Veeam Backup Integration via Syslog

1) Purpose and Scope

When Syslog integration is configured on the Veeam side:

• As soon as a Syslog server is added, Veeam sends a test event to verify communication. 
• Afterwards, all events that Veeam writes to Microsoft Windows Event Log are also forwarded to the Syslog server.

2) Prerequisites

The customer should have the following information ready:

Syslog Server Information

• Syslog server FQDN or IPv4 address 
• Note: IPv6 cannot be entered in this field in the Veeam interface.

Communication Protocol (Transport)

• Supported transport options: UDP, TCP, or TLS

Port Information

Default ports: 

• 514 (TCP and UDP) 
• 6514 (TLS) 

Network/Access

• Network connectivity from the Veeam Backup Server to the Syslog server over the selected port (firewall/ACL rules must allow it).

3) Syslog Message Format (Customer Information)

• Syslog messages sent by Veeam are generated according to RFC 5424. 
• Typical fields included in the message: 
  • TIMESTAMP (with reference to RFC 3339 format) 
  • PRI, HOSTNAME, APP-NAME, STRUCTURED-DATA, MSG 
• Note: The structure and content of the syslog message may vary depending on the target syslog server/agent implementation.

4) Setup – Adding a Syslog Server via Veeam Console (Windows Console)

Steps

1. In the Veeam Backup & Replication Console, go to: Options > Event Forwarding 
2. Under Syslog servers, click Add. 
3. In the Server field, enter the Syslog server FQDN or IPv4 address (IPv6 is not supported). 
4. In the Transport field, select the protocol: TCP / UDP / TLS 
   • Default ports: 514 (TCP/UDP), 6514 (TLS) 
5. Click OK to save.

Expected Behavior

• If the Syslog server is unreachable, Veeam displays an error message in the interface. 
• While adding the Syslog server, Veeam sends a test event to validate communication.

5) Setup – Adding a Syslog Server via Veeam Web UI

Steps

1. Click the Settings (gear) icon on the top bar. 
2. Go to the Event Forwarding tab. 
3. Under Syslog Servers, select New. 
4. In the Server field, enter the Syslog server FQDN or IPv4 address (IPv6 is not supported). 
5. In the Port field, enter the port to be used: 
   • Default: 514 (TCP/UDP), 6514 (TLS) 
6. In the Transport field, select the protocol: TCP / UDP / TLS 
7. Click OK to save.

Updating an Existing Entry

• Select the relevant syslog entry from the list and click Edit to modify it.

6) Event Filtering (Excluding Specific Events)

If the customer does not want certain events to be forwarded to syslog, they can apply filters based on Event ID and severity.

Adding a Filter

1. Options > Event Forwarding 
2. Under Syslog servers, go to Filters 
3. Click Add 
4. Enter the Event ID and select the severity 
5. Click OK

After completing all these steps, you can add your Veeam Backup solution as a log source in Logsign USO.