Veeam Backup & Replication

This page gets Collimo reading your Veeam Backup & Replication (B&R) server with a view-only account, so it can show the health of your Veeam server and when each VM was last backed up.

What Collimo reads: every job's last result and next run; how full each repository is; and every machine Veeam holds backups of, with its newest restore point. What it can't: it changes nothing, starts no job, and doesn't read the backups themselves. Collimo watches your backup server; it doesn't make, keep or restore backups of your machines.

What you need: B&R 12 or later. Collimo talks to the REST API the backup server itself serves, on port 9419. Veeam Backup Enterprise Manager and Veeam ONE aren't needed.

Beta

Built from Veeam's published API reference and tested against recorded answers, not yet a real server. If something reads wrong, tell us: Settings → Diagnostics shows what Veeam answered.

Make the view-only account

1. On the Veeam server, or in your domain, make an account for Collimo, such as LAB\collimo, with a long random password.
2. In the Veeam console, open the main menu → Users and Roles.
3. Add the account, and give it the role Veeam Backup Viewer.

No MFA on this account

Veeam's REST API can't sign in an account that has multi-factor sign-in turned on. Veeam's own advice is a service account without it. Keep the account to the Viewer role, which can only look.

Why the panel shows an API revision, not a version

The Viewer role can't read the server's own version from B&R 12.2 on. So Collimo shows the newest REST API revision the server takes, and the release that revision came with: 12.3.1 or later means 12.3.1, or a newer server answering in 12.3.1's terms.

Enter it in the setup wizard

On the wizard's What you have page, set Veeam Backup & Replication to the number you have. On its page:

1. Name: what you call it, such as veeam1.
2. Address: with the port: https://192.168.1.30:9419.
3. User: LAB\collimo.
4. Password: its password.
5. Leave Verify the certificate off, unless the server has a trusted certificate.
6. Click Test.

When it works you see ✓ Connected: and what it found, such as 12 jobs, 2 repositories, 40 machines.

Editing the stack by hand

Each source takes a numbered slot, SOURCE_1 to SOURCE_8, with its secret beside it. Write any $ in the password as $$.

SOURCE_3=veeam https://192.168.1.30:9419 name=veeam1 user=LAB\collimo
SOURCE_3_SECRET=<its password>

Settings → Add a source writes the first line for you. See Every variable.

Where it shows up

Veeam gets a panel on the Virtualization tab: repositories, each job's last run, and the machines longest since a backup. Each VM on vCenter, Proxmox VE or XCP-ng also gets its last backup in Last backup per VM, from whichever backup server holds the newest.

It alerts on:

• a job whose last run failed (critical) or finished with warnings. A disabled job is never judged.
• a repository Veeam reports offline, or one nearly full.

A machine's newest restore point takes one question per machine, so those are read once an hour, up to 500 machines at a time. With more, the panel says how many were read, and the rest follow the next hour.

If something's wrong

What you see	What to do
refused the sign-in for LAB\collimo	Check the password, and that the account has no MFA.
took none of API revisions	The server is older than B&R 12, or isn't a B&R server on that port.
set user= on the slot to the Veeam account	Fill in User.
denied the account access (403); check its role	Give the account the Veeam Backup Viewer role.
Nothing answered at that address and port.	Add the port, :9419, and check the Veeam server's firewall allows it from the Docker host.
The certificate isn't trusted.	Untick Verify the certificate.

See Troubleshooting for more.