Veeam ONE v13: Reporting and Alerting Setup

Veeam v13 Series Component: Veeam ONE v13 Platform: Windows (Veeam ONE server) + VBR v13 or v12.3.x
Veeam ONE Reporting Alerting Monitoring Veeam Analytics Service VBR Integration

Veeam ONE v13 is a substantial release. The monitoring and reporting engine has been rebuilt: a new PostgreSQL-powered reporting database replaces the SSRS-based backend that has been there since the beginning, data collection has shifted from a WMI-and-remote-agent pull model to a push-based Veeam Analytics Service installed on each VBR server, and reports are now accessible directly inside the VBR backup console without opening a separate application. The web client has been redesigned with a visual report catalog, a background report download queue, and three UI themes.

If you are configuring Veeam ONE from scratch against a v13 VBR server, or upgrading from v12 and wondering what changed, this article covers the complete setup sequence: connecting VBR via the new Analytics Service, configuring SMTP and email notifications, setting up and customizing alarms, scheduling report distribution, and the recommended alarm set for a production environment.

License Requirement Veeam ONE is included with Veeam Data Platform Advanced and Premium editions. It is not included with the Foundation tier. The VBR console integration (reports visible inside the backup console) also requires a VBR license that includes ONE.

1. What Changed in v13: Architecture Overview

Understanding the architecture changes matters because they affect how you connect VBR, what firewall rules are needed, and what you see during setup.

Monitoring database
SQL Server (unchanged)
Real-time alarm state, event data, infrastructure inventory. Still on SQL Server in v13. PostgreSQL migration for this component is planned for a future release.
Reporting database (NEW v13)
PostgreSQL
Historical report data and data warehouse. Replaces SSRS. Dramatically faster report generation. Bundled PostgreSQL 17.6 instance -- same version as VBR v13.
Data collection (CHANGED v13)
Veeam Analytics Service
Agent installed on each VBR server. VBR pushes data to ONE on port 2805. Replaces the pull-based WMI model. Required for VSA (Linux appliance) monitoring.

Connection Direction Change

In v12 and earlier, Veeam ONE connected outbound to VBR servers on port 2805 to pull data. In v13, the direction reverses: the Veeam Analytics Service installed on each VBR server connects inbound to Veeam ONE on port 2805. This is a breaking change for environments with microsegmentation or strict firewall rules. If you are upgrading from v12 with a locked-down network, update your firewall rules to allow inbound TCP 2805 to the Veeam ONE server from each VBR server before upgrading.

VersionConnection DirectionPortProtocol
Veeam ONE v12 and earlierONE server → VBR server2805TCP outbound from ONE
Veeam ONE v13VBR server → ONE server2805TCP inbound to ONE
Legacy Fallback Mode If the Veeam Analytics Service cannot be installed on a VBR server (for example, when monitoring older v12.x VBR instances that are not yet upgraded), Veeam ONE v13 falls back to the legacy WMI-based collection mode. This requires the original wide port range documented in the Veeam ONE ports guide. The fallback should be treated as temporary -- upgrade VBR servers to enable the Analytics Service and simplify firewall rules.

2. Connecting VBR to Veeam ONE: The Veeam Analytics Service

When you add a VBR v13 server to Veeam ONE, the installer automatically pushes the Veeam Analytics Service to the VBR server. This is distinct from previous versions where you simply entered credentials and ONE connected remotely. The user account you provide in Veeam ONE to connect to VBR must have the Veeam Backup Administrator role on the VBR server.

Adding a VBR v13 Server (Windows)

1
Open the Veeam ONE Web UI

Navigate to https://<veeam-one-server>/ and log in. Go to Configuration > Data Collection > Veeam Backup and Replication. Click Add.

2
Enter VBR server address and credentials

Enter the FQDN or IP of the VBR server. Provide credentials for an account with the Veeam Backup Administrator role. The account must have already completed its first login on the VBR server if it is a local VSA account -- the DISA STIG policy on the Software Appliance requires a password change on first login; that must be done before this step or the connection will fail with a "restricted permissions" error.

3
Accept the certificate and install the Analytics Service

Veeam ONE connects, displays the VBR server certificate thumbprint for verification, and then pushes the Veeam Analytics Service installer to the VBR server. The install runs silently on the VBR server. Data collection begins automatically once the service is running.

4
Enable VBR console integration (optional)

In the server's connection settings, check Allow Veeam Backup and Replication console to display analytics data. This is what enables the Reports tab inside the VBR backup console. Only one Veeam ONE instance can be registered per VBR server for this integration at a time.

Adding a VBR Server Running on the Veeam Software Appliance (VSA)

The VSA is a hardened Linux appliance with Zero Trust principles enforced. The automated Analytics Service push requires explicit approval by a Security Officer on the VSA side before the connection is permitted. There are two approaches:

Method 1 -- Online (Credential-Based)
Add the VBR server in Veeam ONE as above. On the VSA Host Management Console, navigate to Backup Infrastructure and approve the incoming Data Collection connection request. The Security Officer must approve it. Once approved, the Analytics Service installs and data collection begins. You can then remove the VBR credentials from Veeam ONE if desired.
Method 2 -- Offline Bundle (No Credentials Stored)
In Veeam ONE Web UI: Configuration > Data Collection > Veeam Analytics Service > Download Package > Linux. Transfer VeeamAnalyticsService.bndl to the VSA. Upload via the Veeam Updater Web UI on the VSA. Security Officer approves the connection. No VBR credentials are stored in Veeam ONE at any point -- the most secure option for VSA deployments.

3. VBR Console Integration: Reports in the Backup Console

One of the headline features of v13 is that Veeam ONE reports are accessible directly from the VBR backup console -- both the thick Windows client and the new Web UI. You no longer need to open a separate Veeam ONE window to run a Protected VMs summary or a Backup Job Statistics report. The integration surfaces a Reports tab inside the VBR console that connects directly to the registered Veeam ONE instance.

How it works The "Allow VBR console to display analytics data" checkbox in Veeam ONE's connection settings for a VBR server is the toggle that enables this. Only one Veeam ONE server can be the source for a given VBR console. If you move a VBR server between Veeam ONE instances, clear the checkbox on the old instance before enabling it on the new one, or the VBR server will remain registered to the old instance and the Reports tab will show stale data.

What Appears in the VBR Console

The Reports tab inside the VBR console shows the same report catalog available in the Veeam ONE Web UI, filtered to the reports most relevant to backup operations: protected workloads, backup job status, backup window compliance, repository capacity, and RPO status. The report viewer is embedded -- you can run, filter, and schedule reports without leaving the VBR console. Reports generated in the background are queued in the Download Queue, allowing you to keep working while large reports render.

4. Configuring Email Notifications

Both monitoring alarms and scheduled reports use the same SMTP configuration. Set this up before configuring any alarm notification settings.

Configuring SMTP (All Authentication Types)

1
Open Mail Server Settings

Veeam ONE Client: Settings > Server Settings > Mail Server Settings tab. Check Enable email notifications.

2
Select authentication type

Choose from the drop-down: Custom SMTP (Basic authentication), Microsoft 365, or Google Gmail. For Microsoft 365 and Gmail, click Authorize Now and complete the OAuth flow in your browser. For custom SMTP, enter the server FQDN/IP, port (default 25), and optional credentials. Specify the From address displayed on all outbound notifications.

3
Test and save

Click Send Test Email, enter a recipient address, and confirm the test message arrives. Save settings. This SMTP configuration is shared by alarm notifications, scheduled report emails, and dashboard emails.

FieldNotes
SMTP ServerFQDN or IP. Default port 25. Change port if using 587 (STARTTLS) or 465 (SSL).
AuthenticationBasic (username/password), Microsoft 365 OAuth, Gmail OAuth. OAuth options require clicking Authorize Now and completing browser redirect.
From AddressDisplayed in the From field of all outbound notifications. Use a monitored alias like veeam-alerts@domain.com rather than an individual mailbox.
TimeoutConnection timeout in milliseconds. Default is adequate for LAN. Increase for slow relay hosts.
Email FormatHTML (default, richer formatting) or plain text. Set in the Email format section of Mail Server Settings.

Configuring the Default Notification Group

Rather than specifying recipients on every individual alarm, configure a default notification group that applies to all alarms by default. Any alarm that has "Send email to default group" selected will deliver to every recipient in this group.

In the Veeam ONE Client: Settings > Server Settings > Notification Settings tab. In the default notification group section, add email addresses and assign each one a notification level:

Notification LevelWhen Email is SentTypical Assignment
Any StateEvery status change: Error, Warning, Info, or ResolvedMonitoring team inbox, ticketing integration relay
Errors and WarningsStatus changes to Error or Warning onlyOn-call engineers, team lead
Errors OnlyStatus changes to Error onlyEscalation contacts, management
ResolvedWhen alarm status returns to ResolvedOptional -- useful for tracking mean time to resolution

5. Alarm Fundamentals: Severity, States, and Scope

Veeam ONE uses a consistent alarm model across all monitored objects. Understanding it before configuring alarms saves time troubleshooting unexpected notification behavior.

Alarm States

StateMeaningDefault Behavior
Resolved Condition that triggered the alarm no longer exists Notification sent if Resolved level is configured. Alarm clears from the active alarm list.
Info Informational -- no action required, but condition is noteworthy Notification sent if Any State level is configured
Warning Approaching threshold or degraded condition Notification sent if Errors and Warnings or Any State
Error Threshold breached or job failed Notification sent at all configured levels

Alarm Scope

Alarms apply to specific object types: virtual machines, backup jobs, repositories, proxies, the backup server itself, etc. Each alarm definition specifies what object type it monitors. You can assign alarms to all objects of a type (global scope), to specific Business View groups (scoped), or suppress alarms for specific objects using exclusions.

All predefined alarms are enabled by default with default thresholds. In most environments you will want to tune thresholds rather than creating alarms from scratch. Suppressing noisy alarms early reduces alarm fatigue and keeps the active alarm list meaningful.

6. Configuring Alarms: Per-Alarm Notification Actions

In the Veeam ONE Client, go to Alarms in the left navigation tree. Right-click any alarm and select Edit to open its settings. The Notifications tab is where you define what happens when the alarm fires.

Available Notification Actions Per Alarm

ActionNotes
Send email to default group Default action applied to all alarms. Delivers to the default notification group configured in Server Settings. Enabled by default for all predefined alarms.
Send email to Business View group owner Delivers to the email address specified as the owner of the Business View group the alarmed object belongs to. Useful for tenant or department-scoped notification without maintaining per-alarm recipient lists.
Send email notification Delivers to a specific recipient list for this alarm only. Separate multiple addresses with semicolons, commas, or spaces. Use this for escalation paths on critical alarms -- for example, send repository full alarms to infrastructure leads in addition to the default group.
Send SNMP trap Sends an SNMP trap to configured trap receivers. Requires SNMP to be configured in Server Settings first. Covered in Section 7.
Run script Executes an executable on the Veeam ONE server when the alarm fires. Passes alarm context as command-line parameters. Useful for ticketing system integration or automated remediation. Covered in Section 7.

Condition Triggers for Actions

Each action on an alarm can be configured to fire on specific state changes only, rather than all state changes:

ConditionFires When
Errors and WarningsAlarm changes to Error or Warning state
Errors OnlyAlarm changes to Error state only
ResolvedAlarm returns to Resolved state
Any StateAny state change

You can stack multiple actions on the same alarm with different conditions. For example: send to default group on Errors and Warnings, plus send SNMP trap on Errors Only, plus run a ticketing script on Errors Only. All three actions would be listed under the alarm's notification tab.

Tuning Alarm Thresholds

In the alarm editor, the Alarm Settings tab contains the threshold configuration. Repository alarms have Warning and Error thresholds for free space percentage and absolute free space. Backup job duration alarms have thresholds for job duration and backup window boundaries. Adjust these before going live -- the defaults are conservative and will produce noise in most environments on day one.

7. SNMP Traps and Custom Script Actions

SNMP Traps

Configure SNMP trap delivery in the Veeam ONE Client: Settings > Server Settings > SNMP Settings. Enter the trap receiver hostname/IP, port (default 162), and community string. SNMP v2c is supported. Once configured, add "Send SNMP trap" actions to individual alarms as described in Section 6.

Custom Script Actions

The Run Script action is the most flexible integration point Veeam ONE exposes. The executable must reside on the Veeam ONE server. Veeam ONE passes the following parameters to the command line when calling the script:

ParameterValue Passed
%1Alarm name
%2Affected node (object) name
%3Alarm summary text
%4Date and time the alarm was triggered
%5Current alarm status
%6Previous alarm status
%7Unique ID for the alarm+object combination
%8Type of child alarm object (for compound alarms)

A PowerShell wrapper is the most common implementation. Create a .ps1 that accepts these positional parameters and calls your ticketing system API, sends a Teams/Slack webhook, or writes to a log file. Then wrap it in a .cmd or .exe launcher since Veeam ONE requires a direct executable path, not a script path.

# Example wrapper: C:\VeeamONE\scripts\alarm-webhook.cmd # Called by Veeam ONE with %1-%8 as positional args @echo off pwsh.exe -NonInteractive -ExecutionPolicy Bypass ^ -File "C:\VeeamONE\scripts\Send-AlarmWebhook.ps1" ^ -AlarmName "%1" -NodeName "%2" -Summary "%3" ^ -TriggeredAt "%4" -Status "%5" -PrevStatus "%6"
Note Scripts run under the Veeam ONE service account. Ensure that account has the necessary permissions to reach your ticketing system, webhook endpoint, or log destination. Test scripts manually from the command line as that account before attaching them to alarms.

8. Working with the New Report Catalog

The report catalog in v13 has been fully redesigned. The old flat list is replaced with a visual tile grid showing thumbnail previews, tags, and purpose labels for each report. A Global Search covers report names, descriptions, dashboards, and widgets -- start typing on the main screen and results appear in real time without navigating the catalog first.

Report Organization

Reports are organized by category. The main categories relevant to VBR environments are:

CategoryKey Reports
Backup Protected VMs, Backup Job Statistics, Backup SLA, Failed Job History, Backup Windows Compliance, Job Session History
Capacity Planning Repository Capacity, Repository Growth Trend, Backup Storage Consumption, Object Storage Usage
Infrastructure Managed Servers Overview, Proxy Performance, Infrastructure Health, License Usage
VM VM Change Rate, VM Configuration Changes, Unprotected VMs (critical for coverage audits)
Alerts Alarm History, Active Alarms Summary, Alarm Statistics by Object

Customizing Reports

Click any report tile to open it. Reports are interactive -- columns can be shown or hidden, data can be sorted and grouped, and filters can be applied without re-running the report. For VBR reports, you can filter by backup server, job, repository, proxy, or workload. Drag column headers to reorder. Export to PDF, CSV, or Excel from the report toolbar.

The Report Download Queue is new in v13. When generating large reports (organization-wide job history, annual capacity trends), click Generate and continue working. The report renders in the background and appears in the queue in the top-right corner of the web client when ready.

9. Scheduling and Distributing Reports

Schedule any report or dashboard for automatic email distribution. In the report view, click the Schedule icon (clock) in the toolbar. This opens the scheduling dialog.

1
Set schedule frequency

Daily, weekly, or monthly. For daily: choose time of day. For weekly: choose day of week and time. For monthly: choose day of month and time.

2
Choose output format

PDF is the standard for distribution. CSV is useful for reports consumed by other tooling. HTML sends an inline report in the email body. All formats are available.

3
Configure recipients

Enter recipient email addresses. Each scheduled report has its own recipient list independent of the alarm notification group. Multiple addresses separated by semicolons.

4
Save and verify

Click Save. Use the Send Now button to test delivery immediately before the first scheduled run. Confirm the report arrives at all recipient addresses and that formatting is correct.

Recommended Report Schedule for Production Environments

ReportScheduleRecipientsPurpose
Protected VMsWeekly, Monday morningBackup team, managementConfirms coverage -- flags any VM that fell out of protection
Backup Job StatisticsDaily, 06:00Backup teamMorning operational review -- shows prior night's job outcomes
Failed Job HistoryDaily, 06:00Backup team, escalationImmediate visibility on failures before business hours
Backup SLA (RPO Compliance)Weekly, MondayManagement, complianceSLA reporting -- shows % of workloads meeting RPO targets
Repository CapacityWeekly, MondayInfrastructure leadsStorage planning and trending
License UsageMonthly, 1st of monthIT managementLicense consumption tracking and renewal planning
Unprotected VMsWeekly, MondayBackup team, security teamCoverage audit -- any VM not in a job is a gap

10. Business View: Scoping Reports and Alarms

Business View is Veeam ONE's grouping and organizational layer. It lets you create logical groups of objects -- VMs, backup jobs, infrastructure components -- and use those groups as report scopes, alarm scopes, and notification targets. For MSPs and multi-tenant environments, Business View groups map naturally to customers or service tiers. For enterprises, they map to business units, locations, or application tiers.

Creating Business View Groups

In the Veeam ONE Client, navigate to Business View. Right-click to add a new category or group. Groups can be populated:

Population MethodBest For
Static membership -- manually add specific VMs or objectsSmall fixed sets, critical application tiers
Dynamic -- membership rules based on VM name patterns, tags, custom attributes, folder, datastore, or clusterLarge environments, auto-inclusion of new VMs matching the pattern
vSphere tagsEnvironments already tagging VMs by tier, owner, or application in vCenter

Each group can have an owner email address assigned. This owner address is used by the "Send email to Business View group owner" alarm action -- the owner of the group containing the alarmed object receives the notification. This is the right pattern for delegating alarm notification to business unit contacts without giving them access to the Veeam ONE console.

Using Business View for Report Scoping

When running or scheduling a report, the scope filter includes Business View groups as available targets. Run a Protected VMs report scoped to a specific customer's Business View group and you get a customer-specific coverage report without exposing other tenants' data. Schedule it on a monthly cadence and send it to the customer contact's email -- this is the foundation of backup service reporting for MSPs.

All predefined alarms are enabled by default. The following are the ones that matter most in practice. Focus on tuning these first rather than trying to review all 200-plus predefined alarms at once.

AlarmDefault ThresholdRecommended Tuning
Backup job failed Any failure = Error No tuning needed. Keep on default. Pair with a Run Script action to auto-create tickets.
Backup job ran longer than X hours 8 hours = Warning, 12 hours = Error Adjust to your backup window. If backup window ends at 07:00, set Warning to trigger at 06:00.
Backup repository free space Warning at 20%, Error at 10% Adjust upward for fast-growing repositories. Warning at 30%, Error at 20% is safer in most environments. Also set absolute thresholds (e.g. Warning at 500 GB free, Error at 200 GB).
VM is not backed up 24 hours without a successful backup = Warning; 48 hours = Error Default thresholds are reasonable. Consider scoping this alarm to a Business View group that excludes intentionally-excluded VMs to reduce noise.
Backup proxy is not responding N/A -- object state change No threshold to tune. Ensure this triggers for all proxies. Add a separate specific recipient for infrastructure engineers.
Veeam Backup service is not running N/A -- object state change Critical. Add an escalation recipient. This alarm fires when the main VBR service stops -- a sign of serious infrastructure problems.
Repository immutability window expiring 30 days before expiry = Warning If using immutable repositories, this is critical. Tune warning lead time based on your change approval cycle.
Backup copy job failed Any failure = Error Keep on default. Off-site copy failure is often overlooked until a restore is needed.
Object storage capacity Warning at 80%, Error at 90% Tune to match your cloud storage cost thresholds. For capacity-on-demand storage (AWS S3, Azure Blob), cost may matter more than hard limits.
Alarm Fatigue Management The single biggest Veeam ONE operational problem is alarm fatigue from improperly tuned thresholds. A Veeam ONE deployment where the active alarm list has 300 entries constantly is effectively useless -- engineers stop looking at it. Set thresholds aggressively on day one, then review the active alarm list weekly for the first month and tune anything that fires more than twice a week without resulting in action.

Key Takeaways

  • Veeam ONE v13 introduces the Veeam Analytics Service: an agent installed on each VBR server that pushes data to ONE on port 2805. The connection direction is reversed from v12. Update firewall rules before upgrading in microsegmented environments.
  • For VBR servers running on the Veeam Software Appliance (Linux), the Analytics Service installation requires explicit Security Officer approval via Host Management Console. The offline bundle method avoids storing VBR credentials in Veeam ONE entirely.
  • Reports are now accessible inside the VBR backup console (both thick client and Web UI) when the "Allow VBR console to display analytics data" checkbox is enabled in Veeam ONE's connection settings for that VBR server.
  • The reporting database is now PostgreSQL, replacing SSRS. Report generation is significantly faster, and large reports can be queued in the background Download Queue.
  • SMTP configuration is shared between alarm notifications and scheduled reports. Set up SMTP first and send a test email before configuring any alarm settings.
  • The default notification group is the right place to configure your monitoring team recipients -- all alarms default to sending to this group unless overridden per alarm.
  • The Run Script alarm action accepts 8 command-line parameters (alarm name, object name, summary, timestamp, status, prior status, ID, child type) and is the primary integration point for ticketing systems and chat webhooks.
  • Business View groups enable per-tenant and per-department report scoping and alarm notification delegation -- essential for MSPs and large enterprise environments.
  • Tune alarm thresholds in the first week. Alarm fatigue from default thresholds that don't fit your environment renders the monitoring layer ineffective. Review the active alarm list weekly for the first month.

Read more