VEEAM

1. Before You Begin

Step 1:

Verify the Firewall Configuration

a. In the Firewall, the following Custom Port and Protocol must be allowed from the Device to the Forwarder.

Custom Port: 21712
Protocol: TCP

b. In the Firewall, following Hosts must be allowed from the Forwarder to Chronicle.

Connection Type	Destination	Port
TCP	malachiteingestion-pa.googleapis.com	443
TCP	asia-northeast1-malachiteingestion-pa.googleapis.com	443
TCP	asia-south1-malachiteingestion-pa.googleapis.com	443
TCP	asia-southeast1-malachiteingestion-pa.googleapis.com	443
TCP	australia-southeast1-malachiteingestion-pa.googleapis.com	443
TCP	europe-malachiteingestion-pa.googleapis.com	443
TCP	europe-west2-malachiteingestion-pa.googleapis.com	443
TCP	europe-west3-malachiteingestion-pa.googleapis.com	443
TCP	europe-west6-malachiteingestion-pa.googleapis.com	443
TCP	europe-west12-malachiteingestion-pa.googleapis.com	443
TCP	me-central1-malachiteingestion-pa.googleapis.com	443
TCP	me-central2-malachiteingestion-pa.googleapis.com	443
TCP	me-west1-malachiteingestion-pa.googleapis.com	443
TCP	northamerica-northeast2-malachiteingestion-pa.googleapis.com	443
TCP	accounts.google.com	443
TCP	oauth2.googleapis.com	443

Add the below Collector to the Forwarder Config File,

- syslog:
    common:
     enabled: true
     data_type: VEEAM
     data_hint:
     batch_n_seconds: 10
     batch_n_bytes: 1048576
    tcp_address: 0.0.0.0:21712
    udp_address: 0.0.0.0:21712

2. Configuring Syslog

To enable syslog forwarding:

1. Open the burger menu in the Veeam Backup & Replication Console and select Options

2. In the Options dialog, select the Event Forwarding tab.

3. Click Add under Syslog servers.
Enter the fields in the Add Syslog Server

Server: Forwarder IP
Port: 21712
Transport: TCP

4. Click OK and Apply to Save.