Veeam Backup & Replication • Re: Feature request: Syslog message for backup deletion

Hello,

I’m following up on this topic after opening a support ticket with Veeam (#07821896).

@gwyn: In your screenshot, we can see that the restore point is encrypted.

We identified that the issue occurs only when deleting encrypted restore points:
- For non-encrypted jobs, the deletion correctly generates a Windows event (event ID 10050 “Restore Point Deleted”), which is then forwarded to the Syslog server.
- For encrypted jobs, no entry is created in the Windows Event Log, so no Syslog message is generated.

This seems inconsistent because:
- The documentation for event 10050 makes no distinction between encrypted and non-encrypted restore points:
https://helpcenter.veeam.com/docs/backu ... ml?ver=120
- When creating a restore point (event ID 10010), the event is generated for both encrypted and non-encrypted restore points:
https://helpcenter.veeam.com/docs/backu ... ml?ver=120

So we would expect to receive a Syslog message for all deletions, regardless of the restore point type.
And I would argue that tracing a deletion is even more critical than a creation, from an auditing and traceability perspective.

Could you please confirm whether this is a bug or a current limitation?

Thank you,
Have a good day.

Statistics: Posted by C Y R I L — Sep 12, 2025 1:42 pm

---