Monitoring Altaro VM Backup Jobs with PRTG

Altaro Software is an easy-to-use and reliable solution for backing up the virtual machines from your VMware or Hyper-V hypervisors. By using PRTG Network Monitor, you can get insights into successful and failed onsite or offsite backup copies. Anything happens, your Backup Team will be notified via ticket, email, SMS, push notification to your smartphone, etc.

VMware or Hyper-V virtual machines backup, Offsite backup, Exchange granular restore, Continuous Data Protection (CDP), Augmented Inline Deduplication, WAN-Optimized Replication, Sandbox & Verification, Instant boot from backup, Intuitive user interface, and Cloud-based management console ARE just some of the features supported by Altaro VM Backup.

But, those mentioned features, deployment and configuration procedures might be covered in one of the future articles. Today I´ll talk about monitoring Altaro VM Backup jobs or events with PRTG Network Monitor. Upon completion or failure of the backup or restore jobs, Altaro VM Backup will generate and save log entries in the Windows Application event log file. PRTG can query Windows > Application log file and show returned values within the sensor(s).

What is a sensor in PRTG? In PRTG “Sensors” are the basic monitoring elements. One sensor usually monitors one measured value in your network, e.g. the traffic of a switch port, the CPU load of a server, the free space of a disk drive.

If you are not familiar with PRTG and you´d like to get a better picture in 2 minutes, you can watch the awesome video created by Paessler.

Monitoring of event logs can be achieved by using PowerShell script and/or by using WMI sensors and querying specific IDs generated by Altaro VM Backup.

Altaro VM Backup might be installed on a VM, and it is dependent on the functional and reliable back-end infrastructure. That being said, from a network monitoring standpoint, it is recommended to monitor network devices, hypervisors, guest OSs, storage, etc. For example, to get a better picture of Hyper-V, you can read my article Get more visibility into Hyper-V Server with PRTG.


By using EXE/Script sensor and PowerShell script you can monitor if Altaro has successfully created onsite and/or offsite backup copies. In case of a failed backup, the sensor will go in down-state (red sensor) and the Backup Team will get a notification(s) via email, ticket, SMS, push notification (iOS, Android), or other notification methods.

The EXE/Script sensor runs an executable file (.exe, .dll) or a script (batch file, VBScript, PowerShell) on the probe system. This means you will need to install PRTG remote probe on the same machine as where you installed Altaro VM Backup. The PowerShell script can be copied or downloaded from this LINK. The script should be copied to the local probe or remote probe machine at the following location C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXE.

# Altaro Backup Monitoring
# Description: Modified script by Robert
# Original script: (c) 2014 Stephan Linke | Paessler AG
# Parameters:
# -VM: VM Name
# -BackupType: local or offsite
# -MaxAge: Maximum age of the log entry to be considered checking (in hours)
# -LimitEntries:  Maximum number of entries to check
# -Loglevel: The numerical level of the log file
# -ProviderName: Provider of the Log file
# -EventId: The ID of the Event
# ------------------

    [string]$VM = 'SQL-Srv-2019',
    [string]$BackupType = 'local',
    [int]$MaxAge        = 24,
    [int]$LimitEntries    = 10,
    [string]$LogName    = "Application",
    [string]$ProviderName      = "Altaro VM Backup"

if ($BackupType -eq 'local') { $EventID = 5000 }
elseif ($BackupType -eq 'offsite'){ $EventID    = 5005 }
else { Write-Host "0:Specified BackupType not local or offsite, quitting"; exit 2; }

try { $Events = (Get-WinEvent -FilterHashTable @{ProviderName=$ProviderName;LogName=$LogName;ID=$EventID;StartTime=(get-date).AddHours(-$MaxAge)} -MaxEvents $LimitEntries) }
catch [Exception]
    Write-Host "0:Can't find anything for $ProviderName in your $LogName eventlog. Please check Log name, Provider, Log ID, EventID, ComputerName and Credentials"
    exit 2;

foreach ($i in $Events)
    if ($Events.Message -match 'Guest VM Name: '+$VM) { Write-Host "0:$($BackupType) Backup $VM completed in last $MaxAge hours"; Exit 0; }

Write-Host "2:$($BackupType) Backup $VM failed in last $MaxAge hours"; Exit 2;

You can adjust the following parameters:

  • [string]$VM = ‘SQL-Srv-2019’, – select one or multiple VMs.
  • [string]$BackupType = ‘local’, – define local or ofssite backup, or both
  • [int]$MaxAge = 24, – checking entries in last 24 hours
  • [int]$LimitEntries = 10, – number of entries that should be checked
  • Write-Host “2:$($BackupType) Backup $VM failed in last $MaxAge hours”; Exit 2; – If you want the sensor not to go into an alarm state (red) when a backup fails, but in a warning state (yellow) instead, substitute “exit 2” with “exit 1” in the code.

Once we added the script to mentioned location, it will take a few seconds to add the sensor and get the latest information. As you can see my VM SQL-Srv-2019 is successfully backed up.

How to add EXE/Script sensor

The sensor is working fine and the next step is to configure notification triggers. The Backup Team wants to be notified in case of a failed onsite or offsite backup. We’ll create State Trigger and configure it based on our needs. In my case, if the sensor is in red-state for more than 30 seconds, PRTG will inform Backup Team via ticket. In case the problem is not solved (sensor still in red state), the case will be escalated after 30 minutes (1800 seconds) to IT Admin via SMS, email, ticket, or whatever we choose as a notification method. The procedure of creating notification trigger is shown below.


Altaro VM backup will generate log entries in the Application log file upon completion of the backup jobs. These entries are associated with the following Event IDs:

  • Event ID 5000 – Successful Backup event
  • Event ID 5001 – Warning Backup event
  • Event ID 5002 – Failed Backup event
  • Event ID 5003 – Successful Restore or Verification event
  • Event ID 5004 – Failed Restore or Verification event
  • Event ID 5005 – Successful Offsite Copy event
  • Event ID 5007 – Failed Offsite Copy event

These event IDs can be monitored by using the Event Log (Windows API) sensor and/or WMI Event Log sensor. We can combine multiple IDs in single sensors (Event log Windows API sensor) and/or create separate sensors (WMI Event Log sensor). The procedure of creating sensors and filtering based on IDs is shown below.

Adding WMI Event Log sensor and filtering per failed backup jobs (Event 5002)

The next step is to configure channel limits, which means, in case of value changes for ID 5002 (e.g. backup has failed), the sensor will go in down-state and send a notification to Backup Team.

Configure channel limits

In meantime, we experienced some issues with our Synology DS1821+, and Altaro VM Backup didn’t complete the backup of VM SQL-Srv-2109, and the sensor goes into down- state (red sensor).

Monitoring Failed Onsite Backup Events

PRTG is triggering notification after a defined time (in my case 30 seconds), it is opening a ticket and assigning it to the Backup Team.

PRTG opens ticket and assign it to Backup Team

Using PRTG in heterogeneous infrastructure will save a lot of time and give us the opportunity to be more productive and do our work precisely.

This was just a part of what we can do with PRTG and Altaro. Thank you for reading this article. In case of any questions, feel free to comment or contact me.

Leave a Reply

Your email address will not be published. Required fields are marked *

Share via
Copy link