example.yaml

# veeam-vhc-aws.yaml — Full configuration example

global:
  timeout_seconds: 30
  retry_count: 2
  retry_delay_seconds: 5
  # Page size for paginated VBR API calls (sessions, backups). Default: 500
  page_size: 500
  # Max pages per paginated API call before circuit-breaking. Default: 100
  max_pages: 100

  logging:
    # Log level: DEBUG, INFO, WARNING, ERROR (default: DEBUG)
    level: DEBUG
    # Log file path (default: ./veeam-vhc-aws.log)
    file: ./veeam-vhc-aws.log
    # Time-based rotation: midnight, S, M, H, D, W0-W6 (default: midnight)
    rotation_when: midnight
    # Rotation interval count (default: 1)
    rotation_interval: 1
    # Number of rotated log files to keep (default: 30)
    rotation_keep: 30
    # Also log to stderr console (default: true)
    console: true
    # Disk free space threshold as a percentage of total drive capacity (default: 20)
    # Warning fires at exactly this percentage; critical fires for every percent below it.
    # Checked on every run — no deduplication. Set to 0 to disable.
    disk_warning_pct: 20

# Servers to monitor — add as many as needed
# Each entry must have: name, type (vbr or vbaws), url
# Servers >5 automatically run in parallel
servers:
  - name: prod-vbr
    type: vbr
    url: https://vbr-server:9419
    username: DOMAIN\backupadmin
    password: ""
    api_version: "1.3-rev1"
    verify_ssl: true
    # api_version: "1.1-rev2"  # VBR 12.3 and earlier — default is 1.3-rev1 for VBR 13

  - name: prod-vbaws
    type: vbaws
    url: https://vbaws-appliance
    username: admin
    password: ""
    verify_ssl: true

  # Add more servers as needed:
  # - name: dr-vbr
  #   type: vbr
  #   url: https://dr-vbr-server:9419
  #   username: DOMAIN\backupadmin
  #   password: ""
  #   verify_ssl: true

output:
  # JSON to stdout (default)
  - type: json_stdout

  # ntfy push notifications
  # - type: webhook
  #   url: https://ntfy.example.com/veeam-alerts
  #   template: ntfy
  #   min_severity: warning    # only notify on warning+

  # Slack webhook
  # - type: webhook
  #   url: https://hooks.slack.com/services/T.../B.../xxx
  #   template: slack
  #   min_severity: warning

  # Microsoft Teams webhook
  # - type: webhook
  #   url: https://outlook.office.com/webhook/...
  #   template: teams
  #   min_severity: warning

  # PagerDuty Events API v2
  # - type: webhook
  #   url: https://events.pagerduty.com/v2/enqueue
  #   template: pagerduty
  #   min_severity: critical

  # Prometheus pushgateway (push metrics after each run)
  # - type: prometheus
  #   mode: pushgateway
  #   url: localhost:9091          # pushgateway address
  #   job: veeam_vhc_aws          # job label in Prometheus

  # Prometheus HTTP server (expose /metrics endpoint for scraping)
  # - type: prometheus
  #   mode: server
  #   port: 9100                  # port for /metrics endpoint

  # JSON to file
  # - type: json_file
  #   path: /var/log/veeam-vhc-aws.json

  # Email
  # - type: email
  #   smtp_host: smtp.example.com
  #   smtp_port: 587
  #   from_addr: veeam-vhc-aws@example.com
  #   to_addrs: ["ops@example.com"]
  #   min_severity: warning

repo_health:
  enabled: true
  thresholds:
    free_space_warning_pct: 15
    free_space_critical_pct: 5
    rescan_on_unhealthy: true
  include_external_repos: true
  check_external_maintenance: true
  external_maintenance_lookback_hours: 48

retention:
  enabled: true
  thresholds:
    overage_multiplier: 1.5
    max_age_multiplier: 1.5
    orphan_detection: true
  # Backup names to exclude from orphan detection and retention checks
  # exclude_backups:
  #   - marvinvmtest
  #   - old-test-backup

worker_health:
  enabled: true
  lookback_hours: 24
  # Per-policy session scoping (issue #16): the global VBAWS /sessions fetch is capped and can
  # hide sessions for low-frequency policies. When true, sessions are also queried per policy and
  # merged. Default false — the policy route/filter are pending live-appliance confirmation; enable
  # only after validating against your VBAWS version.
  per_job_sessions: false
  thresholds:
    session_failure_rate_warning: 0.1
    session_failure_rate_critical: 0.3
    retention_session_max_failures: 1
    zero_deleted_items_warning: true
    recurring_failure_threshold: 3

error_patterns:
  - pattern: "Access Key Id you provided does not exist"
    severity: critical
    message: "AWS Access Key expired or deleted — rotate credentials in VBR"
    category: credential
    source: vbr
    log_hint: "%ProgramData%\\Veeam\\Backup\\Utils\\ExternalMaintenance\\Agent.ExternalMaintenance.<repo>.log"

  - pattern: "Failed to establish connection to Amazon S3 endpoint"
    severity: critical
    message: "S3 endpoint unreachable — check network, DNS, or endpoint configuration"
    category: auth
    source: vbr

  - pattern: "S3 error:"
    severity: warning
    message: "Generic S3 error detected on external maintenance"
    category: s3
    source: vbr

  - pattern: "not enough free addresses in subnet '(?P<subnet>subnet-[a-z0-9]+)'"
    severity: critical
    message: "Subnet IP exhaustion — workers cannot deploy for retention"
    category: network
    source: vbaws
    extract_fields: [subnet]
    log_hint: "Task.Retention_<backupName>.log"
    remediation: "Add subnets to worker config, increase CIDR range, or reduce MaxParallelTasks"

  - pattern: "No valid combination of the network settings was found"
    severity: critical
    message: "Worker network configuration invalid — check VPC, subnet, security group"
    category: network
    source: vbaws
    log_hint: "Task.Retention_<backupName>.log"

  - pattern: "SSM command .+ hasn't been executed in \\d+ seconds"
    severity: critical
    message: "SSM agent timeout — EC2 instance may be unreachable or SSM agent not running"
    category: ssm
    source: vbaws
    remediation: "Check SSM agent status on target instance, verify IAM role has SSM permissions"

  - pattern: "There are not enough free addresses in subnet"
    severity: critical
    message: "Subnet IP exhaustion — workers cannot deploy for backup"
    category: network
    source: vbaws
    remediation: "Add subnets to worker config, increase CIDR range, or reduce concurrent workers"

  - pattern: "Invalid credentials"
    severity: critical
    message: "Invalid credentials — check IAM access key or role permissions"
    category: credential
    source: vbaws

# Daily summary — sends a complete status digest once per day
# Schedule via setup.ps1 (creates a separate Windows scheduled task)
# Or add a cron job running: veeam-vhc-aws summary -c /path/to/config.yaml
daily_summary:
  enabled: true
  # Optionally use different output handlers for the summary.
  # If omitted, uses the same handlers defined in the output section above.
  # output:
  #   - type: webhook
  #     url: https://ntfy.sh/my-veeam-daily
  #     template: ntfy