be installed. For more details, check the Elastic Agent installation instructions. You can install only one Elastic Agent per host.

Elastic Agent is required to receive Event Forwarding syslog and ship the data to Elastic, where the events are processed by the integration ingest pipeline.

Before configuring the integration, enable Event Forwarding on the backup server so Veeam can reach the Elastic Agent listener.

1. In the VBR console, open Options → Event Forwarding → Add, or in the web UI open the gear menu → Event Forwarding → Syslog Servers → New. You can also use Add-VBRSyslogServer or REST PUT /api/v1/generalOptions/eventForwarding.
2. Set the syslog server to the Elastic Agent host FQDN or IPv4 address.
3. Set the port and transport to match this integration: UDP or TCP on the configured listen port, or TLS if you enable SSL on the TCP input.
4. VBR allows one syslog destination per backup server. Adding the server sends a test event; the UI reports an error if the listener is unreachable.
5. Confirm TCP framing. Leave Veeam at newline-delimited messages unless SyslogTcpUseOctetCount is set to 1 (KB4522).

1. In Kibana, navigate to Fleet → Integrations and search for Veeam.

2. Click Add Veeam.

3. Configure the integration settings:

   • Enable Collect Veeam events via TCP and/or Collect Veeam events via UDP to match the transport configured in VBR.
   • Listen Address: Bind address the backup server can reach. Use 0.0.0.0 to listen on all interfaces. localhost blocks remote VBR.
   • Listen Port: Must match Event Forwarding. Defaults are 9604 (TCP) and 9605 (UDP).
   • For TCP with VBR Transport = TLS, configure the SSL server certificate and key under SSL Configuration. Do not require client certificates.
   • Enable Preserve original event if you want a raw copy of the syslog line in event.original.
   • Configure any optional TCP/UDP options or processors as required.

4. Select Save and continue to save the integration.

5. Add the integration to an existing Agent policy or create a new one.

6. Verify that Veeam Event Forwarding events are being ingested into Elasticsearch.

1. In the top search bar in Kibana, search for Dashboards.
2. In the search bar, type Veeam, and verify the dashboard information is populated.

VBR allows one syslog destination per backup server. Multiple backup servers can send to the same Elastic Agent listener. Prefer TCP or TLS over UDP; UDP is lossy, and Veeam documents 10-second TCP timeouts before dropping events.

For more information on architectures that can be used for scaling this integration, check the Ingest Architectures documentation.

• No data collected: Confirm VBR Event Forwarding points at the Agent IPv4 address or FQDN and port, the Agent is healthy and listening, and the listen address is not localhost when VBR is remote.
• TCP framing issues: Check that both sides use the same framing method (newline vs RFC 6587 octet-counting per KB4522).
• TLS handshake failures: Confirm the TCP input SSL certificate is the server certificate Veeam trusts, and that client certificate authentication is not required.
• Privileged port bind failures: Use the integration default high ports (9604 / 9605) and set the same port in VBR, rather than binding the Agent to 514 without elevated rights.
• Mixed appliance syslog: Do not point Veeam Software Appliance Observability → Syslog (OS and audit logs) at this data stream. That payload is not Event Forwarding.
• IPv6 destination: Event Forwarding does not support IPv6 syslog destinations. Use IPv4 or an FQDN that resolves to IPv4.

For help with Elastic ingest tools, check Common problems.

• Veeam Backup & Replication user guide
• Event Forwarding
• Events and event IDs
• Syslog message format (Event Reference)
• Add-VBRSyslogServer
• KB4522 SyslogTcpUseOctetCount

The event data stream provides Event Forwarding syslog from Veeam Backup & Replication. Each document is one catalog event. event.code is the Veeam Event ID (instanceId). Events span the 12 official Event Reference categories: Backup, Restore, Infrastructure Components, Agent Management, Licenses, Cloud Connect, Credential Records, Configuration, Users, Plug-Ins for Enterprise Applications, Malware Detection, and Security & Compliance Analyzer.

{
    "@timestamp": "2026-07-25T12:21:33.216Z",
    "agent": {
        "ephemeral_id": "3ddd43e3-70a9-40b9-9648-c0c1812d00f3",
        "id": "e2306d90-1d10-48e8-b108-24852156d458",
        "name": "elastic-agent-94177",
        "type": "filebeat",
        "version": "8.19.0"
    },
    "data_stream": {
        "dataset": "veeam.event",
        "namespace": "84264",
        "type": "logs"
    },
    "ecs": {
        "version": "9.5.0"
    },
    "elastic_agent": {
        "id": "e2306d90-1d10-48e8-b108-24852156d458",
        "snapshot": false,
        "version": "8.19.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "iam"
        ],
        "code": "42400",
        "dataset": "veeam.event",
        "ingested": "2026-09-23T09:46:08Z",
        "kind": "event",
        "original": "<14>1 2026-07-25T05:21:33.216714-07:00 vbr-01 Veeam_MP - - [origin enterpriseId=\"31023\"] [INF] [categoryId=0 instanceId=42400 Operation=\"Four-eyes authorization has been enabled\" OperationId=\"0\" InitiatorFullInfo=\"<ModifiedUserInfo fullName=\"EXAMPLE\\alice.johnson\" loginType=\"0\" />\" VbrHostName=\"vbr-01.example.local\" VbrVersion=\"13.1.0.411\" Version=\"1\" Description=\"Four-eyes authorization has been enabled by EXAMPLE\\alice.johnson.\"]",
        "provider": "Veeam_MP",
        "type": [
            "info"
        ]
    },
    "host": {
        "name": "vbr-01.example.local"
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "level": "info",
        "source": {
            "address": "172.19.0.3:45010"
        },
        "syslog": {
            "appname": "Veeam_MP",
            "facility": {
                "code": 1,
                "name": "user-level"
            },
            "hostname": "vbr-01",
            "priority": 14,
            "severity": {
                "code": 6,
                "name": "Informational"
            },
            "structured_data": {
                "origin": {
                    "enterpriseId": "31023"
                }
            },
            "version": "1"
        }
    },
    "message": "Four-eyes authorization has been enabled by EXAMPLE\\alice.johnson.",
    "observer": {
        "hostname": "vbr-01",
        "version": "13.1.0.411"
    },
    "related": {
        "hosts": [
            "vbr-01.example.local",
            "vbr-01"
        ],
        "user": [
            "alice.johnson"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "veeam-event"
    ],
    "user": {
        "domain": "EXAMPLE",
        "name": "alice.johnson"
    },
    "veeam": {
        "event": {
            "category_id": "0",
            "enterprise_id": "31023",
            "initiator_full_info": {
                "full_name": "EXAMPLE\\alice.johnson",
                "login_type": "0",
                "original": "<ModifiedUserInfo fullName=\"EXAMPLE\\alice.johnson\" loginType=\"0\" />"
            },
            "operation": "Four-eyes authorization has been enabled",
            "operation_id": "0",
            "version": "1"
        }
    }
}

These inputs can be used with this integration:

ssl.enabled: true
ssl.certificate: "/path/to/server.crt"
ssl.key: "/path/to/server.key"
ssl.certificate_authorities: ["/path/to/ca.crt"]
ssl.client_authentication: "optional"

This integration includes one or more Kibana dashboards that visualizes the data collected by the integration. The screenshots below illustrate how the ingested data is displayed.