Security
The following table lists Veeam Backup & Replication events related to security.
Event ID | Message Summary | Message Details | Severity |
|---|---|---|---|
25300 | Credentials record added | Credentials <Credentials> have been added. | Info, Warning, Error |
25400 | Credentials record updated | Credentials <Credentials> have been updated. | Info, Warning, Error |
25500 | Credentials record deleted | Credentials <Credentials> have been deleted. | Info, Warning, Error |
31210 | User or group failed to add | Failed to add a user or a group: <User name/Group name>. | Info |
31600 | Password added to the password manager | Encryption password <Password ID> has been added. | Info, Warning, Error |
31700 | Password stored in the password manager changed | Encryption password <Password ID> has been changed. | Info, Warning, Error |
31800 | Encryption password deleted | Encryption password <Password ID> has been deleted. | Info, Warning, Error |
31900 | SSH credentials updated | SSH options for credentials <Credentials> have been updated. | Info, Warning, Error |
40200 | Global MFA enabled | Multi-factor authentication has been enabled by <Initiator name>. | Info |
40201 | Global MFA disabled | Multi-factor authentication has been disabled by <Initiator name>. | Info |
40202 | MFA reset user token | Multi-factor authentication token has been reset for <User name> by <Initiator name>. | Info |
40203 | User MFA enabled | Multi-factor authentication has been disabled for <User name> by <Initiator name>. | Info |
40204 | User MFA disabled | Multi-factor authentication token has been disabled for <User name> by <Initiator name>. | Info |
40205 | Invalid MFA code | Invalid MFA code has been entered for <User name>. | Info |
40206 | User blocked | <User name> has been locked out by entering too many invalid MFA codes. | Info |
40903 | Object location changed | Object location has been changed. | Info |
41600 | Malware activity detected | Potential malware activity <Activity name> has been detected for <Restore point ID> <Machine name> by <User name>. Rule name: <Rule name>. | Warning |
41610 | Malware detection event resolved | Malware detection event has been resolved for <Restore point ID> by <User name>. False positive: <State>. | Info |
42200 | Malware detection session started | Malware detection session has been started. | Info |
42210 | Malware detection session finished | Malware detection session has been finished with <State>. | Info, Warning, Error |
42220 | Restore point marked as infected | Restore point has been marked as infected by <User name>. | Info |
42230 | Restore point marked as clean | Restore point has been marked as clean by <User name>. | Info |
42260 | Objects added to the malware exclusions list | <N> objects have been added to the malware exclusions list. | Info |
42270 | Objects removed from the malware exclusions list | <N> objects have been removed from the malware exclusions list. | Info |
42280 | Malware exclusions list modified | Malware exclusions list has been modified. | Info |
42290 | Malware detection settings changed | Malware detection settings have been changed. | Info |
42300 | KMS added | KMS server <Host name> has been added. | Info |
42301 | KMS deleted | KMS server <Host name> has been deleted. | Info |
42302 | KMS updated | KMS server <Host name> settings has been changed. | Info |
42400 | Four-eyes authorization enabled | Four-eyes authorization has been enabled by <Initiator name>. | Info |
42401 | Four-eyes authorization disabled | Four-eyes authorization has been disabled by <Initiator name>. | Info |
42402 | Four-eyes authorization request initiated | <Operation name> has been initiated by <Initiator name> and requires an additional approval. | Info |
42403 | Four-eyes authorization request approved | <Operation name> initiated by <Initiator name> has been approved by <User name>. | Info |
42404 | Four-eyes authorization request rejected | <Operation name> initiated by <Initiator name> has been rejected by <User name>. | Info |
42405 | Four-eyes authorization request expired | <Operation name> initiated by <Initiator name> has expired while waiting for additional approval and was auto-rejected. | Info |
42500 | KMS key rotation finished | KMS key rotation has been completed with <State>. | Info |