The Veeam App for Splunk is a free solution provided by Veeam to monitor your backup infrastructure by centralizing backup job statuses into a single Dashboard.
Depending on your installed Splunk version, the application can be deployed in either a Windows or a Linux environment.
Prerequisites
Before beginning the installation, ensure the following prerequisites are met:
- A working Veeam Backup & Replication infrastructure.
- A Linux or Windows machine to install Splunk Enterprise to display data collected by the Veeam application.
- The Veeam App for Splunk downloaded from Splunkbase.
Install Splunk Enterprise on Ubuntu Linux
To avoid Windows licensing fees, a Linux OS is often the ideal choice for running Splunk Enterprise. SSH into your Ubuntu system and follow these steps to install it.
Using the wget command, download the Splunk Debian package in the /tmp folder.
# cd /tmp
# wget -O splunk-10.4.2-33c3bf42cd73-linux-amd64.deb "https://download.splunk.com/products/splunk/releases/10.4.2/linux/splunk-10.4.2-33c3bf42cd73-linux-amd64.deb"
Install the Splunk package. Splunk installs to /opt/splunk by default. Install the .deb package using dpkg.
# sudo dpkg -i splunk-10.4.2-33c3bf42cd73-linux-amd64.deb
Configure Splunk to start automatically when the system boots. The --accept-license flag automatically agrees to the EULA. During this step, you will be prompted to create administrative credentials for the Splunk web interface.
# sudo /opt/splunk/bin/splunk enable boot-start --accept-license
Ensure the splunk system user has the correct read/write permissions for the installation directory.
# sudo chown -R splunk:splunk /opt/splunk
Launch Splunk for the first time running as the splunk user.
# sudo -u splunk /opt/splunk/bin/splunk start
Update the boot-start configuration to ensure Splunk always launches specifically as the splunk user on subsequent reboots.
# sudo /opt/splunk/bin/splunk enable boot-start -user splunk
Install the Veeam App for Splunk
Access the Splunk web interface at http://<IP_Address>:8000. Log in using the admin credentials you created during the initial setup step.
From the main Dashboard, click Manage gear icon.
Click Install App From File in the top-right corner of the screen.
Click Browse to select the Veeam App for Splunk .tgz file you downloaded earlier, then click Upload.
Once the upload finishes, click Close
Configure Data Inputs
Now that the app is uploaded, you must configure a Data Input to collect Syslog data from your Veeam Backup Server.
From the main Dashboard, click Manage then navigate to Settings > Data Inputs.
Locate the UDP row in the Local Inputs section and click Add new.
Select UDP and specify the Port you wish to use. In this example, port 1514 is used instead of the default syslog port 514, as port 514 is often already in use by Ubuntu's native logging services. Click Next.
Configure the Input Settings exactly as follows:
- Source type - select veeam_vbr_syslog
- App context - select Veeam App (VeeamApp)
- Host - select DNS
- Index - leave as Default
Click Review when done.
Verify the settings, and click Submit.
The configuration has been completed successfully.
Configure Syslog in Veeam Backup & Replication
To start forwarding events, you must configure your Veeam Backup & Replication server to send logs to your Splunk instance.
From the Veeam console, navigate to Settings > Options.
Select the Event Forwarding tab and click Add in the Syslog server section. Enter the IP Address or DNS name of your Splunk Server along with the custom port you configured earlier. Ensure the Transport type is set to UDP, then click OK.
Click OK to save and activate the configuration.
Verify data collection in Splunk
Return to the Splunk web interface and click Start Searching.
Within a few moments, Splunk will begin receiving live backup data and populating your dashboard from the Veeam Server.
Accessing the Dashboard
To access the Veeam App for Splunk main Dashboard, navigate to the Splunk web interface and click on the Veeam App icon, which will now be visible in the left-hand navigation pane.
Once backup tasks or jobs are executed on your Veeam Server, the data is collected by Splunk and visually displayed within the app's charts and graphs.
From this point forward, you can efficiently monitor the status of your entire backup infrastructure from a single pane of glass leveraging the Veeam App for Splunk.
