Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #22343: Veeam Backup & Replication: new REST API based special agent

Component Checks & agents
Title Veeam Backup & Replication: new REST API based special agent
Date Sep 24, 2026
Level Prominent Change
Class New Feature
Compatibility Incompatible - Manual interaction might be required
Checkmk versions & editions
3.0.0b1
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

A new special agent for Veeam Backup & Replication (agent_veeam) is now available, querying the Veeam REST API directly instead of relying on the PowerShell-based agent plug-in. It runs alongside the existing plug-in and can be configured independently.

The special agent requires Veeam Backup & Replication 13.0.1.180 or later (REST API version 1.3-rev1). Against an older backup server, it stops with an error naming the required version.

The new special agent currently provides the following services:

  • Backup job %s, from the veeam_backup_jobs agent section (GET /api/v1/jobs/states), reporting the state and result of each configured backup job and the time since its last run, which the perf-o-meter shows. A disabled job is OK by default, configurable in the Veeam: Backup job rule. The same rule sets levels for the time since the last run, which are not applied to disabled jobs. Disabled jobs are discovered by default; to leave them out, use the Veeam: Backup job discovery rule.
  • Backup %s, from the veeam_backups agent section (GET /api/v1/taskSessions), delivered via piggyback to each protected machine. The time since the last backup is checked against the Veeam: Time since last backup rule, with the same default levels as the plug-in's VEEAM Client service (30 hours/2 days). The summary shows the result, the time since the last backup and the backup size; the perf-o-meter shows the time since the last backup.
  • Veeam License, from the veeam_license agent section (GET /api/v1/license), reporting the license edition, status, expiry, support expiry and consumption. The perf-o-meter shows the time until the license expires.
  • Configuration backup, from the veeam_config_backup agent section (GET /api/v1/configBackup), reporting whether configuration backup is enabled, the time since the last successful backup, restore points kept, encryption and the target repository. The perf-o-meter shows the time since the last successful backup.
  • Backup proxy %s, from the veeam_proxies agent section (GET /api/v1/backupInfrastructure/proxies/states), reporting each proxy's type, description, host, and its online, disabled and out-of-date states. A disabled proxy is OK by default, configurable in the Veeam: Backup proxy rule.
  • Scale-out repository %s, from the veeam_scaleout_repositories agent section (GET /api/v1/backupInfrastructure/scaleOutRepositories), reporting the number of performance extents and their statuses, the capacity and archive tier configuration, and the placement policy.
  • Restore points, from the veeam_restore_points agent section (GET /api/v1/backupObjects and GET /api/v1/restorePoints), delivered via piggyback to each protected machine, reporting the age and type of the last restore point, the number of restore points and the malware status. The perf-o-meter shows the age of the last restore point. Like the Backup services, those of a file share backup go to a host named after the share.
  • Backup repository %s, from the veeam_repositories agent section (GET /api/v1/backupInfrastructure/repositories/states), reporting a backup repository's used space, online and out-of-date states, host, path and description. Each extent of a scale-out repository is discovered as its own service; the scale-out repository itself has no capacity of its own.
  • Protection group %s, from the veeam_protection_groups agent section (GET /api/v1/agents/protectionGroups), reporting each agent protection group's type, number of configured computers (for group types that list them) and description. A disabled protection group is OK by default, configurable in the Veeam: Protection group rule. Reading protection groups requires the Veeam Backup Administrator, Restore Operator or Tape Operator role.
  • Managed server %s, from the veeam_managed_servers agent section (GET /api/v1/backupInfrastructure/managedServers), reporting the type and availability status of each server managed by Veeam (hypervisor hosts, Windows and Linux servers, SMB3 servers), its description and its roles.
  • Replica %s, from the veeam_replicas agent section (GET /api/v1/replicas), reporting each replica's state, type, platform, source job, creation time and ID. By default, a ready replica is OK, a failed over or failing back one is WARN and a failed failover is CRIT, configurable per replica state in the Veeam: Replica rule. CDP replicas are not monitored, as Veeam reports no state for them. The item is the replica's name followed by the first 8 characters of its ID, as replica names are not unique. Reading replicas requires the Veeam Backup Administrator or Restore Operator role.

The special agent also inventorizes the backup server in the HW/SW inventory, from the veeam_server_info agent section (GET /api/v1/serverInfo): its name, build version, platform, configuration database, registration and installed patches. Reading this endpoint requires a more privileged role than read-only monitoring. An account without that role makes the special agent stop; deselect this service (see below), or grant the role.

It also inventorizes the WAN accelerators, from the veeam_wan_accelerators agent section (GET /api/v1/backupInfrastructure/wanAccelerators): one row per accelerator with its description, traffic port, number of streams, high bandwidth mode and cache folder and size. Reading this endpoint requires the Veeam Backup Administrator role.

You can select which services the special agent fetches: every service can be enabled or disabled individually in the rule, and all are enabled by default. Deselect the ones you do not need, for example data your monitoring account cannot read. If a selected service cannot be fetched — because the account lacks a required Veeam role, or for any other reason — the special agent stops and reports the error on the host's Checkmk service, so you can correct the selection or grant the missing permission.

If a host is monitored by both the new special agent and the legacy PowerShell agent plug-in, the new sections take precedence: veeam_backup_jobs supersedes veeam_jobs, and veeam_backups supersedes veeam_client. On such a host, the corresponding old services (from the plug-in) disappear once the new special agent is configured, replaced by the new ones.

The item of the new services is the job name, sanitized as the plug-in does it: spaces and apostrophes are replaced by underscores. The same job thus has the same item on the old and on the new services. A Veeam: Time since last backup rule with an item condition therefore applies to the new Backup service as it did to VEEAM Client.

Compared with the PowerShell agent plug-in, the special agent:

  • Monitors file backup jobs, which the plug-in does not: each gets a Backup job service, and each backed-up file share a Backup and a Restore points service.
  • Shows different data on the Backup service than the plug-in's VEEAM Client:
  • For Veeam Agent backup jobs, the Veeam REST API does not report per-machine details, so the service is based on the job's last session. Its duration covers the whole session, including its start and finish, so it is longer than the machine's processing time that VEEAM Client showed, and the average speed is not reported.
  • For all job types, the backup server is not shown.

Still, Backup job and Backup are new services, not renamed VEEAM Job and VEEAM Client services. Existing graphs, performance data history, and any downtimes or acknowledgements of the old services are lost.

To the list of all Werks