Veeam ONE v13: Reporting and Alerting Setup
In This Article
- What Changed in v13: Architecture Overview
- Connecting VBR to Veeam ONE: The Veeam Analytics Service
- VBR Console Integration: Reports in the Backup Console
- Configuring Email Notifications
- Alarm Fundamentals: Severity, States, and Scope
- Configuring Alarms: Per-Alarm Notification Actions
- SNMP Traps and Custom Script Actions
- Working with the New Report Catalog
- Scheduling and Distributing Reports
- Business View: Scoping Reports and Alarms
- Recommended Alarms for Production Environments
- Key Takeaways
Veeam ONE v13 is a substantial release. The monitoring and reporting engine has been rebuilt: a new PostgreSQL-powered reporting database replaces the SSRS-based backend that has been there since the beginning, data collection has shifted from a WMI-and-remote-agent pull model to a push-based Veeam Analytics Service installed on each VBR server, and reports are now accessible directly inside the VBR backup console without opening a separate application. The web client has been redesigned with a visual report catalog, a background report download queue, and three UI themes.
If you are configuring Veeam ONE from scratch against a v13 VBR server, or upgrading from v12 and wondering what changed, this article covers the complete setup sequence: connecting VBR via the new Analytics Service, configuring SMTP and email notifications, setting up and customizing alarms, scheduling report distribution, and the recommended alarm set for a production environment.
1. What Changed in v13: Architecture Overview
Understanding the architecture changes matters because they affect how you connect VBR, what firewall rules are needed, and what you see during setup.
Connection Direction Change
In v12 and earlier, Veeam ONE connected outbound to VBR servers on port 2805 to pull data. In v13, the direction reverses: the Veeam Analytics Service installed on each VBR server connects inbound to Veeam ONE on port 2805. This is a breaking change for environments with microsegmentation or strict firewall rules. If you are upgrading from v12 with a locked-down network, update your firewall rules to allow inbound TCP 2805 to the Veeam ONE server from each VBR server before upgrading.
| Version | Connection Direction | Port | Protocol |
|---|---|---|---|
| Veeam ONE v12 and earlier | ONE server → VBR server | 2805 | TCP outbound from ONE |
| Veeam ONE v13 | VBR server → ONE server | 2805 | TCP inbound to ONE |
2. Connecting VBR to Veeam ONE: The Veeam Analytics Service
When you add a VBR v13 server to Veeam ONE, the installer automatically pushes the Veeam Analytics Service to the VBR server. This is distinct from previous versions where you simply entered credentials and ONE connected remotely. The user account you provide in Veeam ONE to connect to VBR must have the Veeam Backup Administrator role on the VBR server.
Adding a VBR v13 Server (Windows)
Navigate to https://<veeam-one-server>/ and log in. Go to Configuration > Data Collection > Veeam Backup and Replication. Click Add.
Enter the FQDN or IP of the VBR server. Provide credentials for an account with the Veeam Backup Administrator role. The account must have already completed its first login on the VBR server if it is a local VSA account -- the DISA STIG policy on the Software Appliance requires a password change on first login; that must be done before this step or the connection will fail with a "restricted permissions" error.
Veeam ONE connects, displays the VBR server certificate thumbprint for verification, and then pushes the Veeam Analytics Service installer to the VBR server. The install runs silently on the VBR server. Data collection begins automatically once the service is running.
In the server's connection settings, check Allow Veeam Backup and Replication console to display analytics data. This is what enables the Reports tab inside the VBR backup console. Only one Veeam ONE instance can be registered per VBR server for this integration at a time.
Adding a VBR Server Running on the Veeam Software Appliance (VSA)
The VSA is a hardened Linux appliance with Zero Trust principles enforced. The automated Analytics Service push requires explicit approval by a Security Officer on the VSA side before the connection is permitted. There are two approaches:
3. VBR Console Integration: Reports in the Backup Console
One of the headline features of v13 is that Veeam ONE reports are accessible directly from the VBR backup console -- both the thick Windows client and the new Web UI. You no longer need to open a separate Veeam ONE window to run a Protected VMs summary or a Backup Job Statistics report. The integration surfaces a Reports tab inside the VBR console that connects directly to the registered Veeam ONE instance.
What Appears in the VBR Console
The Reports tab inside the VBR console shows the same report catalog available in the Veeam ONE Web UI, filtered to the reports most relevant to backup operations: protected workloads, backup job status, backup window compliance, repository capacity, and RPO status. The report viewer is embedded -- you can run, filter, and schedule reports without leaving the VBR console. Reports generated in the background are queued in the Download Queue, allowing you to keep working while large reports render.
4. Configuring Email Notifications
Both monitoring alarms and scheduled reports use the same SMTP configuration. Set this up before configuring any alarm notification settings.
Configuring SMTP (All Authentication Types)
Veeam ONE Client: Settings > Server Settings > Mail Server Settings tab. Check Enable email notifications.
Choose from the drop-down: Custom SMTP (Basic authentication), Microsoft 365, or Google Gmail. For Microsoft 365 and Gmail, click Authorize Now and complete the OAuth flow in your browser. For custom SMTP, enter the server FQDN/IP, port (default 25), and optional credentials. Specify the From address displayed on all outbound notifications.
Click Send Test Email, enter a recipient address, and confirm the test message arrives. Save settings. This SMTP configuration is shared by alarm notifications, scheduled report emails, and dashboard emails.
| Field | Notes |
|---|---|
| SMTP Server | FQDN or IP. Default port 25. Change port if using 587 (STARTTLS) or 465 (SSL). |
| Authentication | Basic (username/password), Microsoft 365 OAuth, Gmail OAuth. OAuth options require clicking Authorize Now and completing browser redirect. |
| From Address | Displayed in the From field of all outbound notifications. Use a monitored alias like veeam-alerts@domain.com rather than an individual mailbox. |
| Timeout | Connection timeout in milliseconds. Default is adequate for LAN. Increase for slow relay hosts. |
| Email Format | HTML (default, richer formatting) or plain text. Set in the Email format section of Mail Server Settings. |
Configuring the Default Notification Group
Rather than specifying recipients on every individual alarm, configure a default notification group that applies to all alarms by default. Any alarm that has "Send email to default group" selected will deliver to every recipient in this group.
In the Veeam ONE Client: Settings > Server Settings > Notification Settings tab. In the default notification group section, add email addresses and assign each one a notification level:
| Notification Level | When Email is Sent | Typical Assignment |
|---|---|---|
| Any State | Every status change: Error, Warning, Info, or Resolved | Monitoring team inbox, ticketing integration relay |
| Errors and Warnings | Status changes to Error or Warning only | On-call engineers, team lead |
| Errors Only | Status changes to Error only | Escalation contacts, management |
| Resolved | When alarm status returns to Resolved | Optional -- useful for tracking mean time to resolution |
5. Alarm Fundamentals: Severity, States, and Scope
Veeam ONE uses a consistent alarm model across all monitored objects. Understanding it before configuring alarms saves time troubleshooting unexpected notification behavior.
Alarm States
| State | Meaning | Default Behavior |
|---|---|---|
| Resolved | Condition that triggered the alarm no longer exists | Notification sent if Resolved level is configured. Alarm clears from the active alarm list. |
| Info | Informational -- no action required, but condition is noteworthy | Notification sent if Any State level is configured |
| Warning | Approaching threshold or degraded condition | Notification sent if Errors and Warnings or Any State |
| Error | Threshold breached or job failed | Notification sent at all configured levels |
Alarm Scope
Alarms apply to specific object types: virtual machines, backup jobs, repositories, proxies, the backup server itself, etc. Each alarm definition specifies what object type it monitors. You can assign alarms to all objects of a type (global scope), to specific Business View groups (scoped), or suppress alarms for specific objects using exclusions.
All predefined alarms are enabled by default with default thresholds. In most environments you will want to tune thresholds rather than creating alarms from scratch. Suppressing noisy alarms early reduces alarm fatigue and keeps the active alarm list meaningful.
6. Configuring Alarms: Per-Alarm Notification Actions
In the Veeam ONE Client, go to Alarms in the left navigation tree. Right-click any alarm and select Edit to open its settings. The Notifications tab is where you define what happens when the alarm fires.
Available Notification Actions Per Alarm
| Action | Notes |
|---|---|
| Send email to default group | Default action applied to all alarms. Delivers to the default notification group configured in Server Settings. Enabled by default for all predefined alarms. |
| Send email to Business View group owner | Delivers to the email address specified as the owner of the Business View group the alarmed object belongs to. Useful for tenant or department-scoped notification without maintaining per-alarm recipient lists. |
| Send email notification | Delivers to a specific recipient list for this alarm only. Separate multiple addresses with semicolons, commas, or spaces. Use this for escalation paths on critical alarms -- for example, send repository full alarms to infrastructure leads in addition to the default group. |
| Send SNMP trap | Sends an SNMP trap to configured trap receivers. Requires SNMP to be configured in Server Settings first. Covered in Section 7. |
| Run script | Executes an executable on the Veeam ONE server when the alarm fires. Passes alarm context as command-line parameters. Useful for ticketing system integration or automated remediation. Covered in Section 7. |
Condition Triggers for Actions
Each action on an alarm can be configured to fire on specific state changes only, rather than all state changes:
| Condition | Fires When |
|---|---|
| Errors and Warnings | Alarm changes to Error or Warning state |
| Errors Only | Alarm changes to Error state only |
| Resolved | Alarm returns to Resolved state |
| Any State | Any state change |
You can stack multiple actions on the same alarm with different conditions. For example: send to default group on Errors and Warnings, plus send SNMP trap on Errors Only, plus run a ticketing script on Errors Only. All three actions would be listed under the alarm's notification tab.
Tuning Alarm Thresholds
In the alarm editor, the Alarm Settings tab contains the threshold configuration. Repository alarms have Warning and Error thresholds for free space percentage and absolute free space. Backup job duration alarms have thresholds for job duration and backup window boundaries. Adjust these before going live -- the defaults are conservative and will produce noise in most environments on day one.
7. SNMP Traps and Custom Script Actions
SNMP Traps
Configure SNMP trap delivery in the Veeam ONE Client: Settings > Server Settings > SNMP Settings. Enter the trap receiver hostname/IP, port (default 162), and community string. SNMP v2c is supported. Once configured, add "Send SNMP trap" actions to individual alarms as described in Section 6.
Custom Script Actions
The Run Script action is the most flexible integration point Veeam ONE exposes. The executable must reside on the Veeam ONE server. Veeam ONE passes the following parameters to the command line when calling the script:
| Parameter | Value Passed |
|---|---|
| %1 | Alarm name |
| %2 | Affected node (object) name |
| %3 | Alarm summary text |
| %4 | Date and time the alarm was triggered |
| %5 | Current alarm status |
| %6 | Previous alarm status |
| %7 | Unique ID for the alarm+object combination |
| %8 | Type of child alarm object (for compound alarms) |
A PowerShell wrapper is the most common implementation. Create a .ps1 that accepts these positional parameters and calls your ticketing system API, sends a Teams/Slack webhook, or writes to a log file. Then wrap it in a .cmd or .exe launcher since Veeam ONE requires a direct executable path, not a script path.
8. Working with the New Report Catalog
The report catalog in v13 has been fully redesigned. The old flat list is replaced with a visual tile grid showing thumbnail previews, tags, and purpose labels for each report. A Global Search covers report names, descriptions, dashboards, and widgets -- start typing on the main screen and results appear in real time without navigating the catalog first.
Report Organization
Reports are organized by category. The main categories relevant to VBR environments are:
| Category | Key Reports |
|---|---|
| Backup | Protected VMs, Backup Job Statistics, Backup SLA, Failed Job History, Backup Windows Compliance, Job Session History |
| Capacity Planning | Repository Capacity, Repository Growth Trend, Backup Storage Consumption, Object Storage Usage |
| Infrastructure | Managed Servers Overview, Proxy Performance, Infrastructure Health, License Usage |
| VM | VM Change Rate, VM Configuration Changes, Unprotected VMs (critical for coverage audits) |
| Alerts | Alarm History, Active Alarms Summary, Alarm Statistics by Object |
Customizing Reports
Click any report tile to open it. Reports are interactive -- columns can be shown or hidden, data can be sorted and grouped, and filters can be applied without re-running the report. For VBR reports, you can filter by backup server, job, repository, proxy, or workload. Drag column headers to reorder. Export to PDF, CSV, or Excel from the report toolbar.
The Report Download Queue is new in v13. When generating large reports (organization-wide job history, annual capacity trends), click Generate and continue working. The report renders in the background and appears in the queue in the top-right corner of the web client when ready.
9. Scheduling and Distributing Reports
Schedule any report or dashboard for automatic email distribution. In the report view, click the Schedule icon (clock) in the toolbar. This opens the scheduling dialog.
Daily, weekly, or monthly. For daily: choose time of day. For weekly: choose day of week and time. For monthly: choose day of month and time.
PDF is the standard for distribution. CSV is useful for reports consumed by other tooling. HTML sends an inline report in the email body. All formats are available.
Enter recipient email addresses. Each scheduled report has its own recipient list independent of the alarm notification group. Multiple addresses separated by semicolons.
Click Save. Use the Send Now button to test delivery immediately before the first scheduled run. Confirm the report arrives at all recipient addresses and that formatting is correct.
Recommended Report Schedule for Production Environments
| Report | Schedule | Recipients | Purpose |
|---|---|---|---|
| Protected VMs | Weekly, Monday morning | Backup team, management | Confirms coverage -- flags any VM that fell out of protection |
| Backup Job Statistics | Daily, 06:00 | Backup team | Morning operational review -- shows prior night's job outcomes |
| Failed Job History | Daily, 06:00 | Backup team, escalation | Immediate visibility on failures before business hours |
| Backup SLA (RPO Compliance) | Weekly, Monday | Management, compliance | SLA reporting -- shows % of workloads meeting RPO targets |
| Repository Capacity | Weekly, Monday | Infrastructure leads | Storage planning and trending |
| License Usage | Monthly, 1st of month | IT management | License consumption tracking and renewal planning |
| Unprotected VMs | Weekly, Monday | Backup team, security team | Coverage audit -- any VM not in a job is a gap |
10. Business View: Scoping Reports and Alarms
Business View is Veeam ONE's grouping and organizational layer. It lets you create logical groups of objects -- VMs, backup jobs, infrastructure components -- and use those groups as report scopes, alarm scopes, and notification targets. For MSPs and multi-tenant environments, Business View groups map naturally to customers or service tiers. For enterprises, they map to business units, locations, or application tiers.
Creating Business View Groups
In the Veeam ONE Client, navigate to Business View. Right-click to add a new category or group. Groups can be populated:
| Population Method | Best For |
|---|---|
| Static membership -- manually add specific VMs or objects | Small fixed sets, critical application tiers |
| Dynamic -- membership rules based on VM name patterns, tags, custom attributes, folder, datastore, or cluster | Large environments, auto-inclusion of new VMs matching the pattern |
| vSphere tags | Environments already tagging VMs by tier, owner, or application in vCenter |
Each group can have an owner email address assigned. This owner address is used by the "Send email to Business View group owner" alarm action -- the owner of the group containing the alarmed object receives the notification. This is the right pattern for delegating alarm notification to business unit contacts without giving them access to the Veeam ONE console.
Using Business View for Report Scoping
When running or scheduling a report, the scope filter includes Business View groups as available targets. Run a Protected VMs report scoped to a specific customer's Business View group and you get a customer-specific coverage report without exposing other tenants' data. Schedule it on a monthly cadence and send it to the customer contact's email -- this is the foundation of backup service reporting for MSPs.
11. Recommended Alarms for Production Environments
All predefined alarms are enabled by default. The following are the ones that matter most in practice. Focus on tuning these first rather than trying to review all 200-plus predefined alarms at once.
| Alarm | Default Threshold | Recommended Tuning |
|---|---|---|
| Backup job failed | Any failure = Error | No tuning needed. Keep on default. Pair with a Run Script action to auto-create tickets. |
| Backup job ran longer than X hours | 8 hours = Warning, 12 hours = Error | Adjust to your backup window. If backup window ends at 07:00, set Warning to trigger at 06:00. |
| Backup repository free space | Warning at 20%, Error at 10% | Adjust upward for fast-growing repositories. Warning at 30%, Error at 20% is safer in most environments. Also set absolute thresholds (e.g. Warning at 500 GB free, Error at 200 GB). |
| VM is not backed up | 24 hours without a successful backup = Warning; 48 hours = Error | Default thresholds are reasonable. Consider scoping this alarm to a Business View group that excludes intentionally-excluded VMs to reduce noise. |
| Backup proxy is not responding | N/A -- object state change | No threshold to tune. Ensure this triggers for all proxies. Add a separate specific recipient for infrastructure engineers. |
| Veeam Backup service is not running | N/A -- object state change | Critical. Add an escalation recipient. This alarm fires when the main VBR service stops -- a sign of serious infrastructure problems. |
| Repository immutability window expiring | 30 days before expiry = Warning | If using immutable repositories, this is critical. Tune warning lead time based on your change approval cycle. |
| Backup copy job failed | Any failure = Error | Keep on default. Off-site copy failure is often overlooked until a restore is needed. |
| Object storage capacity | Warning at 80%, Error at 90% | Tune to match your cloud storage cost thresholds. For capacity-on-demand storage (AWS S3, Azure Blob), cost may matter more than hard limits. |
Key Takeaways
- Veeam ONE v13 introduces the Veeam Analytics Service: an agent installed on each VBR server that pushes data to ONE on port 2805. The connection direction is reversed from v12. Update firewall rules before upgrading in microsegmented environments.
- For VBR servers running on the Veeam Software Appliance (Linux), the Analytics Service installation requires explicit Security Officer approval via Host Management Console. The offline bundle method avoids storing VBR credentials in Veeam ONE entirely.
- Reports are now accessible inside the VBR backup console (both thick client and Web UI) when the "Allow VBR console to display analytics data" checkbox is enabled in Veeam ONE's connection settings for that VBR server.
- The reporting database is now PostgreSQL, replacing SSRS. Report generation is significantly faster, and large reports can be queued in the background Download Queue.
- SMTP configuration is shared between alarm notifications and scheduled reports. Set up SMTP first and send a test email before configuring any alarm settings.
- The default notification group is the right place to configure your monitoring team recipients -- all alarms default to sending to this group unless overridden per alarm.
- The Run Script alarm action accepts 8 command-line parameters (alarm name, object name, summary, timestamp, status, prior status, ID, child type) and is the primary integration point for ticketing systems and chat webhooks.
- Business View groups enable per-tenant and per-department report scoping and alarm notification delegation -- essential for MSPs and large enterprise environments.
- Tune alarm thresholds in the first week. Alarm fatigue from default thresholds that don't fit your environment renders the monitoring layer ineffective. Review the active alarm list weekly for the first month.