Catch up on the latest product updates, best practices, and expert insights from the Checkmk Conference #12 – Watch the livestream recordings now
back to website

Werk #22343: Veeam Backup & Replication: new REST API based special agent

Component Checks & agents
Title Veeam Backup & Replication: new REST API based special agent
Date Sep 24, 2026
Level Prominent Change
Class New Feature
Compatibility Incompatible - Manual interaction might be required
Checkmk versions & editions
3.0.0b1
Not yet released 		Checkmk Community, Checkmk Pro, Checkmk Ultimate, Checkmk Cloud, Checkmk Ultimate MT

A new special agent for Veeam Backup & Replication (agent_veeam) is now available, querying the Veeam REST API directly instead of relying on the PowerShell-based agent plug-in. It runs alongside the existing plug-in and can be configured independently.

The special agent requires Veeam Backup & Replication 13.0.1.180 or later (REST API version 1.3-rev1). Against an older backup server, it stops with an error naming the required version.

The new special agent currently provides the following services:

  • Veeam Backup job %s, from the veeam_backup_jobs agent section (GET /api/v1/jobs/states), reporting the state and result of each configured backup job and the time since its last run, which the perf-o-meter shows. A disabled job is OK by default, configurable in the Veeam: Backup job rule. The same rule sets levels for the time since the last run, which are not applied to disabled jobs. Disabled jobs are discovered by default; to leave them out, use the Veeam: Backup job discovery rule.
  • Veeam Backup %s, from the veeam_backups agent section (GET /api/v1/taskSessions), delivered via piggyback to each protected machine. The time since the last backup is checked against the Veeam: Time since last backup rule, with the same default levels as the plug-in's VEEAM Client service (30 hours/2 days). The summary shows the result, the time since the last backup and the backup size; the perf-o-meter shows the time since the last backup.
  • Veeam License, from the veeam_license agent section (GET /api/v1/license), reporting the license edition, status, expiry, support expiry and consumption. The perf-o-meter shows the time until the license expires.
  • Veeam Configuration backup, from the veeam_config_backup agent section (GET /api/v1/configBackup), reporting whether configuration backup is enabled, the time since the last successful backup, restore points kept, encryption and the target repository. The perf-o-meter shows the time since the last successful backup.
  • Veeam Backup proxy %s, from the veeam_proxies agent section (GET /api/v1/backupInfrastructure/proxies/states), reporting each proxy's type, description, host, and its online, disabled and out-of-date states. A disabled proxy is OK by default, configurable in the Veeam: Backup proxy rule.
  • Veeam Scale-out repository %s, from the veeam_scaleout_repositories agent section (GET /api/v1/backupInfrastructure/scaleOutRepositories), reporting the number of performance extents and their statuses, the capacity and archive tier configuration, and the placement policy.
  • Veeam Restore points, from the veeam_restore_points agent section (GET /api/v1/backupObjects and GET /api/v1/restorePoints), delivered via piggyback to each protected machine, reporting the age and type of the last restore point, the number of restore points and the malware status. The perf-o-meter shows the age of the last restore point. Like the Veeam Backup services, those of a file share backup go to a host named after the share.
  • Veeam Backup repository %s, from the veeam_repositories agent section (GET /api/v1/backupInfrastructure/repositories/states), reporting a backup repository's used space, online and out-of-date states, host, path and description. Each extent of a scale-out repository is discovered as its own service; the scale-out repository itself has no capacity of its own. The item is the repository type (for an extent, the extent type) and name, followed by the first 8 characters of its ID, as repository names are not unique.
  • Veeam Protection group %s, from the veeam_protection_groups agent section (GET /api/v1/agents/protectionGroups), reporting each agent protection group's type, number of configured computers (for group types that list them) and description. A disabled protection group is OK by default, configurable in the Veeam: Protection group rule. Reading protection groups requires the Veeam Backup Administrator, Restore Operator or Tape Operator role.
  • Veeam Managed server %s, from the veeam_managed_servers agent section (GET /api/v1/backupInfrastructure/managedServers), reporting the type and availability status of each server managed by Veeam (hypervisor hosts, Windows and Linux servers, SMB3 servers), its description and its roles.
  • Veeam Replica %s, from the veeam_replicas agent section (GET /api/v1/replicas), reporting each replica's state, type, platform, source job, creation time and ID. By default, a ready replica is OK, a failed over or failing back one is WARN and a failed failover is CRIT, configurable per replica state in the Veeam: Replica rule. CDP replicas are not monitored, as Veeam reports no state for them. The item is the replica's name followed by the first 8 characters of its ID, as replica names are not unique. Reading replicas requires the Veeam Backup Administrator or Restore Operator role.

The special agent also inventorizes the backup server in the HW/SW inventory, from the veeam_server_info agent section (GET /api/v1/serverInfo): its name, build version, platform, configuration database, registration and installed patches. Reading this endpoint requires a more privileged role than read-only monitoring. Without that role, the special agent reports a warning (see below); deselect this service or grant the role.

It also inventorizes the WAN accelerators, from the veeam_wan_accelerators agent section (GET /api/v1/backupInfrastructure/wanAccelerators): one row per accelerator with its description, traffic port, number of streams, high bandwidth mode and cache folder and size. Reading this endpoint requires the Veeam Backup Administrator role.

You can select which services the special agent fetches: every service can be enabled or disabled individually in the rule, and all are enabled by default. Deselect the ones you do not need, for example data your monitoring account cannot read. If the account lacks the Veeam role a selected service requires, the special agent still fetches all other services and reports a warning on the host's Check_MK service, naming the section and the denied endpoint, so you can correct the selection or grant the missing permission. The state of this warning is WARN by default; you can change it in the rule Status of the Checkmk services under Individual states per data source > Special agent. While the warning is not OK, the automatic service discovery skips the host. If a selected service cannot be fetched for any other reason, the special agent stops and reports the error on the host's Check_MK service.

If Veeam rejects the login, the special agent stops with an authentication error. After repeated failed logins, Veeam Backup & Replication locks the user and then rejects even the correct password until the user is unlocked. On a Veeam appliance, this happens after 3 failed logins and lasts 15 minutes, or until the user is unlocked manually if a Security Officer is configured (see Unlocking Users in the Veeam documentation). Veeam Backup & Replication on Windows locks users as well. A corrected password in the rule therefore only takes effect once the user is unlocked.

If a host is monitored by both the new special agent and the legacy PowerShell agent plug-in, the new sections take precedence: veeam_backup_jobs supersedes veeam_jobs, and veeam_backups supersedes veeam_client. On such a host, the corresponding old services (from the plug-in) disappear once the new special agent is configured, replaced by the new ones.

The item of the new services is the job name, sanitized as the plug-in does it: spaces and apostrophes are replaced by underscores. The same job thus has the same item on the old and on the new services. A Veeam: Time since last backup rule with an item condition therefore applies to the new Veeam Backup service as it did to VEEAM Client.

Compared with the PowerShell agent plug-in, the special agent:

  • Monitors file backup jobs, which the plug-in does not: each gets a Veeam Backup job service, and each backed-up file share a Veeam Backup and a Veeam Restore points service.
  • Shows different data on the Veeam Backup service than the plug-in's VEEAM Client:
  • For Veeam Agent backup jobs, the Veeam REST API does not report per-machine details, so the service is based on the job's last session. Its duration covers the whole session, including its start and finish, so it is longer than the machine's processing time that VEEAM Client showed, and the average speed is not reported.
  • For all job types, the backup server is not shown.

Still, Veeam Backup job and Veeam Backup are new services, not renamed VEEAM Job and VEEAM Client services. Existing graphs, performance data history, and any downtimes or acknowledgements of the old services are lost.

To the list of all Werks